sealcode 0.1.0

package/src/verify.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { open, sha256Hex } = require('./crypto');
+const { readManifest } = require('./manifest');
+
+async function runVerify({ projectRoot, config, K, log = () => {} }) {
+  const manifest = readManifest(projectRoot, config.lockedDir, K);
+  const lockedRoot = path.join(projectRoot, config.lockedDir);
+  const issues = [];
+  let okCount = 0;
+
+  for (const entry of manifest.files) {
+    const lockedAbs = path.join(lockedRoot, entry.l);
+    if (!fs.existsSync(lockedAbs)) {
+      issues.push({ path: entry.p, kind: 'missing-blob', detail: entry.l });
+      continue;
+    }
+    let plain;
+    try {
+      plain = open(fs.readFileSync(lockedAbs), K);
+    } catch (err) {
+      issues.push({ path: entry.p, kind: 'decrypt-failed', detail: err.message });
+      continue;
+    }
+    const actual = sha256Hex(plain);
+    if (actual !== entry.h) {
+      issues.push({
+        path: entry.p,
+        kind: 'hash-mismatch',
+        detail: `expected ${entry.h}, got ${actual}`,
+      });
+      continue;
+    }
+    if (typeof entry.s === 'number' && plain.length !== entry.s) {
+      issues.push({
+        path: entry.p,
+        kind: 'size-mismatch',
+        detail: `expected ${entry.s} bytes, got ${plain.length}`,
+      });
+      continue;
+    }
+    okCount++;
+    log(`  ok ${entry.p}`);
+  }
+
+  return { ok: issues.length === 0, total: manifest.files.length, okCount, issues };
+}
+
+module.exports = { runVerify };