stylegallery 0.1.0 → 0.1.2

package/scripts/governed-profile-registry.mjs

@@ -1,125 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import Ajv2020 from "ajv/dist/2020.js";
-import { isPlainObject, validateItemSchema } from "./consumer-reference-schema.mjs";
-import { resolveProfileRecords } from "./profile-record-contract.mjs";
-import { validateReferenceProfile, validateReferenceProfileSet } from "./reference-profile-contract.mjs";
-import { parseStrictJson } from "./strict-json.mjs";
-
-const moduleRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const itemSchema = parseStrictJson(fs.readFileSync(path.join(moduleRoot, "consumer-reference/schema/item.schema.json"), "utf8"));
-const validateFullItemSchema = new Ajv2020({ allErrors: true, strict: false }).compile(itemSchema);
-
-export const canonicalGovernedProfilePaths = Object.freeze([
-  "design-engineering/reference-profiles/governed-local/editorial/profile.json",
-  "design-engineering/reference-profiles/governed-local/terminal/profile.json",
-]);
-
-function finding(code, recordPath, message) {
-  return { code, message, path: recordPath };
-}
-
-function isInside(base, target) {
-  const relative = path.relative(base, target);
-  return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
-}
-
-function resolveRegisteredFile(root, relative, failures) {
-  if (!canonicalGovernedProfilePaths.includes(relative)) {
-    failures.push(finding("profile_registry_unregistered", relative, "profile path is not in the canonical governed profile inventory"));
-    return undefined;
-  }
-  const resolvedRoot = path.resolve(root);
-  const target = path.resolve(resolvedRoot, relative);
-  if (!isInside(resolvedRoot, target) || target !== path.join(resolvedRoot, relative)) {
-    failures.push(finding("profile_registry_path_invalid", relative, "registered profile path must remain normalized and repository-local"));
-    return undefined;
-  }
-  let current = resolvedRoot;
-  for (const segment of relative.split("/")) {
-    current = path.join(current, segment);
-    if (!fs.existsSync(current)) {
-      failures.push(finding("profile_registry_missing", relative, "registered profile path does not exist"));
-      return undefined;
-    }
-    if (fs.lstatSync(current).isSymbolicLink()) {
-      failures.push(finding("profile_registry_symlink", relative, "registered profile path must not traverse a symlink"));
-      return undefined;
-    }
-  }
-  if (!fs.lstatSync(target).isFile()) {
-    failures.push(finding("profile_registry_type_invalid", relative, "registered profile must be a regular JSON file"));
-    return undefined;
-  }
-  const realRoot = fs.realpathSync(resolvedRoot);
-  const realTarget = fs.realpathSync(target);
-  if (!isInside(realRoot, realTarget) || realTarget !== path.join(realRoot, relative)) {
-    failures.push(finding("profile_registry_redirect", relative, "registered profile must not resolve through a filesystem redirect"));
-    return undefined;
-  }
-  return realTarget;
-}
-
-export function validateGovernedProfile({ relative, root }) {
-  const failures = [];
-  const file = resolveRegisteredFile(root, relative, failures);
-  if (!file) return { failures, profile: undefined, summary: undefined };
-  let profile;
-  try {
-    profile = parseStrictJson(fs.readFileSync(file, "utf8"));
-  } catch (error) {
-    failures.push(finding("profile_json_invalid", relative, error instanceof Error ? error.message : String(error)));
-    return { failures, profile: undefined, summary: undefined };
-  }
-  if (!validateFullItemSchema(profile)) {
-    for (const error of validateFullItemSchema.errors ?? []) failures.push(finding("item_schema_invalid", relative, `${error.instancePath || "/"} ${error.message}`));
-  }
-  for (const issue of validateItemSchema(profile, itemSchema)) failures.push(finding(issue.code, relative, issue.message));
-  const profileValidation = validateReferenceProfile({ item: profile, relative, root });
-  failures.push(...profileValidation.failures);
-  const records = resolveProfileRecords(path.dirname(file), failures);
-  if (profile.handoff?.status !== "declared" || profile.handoff?.record !== relative) {
-    failures.push(finding("profile_registry_handoff_mismatch", relative, "registered profile handoff must name its exact inventory path"));
-  }
-  if (records?.profile?.id !== profile.id) failures.push(finding("profile_identity_mismatch", relative, "resolved profile identity must match the validated registry item"));
-  return { failures, profile, summary: profileValidation.summary };
-}
-
-export function validateGovernedProfileInventory({ root }) {
-  const records = new Map();
-  const failures = [];
-  const summaries = [];
-  const resolvedRoot = path.resolve(root);
-  if (!fs.existsSync(resolvedRoot) || fs.lstatSync(resolvedRoot).isSymbolicLink() || !fs.lstatSync(resolvedRoot).isDirectory() || fs.realpathSync(resolvedRoot) !== resolvedRoot) {
-    failures.push(finding("profile_registry_root_invalid", resolvedRoot, "governed profile repository root must be a regular non-symlink directory"));
-    return { failures, records };
-  }
-  for (const relative of canonicalGovernedProfilePaths) {
-    const result = validateGovernedProfile({ relative, root });
-    records.set(relative, result);
-    failures.push(...result.failures);
-    if (result.summary) summaries.push(result.summary);
-  }
-  const identities = new Map();
-  for (const [relative, result] of records) {
-    if (!isPlainObject(result.profile) || typeof result.profile.id !== "string") continue;
-    const previous = identities.get(result.profile.id);
-    if (previous) failures.push(finding("profile_registry_identity_duplicate", relative, `profile identity duplicates ${previous}`));
-    else identities.set(result.profile.id, relative);
-  }
-  failures.push(...validateReferenceProfileSet(summaries));
-  const uniqueFailures = [...new Map(failures.map((issue) => [`${issue.code}:${issue.path}:${issue.message}`, issue])).values()];
-  return { failures: uniqueFailures, records };
-}
-
-export function isIndependentPromotionProfile(profile) {
-  return isPlainObject(profile)
-    && profile.profile_kind === "governed_local"
-    && profile.artifact_mode === "governed_local"
-    && profile.fixture_independence === "independent"
-    && !Object.hasOwn(profile, "related_fixture_set_id")
-    && profile.example_only === false
-    && profile.maturity !== "deprecated"
-    && profile.support?.status === "active";
-}

package/scripts/json-schema-formats.mjs

@@ -1,31 +0,0 @@
-import addFormats from "ajv-formats";
-
-const rfc3339DateTime = /^(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})T(?<hour>\d{2}):(?<minute>\d{2}):(?<second>\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
-
-export function isRfc3339DateTime(value) {
-  if (typeof value !== "string") return false;
-  const match = rfc3339DateTime.exec(value);
-  if (!match || !Number.isFinite(Date.parse(value))) return false;
-
-  const year = Number(match.groups.year);
-  const month = Number(match.groups.month);
-  const day = Number(match.groups.day);
-  const hour = Number(match.groups.hour);
-  const minute = Number(match.groups.minute);
-  const second = Number(match.groups.second);
-  const canonical = new Date(0);
-  canonical.setUTCFullYear(year, month - 1, day);
-  canonical.setUTCHours(hour, minute, second, 0);
-
-  return canonical.getUTCFullYear() === year
-    && canonical.getUTCMonth() === month - 1
-    && canonical.getUTCDate() === day
-    && canonical.getUTCHours() === hour
-    && canonical.getUTCMinutes() === minute
-    && canonical.getUTCSeconds() === second;
-}
-
-export function addDateTimeFormat(ajv) {
-  addFormats(ajv, ["date-time"]);
-  return ajv;
-}

package/scripts/markdown-structure.mjs

@@ -1,45 +0,0 @@
-export function stripFencedCodeBlocks(content) {
-  const kept = [];
-  let fence = null;
-
-  for (const line of content.split("\n")) {
-    const marker = line.match(/^ {0,3}(`{3,})[^`]*$/)?.[1] ?? line.match(/^ {0,3}(~{3,}).*$/)?.[1];
-    if (!fence && marker) {
-      fence = { character: marker[0], length: marker.length };
-      continue;
-    }
-    if (fence) {
-      const closing = line.match(/^ {0,3}(`{3,}|~{3,})\s*$/)?.[1];
-      if (closing && closing[0] === fence.character && closing.length >= fence.length) fence = null;
-      continue;
-    }
-    kept.push(line);
-  }
-
-  return kept.join("\n");
-}
-
-export function stripHtmlComments(content) {
-  return content.replace(/<!--[\s\S]*?(?:-->|$)/g, "");
-}
-
-export function structuralMarkdown(content) {
-  return stripFencedCodeBlocks(stripHtmlComments(content));
-}
-
-export function markdownLinkDestinations(content) {
-  const body = structuralMarkdown(content);
-  const destinations = [];
-  const inline = /!?\[[^\]]*\]\(\s*<?([^\s)>]+)>?(?:\s+[^)]*)?\)/g;
-  const reference = /^ {0,3}\[[^\]]+\]:\s*<?([^\s>]+)>?(?:\s+.*)?$/gm;
-  for (const pattern of [inline, reference]) {
-    for (const match of body.matchAll(pattern)) destinations.push(match[1]);
-  }
-  return destinations;
-}
-
-export function isOmoDependency(destination) {
-  if (/^[a-z][a-z0-9+.-]*:/i.test(destination) || destination.startsWith("#")) return false;
-  const pathOnly = destination.split(/[?#]/, 1)[0];
-  return pathOnly.split(/[\\/]/).includes(".omo");
-}

package/scripts/page-artifact-metadata.mjs

@@ -1,124 +0,0 @@
-import crypto from "node:crypto";
-import { inflateSync } from "node:zlib";
-
-const pngSignature = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
-const pngBitDepths = new Map([
-  [0, new Set([1, 2, 4, 8, 16])],
-  [2, new Set([8, 16])],
-  [3, new Set([1, 2, 4, 8])],
-  [4, new Set([8, 16])],
-  [6, new Set([8, 16])],
-]);
-const pngChannels = new Map([[0, 1], [2, 3], [3, 1], [4, 2], [6, 4]]);
-const adam7Passes = Object.freeze([
-  [0, 0, 8, 8], [4, 0, 8, 8], [0, 4, 4, 8], [2, 0, 4, 4],
-  [0, 2, 2, 4], [1, 0, 2, 2], [0, 1, 1, 2],
-]);
-const maxDecodedPngBytes = 256 * 1024 * 1024;
-export const MAX_ARTIFACT_FILE_BYTES = 64 * 1024 * 1024;
-const maxPngChunkBytes = 32 * 1024 * 1024;
-const maxPngCompressedBytes = 64 * 1024 * 1024;
-const crcTable = Uint32Array.from({ length: 256 }, (_, index) => {
-  let value = index;
-  for (let bit = 0; bit < 8; bit += 1) value = (value >>> 1) ^ (0xedb88320 & -(value & 1));
-  return value >>> 0;
-});
-
-function crc32(bytes) {
-  let value = 0xffffffff;
-  for (const byte of bytes) value = crcTable[(value ^ byte) & 0xff] ^ (value >>> 8);
-  return (value ^ 0xffffffff) >>> 0;
-}
-
-function passExtent(size, start, step) {
-  return size <= start ? 0 : Math.ceil((size - start) / step);
-}
-
-function validateDecodedPng(idat, { bitDepth, colorType, height, interlace, width }) {
-  const bitsPerPixel = pngChannels.get(colorType) * bitDepth;
-  const passes = interlace === 0 ? [[0, 0, 1, 1]] : adam7Passes;
-  const rows = passes.flatMap(([startX, startY, stepX, stepY]) => {
-    const passWidth = passExtent(width, startX, stepX);
-    const passHeight = passExtent(height, startY, stepY);
-    return passWidth === 0 || passHeight === 0 ? [] : [{ bytes: Math.ceil((passWidth * bitsPerPixel) / 8), count: passHeight }];
-  });
-  const expected = rows.reduce((total, row) => total + (row.bytes + 1) * row.count, 0);
-  if (!Number.isSafeInteger(expected) || expected <= 0 || expected > maxDecodedPngBytes) return false;
-  const compressed = Buffer.concat(idat);
-  let decoded;
-  let consumed;
-  try {
-    const inflated = inflateSync(compressed, { info: true, maxOutputLength: expected + 1 });
-    decoded = inflated.buffer;
-    consumed = inflated.engine.bytesWritten;
-  }
-  catch { return false; }
-  if (consumed !== compressed.length || decoded.length !== expected) return false;
-  let offset = 0;
-  for (const row of rows) {
-    for (let index = 0; index < row.count; index += 1) {
-      if (decoded[offset] > 4) return false;
-      offset += row.bytes + 1;
-    }
-  }
-  return offset === decoded.length;
-}
-
-function pngDimensions(bytes) {
-  if (bytes.length > MAX_ARTIFACT_FILE_BYTES) return undefined;
-  if (bytes.length < 8 || !bytes.subarray(0, 8).equals(pngSignature)) return undefined;
-  let dimensions;
-  let idatClosed = false;
-  let sawIdat = false;
-  const idat = [];
-  let compressedBytes = 0;
-  let header;
-  let offset = 8;
-  while (offset < bytes.length) {
-    if (bytes.length - offset < 12) return undefined;
-    const length = bytes.readUInt32BE(offset);
-    if (length > maxPngChunkBytes) return undefined;
-    const typeOffset = offset + 4;
-    const dataOffset = typeOffset + 4;
-    const crcOffset = dataOffset + length;
-    const nextOffset = crcOffset + 4;
-    if (nextOffset > bytes.length) return undefined;
-    const typeBytes = bytes.subarray(typeOffset, dataOffset);
-    if ([...typeBytes].some((byte) => !((byte >= 65 && byte <= 90) || (byte >= 97 && byte <= 122)))) return undefined;
-    if (crc32(bytes.subarray(typeOffset, crcOffset)) !== bytes.readUInt32BE(crcOffset)) return undefined;
-    const type = typeBytes.toString("ascii");
-    if (offset === 8 && type !== "IHDR") return undefined;
-    if (type === "IHDR") {
-      if (offset !== 8 || length !== 13 || dimensions) return undefined;
-      const width = bytes.readUInt32BE(dataOffset);
-      const height = bytes.readUInt32BE(dataOffset + 4);
-      const bitDepth = bytes[dataOffset + 8];
-      const colorType = bytes[dataOffset + 9];
-      const bitDepths = pngBitDepths.get(colorType);
-      if (width === 0 || width > 0x7fffffff || height === 0 || height > 0x7fffffff || !bitDepths?.has(bitDepth)) return undefined;
-      if (bytes[dataOffset + 10] !== 0 || bytes[dataOffset + 11] !== 0 || bytes[dataOffset + 12] > 1) return undefined;
-      header = { bitDepth, colorType, height, interlace: bytes[dataOffset + 12], width };
-      dimensions = { height, width };
-    } else if (type === "IDAT") {
-      if (!dimensions || idatClosed) return undefined;
-      sawIdat = true;
-      idat.push(bytes.subarray(dataOffset, crcOffset));
-      compressedBytes += length;
-      if (compressedBytes > maxPngCompressedBytes) return undefined;
-    } else if (type === "IEND") {
-      return length === 0 && nextOffset === bytes.length && dimensions && sawIdat && validateDecodedPng(idat, header) ? dimensions : undefined;
-    } else if (sawIdat) idatClosed = true;
-    offset = nextOffset;
-  }
-  return undefined;
-}
-
-export function artifactMetadata(bytes, mediaType) {
-  const metadata = {
-    byte_length: bytes.length,
-    media_type: mediaType,
-    sha256: `sha256:${crypto.createHash("sha256").update(bytes).digest("hex")}`,
-  };
-  if (mediaType === "image/png") Object.assign(metadata, pngDimensions(bytes));
-  return metadata;
-}

package/scripts/page-evidence-contract.mjs

@@ -1,297 +0,0 @@
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { execFileSync } from "node:child_process";
-import { isDeepStrictEqual } from "node:util";
-import Ajv2020 from "ajv/dist/2020.js";
-import { artifactMetadata, MAX_ARTIFACT_FILE_BYTES } from "./page-artifact-metadata.mjs";
-import { addDateTimeFormat } from "./json-schema-formats.mjs";
-import { parseStrictJson } from "./strict-json.mjs";
-
-export const PAGE_EVIDENCE_CLAIM = "Page evidence is claim-scoped runtime evidence, not visual-regression approval or accessibility certification.";
-export const PAGE_EVIDENCE_MANIFEST = "page-evidence-manifest.json";
-export const PAGE_EVIDENCE_RECEIPT = "page-evidence-session.json";
-export const PAGE_EVIDENCE_MAX_PACKET_BYTES = 256 * 1024 * 1024;
-
-export function finding(code, message, recordPath) {
-  return { code, message, path: recordPath };
-}
-
-export function digest(bytes) {
-  return crypto.createHash("sha256").update(bytes).digest("hex");
-}
-
-export function metadata(bytes, mediaType, reference) {
-  const result = artifactMetadata(bytes, mediaType);
-  return { ...result, path: reference, sha256: result.sha256.replace(/^sha256:/, "") };
-}
-
-export function sameJson(left, right) {
-  return isDeepStrictEqual(left, right);
-}
-
-export function sameStringSet(left, right) {
-  return Array.isArray(left) && Array.isArray(right) && left.length === right.length && new Set(left).size === left.length && left.every((entry) => right.includes(entry));
-}
-
-export function safeRelativePath(reference) {
-  return typeof reference === "string"
-    && reference.length > 0
-    && !path.posix.isAbsolute(reference)
-    && !path.win32.isAbsolute(reference)
-    && !reference.includes("\\")
-    && !reference.includes("?")
-    && !reference.includes("#")
-    && !/^[A-Za-z][A-Za-z\d+.-]*:/.test(reference)
-    && path.posix.normalize(reference) === reference
-    && !reference.split("/").some((segment) => segment === "." || segment === "..");
-}
-
-function isInside(root, target) {
-  const relative = path.relative(root, target);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
-}
-
-export function normalizeReference(root, candidate) {
-  const absolute = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(root, candidate);
-  const reference = path.relative(path.resolve(root), absolute).split(path.sep).join("/");
-  return safeRelativePath(reference) ? reference : undefined;
-}
-
-export function resolveContained({ allowMissing = false, expectedType = "file", prefix, reference, root }, failures) {
-  const absoluteRoot = path.resolve(root);
-  if (!fs.existsSync(absoluteRoot) || !fs.lstatSync(absoluteRoot).isDirectory()) {
-    failures.push(finding(`${prefix}_root_invalid`, "trust root must be an existing directory", absoluteRoot));
-    return undefined;
-  }
-  if (fs.lstatSync(absoluteRoot).isSymbolicLink() || fs.realpathSync(absoluteRoot) !== absoluteRoot) {
-    failures.push(finding(`${prefix}_redirect`, "trust root must not be a filesystem redirect", absoluteRoot));
-    return undefined;
-  }
-  if (!safeRelativePath(reference)) {
-    failures.push(finding(`${prefix}_escape`, "path must be normalized and repository-relative", String(reference)));
-    return undefined;
-  }
-  const target = path.resolve(absoluteRoot, reference);
-  if (!isInside(absoluteRoot, target)) {
-    failures.push(finding(`${prefix}_escape`, "path escapes its trust root", reference));
-    return undefined;
-  }
-  let current = absoluteRoot;
-  const segments = reference.split("/");
-  for (const [index, segment] of segments.entries()) {
-    current = path.join(current, segment);
-    if (!fs.existsSync(current)) {
-      if (allowMissing) return { file: target, reference };
-      failures.push(finding(`${prefix}_missing`, "required file is missing", reference));
-      return undefined;
-    }
-    const stat = fs.lstatSync(current);
-    if (stat.isSymbolicLink()) {
-      failures.push(finding(`${prefix}_symlink`, "path must not traverse a symbolic link", reference));
-      return undefined;
-    }
-    const final = index === segments.length - 1;
-    if ((!final && !stat.isDirectory()) || (final && expectedType === "file" && !stat.isFile()) || (final && expectedType === "directory" && !stat.isDirectory())) {
-      failures.push(finding(`${prefix}_type_invalid`, `path must resolve to a regular ${expectedType}`, reference));
-      return undefined;
-    }
-  }
-  const canonical = path.join(fs.realpathSync(absoluteRoot), ...segments);
-  if (fs.realpathSync(target) !== canonical) {
-    failures.push(finding(`${prefix}_redirect`, "path resolves through a filesystem redirect", reference));
-    return undefined;
-  }
-  return { file: target, reference };
-}
-
-export function readJsonFile({ prefix, reference, root }, failures) {
-  const resolved = readContainedBytes({ prefix, reference, root }, failures);
-  if (!resolved) return undefined;
-  try {
-    return { ...resolved, value: parseStrictJson(resolved.bytes.toString("utf8")) };
-  } catch (error) {
-    failures.push(finding(`${prefix}_json_invalid`, error instanceof Error ? error.message : String(error), reference));
-    return undefined;
-  }
-}
-
-export function readContainedBytes({ prefix, reference, root }, failures) {
-  const resolved = resolveContained({ expectedType: "file", prefix, reference, root }, failures);
-  if (!resolved) return undefined;
-  let descriptor;
-  try {
-    descriptor = fs.openSync(resolved.file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
-    const before = fs.fstatSync(descriptor);
-    const namedBefore = fs.lstatSync(resolved.file);
-    if (!before.isFile() || before.dev !== namedBefore.dev || before.ino !== namedBefore.ino) throw new Error("file identity changed before read");
-    if (before.size > MAX_ARTIFACT_FILE_BYTES) throw new Error(`file exceeds ${MAX_ARTIFACT_FILE_BYTES} bytes`);
-    const bytes = fs.readFileSync(descriptor);
-    const after = fs.fstatSync(descriptor);
-    const namedAfter = fs.lstatSync(resolved.file);
-    if (before.dev !== after.dev || before.ino !== after.ino || after.dev !== namedAfter.dev || after.ino !== namedAfter.ino || after.size !== bytes.length) throw new Error("file identity changed during read");
-    const expected = path.join(fs.realpathSync(path.resolve(root)), ...reference.split("/"));
-    if (fs.realpathSync(resolved.file) !== expected) throw new Error("file path redirected during read");
-    return { ...resolved, bytes };
-  } catch (error) {
-    failures.push(finding(`${prefix}_read_untrusted`, error instanceof Error ? error.message : String(error), reference));
-    return undefined;
-  } finally {
-    if (descriptor !== undefined) fs.closeSync(descriptor);
-  }
-}
-
-function readSchema(schemaRoot, name) {
-  const file = path.join(schemaRoot, name);
-  try {
-    return parseStrictJson(fs.readFileSync(file, "utf8"));
-  } catch (cause) {
-    throw new Error(`${name} is not strict JSON: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-  }
-}
-
-export function compilePageEvidenceSchemas(schemaRoot) {
-  const ajv = new Ajv2020({ allErrors: true, strict: true });
-  addDateTimeFormat(ajv);
-  const sessionSchema = readSchema(schemaRoot, "page-evidence-session.schema.json");
-  const manifestSchema = readSchema(schemaRoot, "page-evidence-manifest.schema.json");
-  ajv.addSchema(sessionSchema);
-  ajv.addSchema(manifestSchema);
-  return {
-    manifest: ajv.getSchema(manifestSchema.$id),
-    runner: ajv.compile({ $ref: `${manifestSchema.$id}#/$defs/runner_result` }),
-    session: ajv.getSchema(sessionSchema.$id),
-  };
-}
-
-export function addSchemaFindings(validate, value, recordPath, code, failures) {
-  if (validate(value)) return true;
-  for (const error of validate.errors ?? []) failures.push(finding(code, `${error.instancePath || "/"} ${error.message}`, recordPath));
-  return false;
-}
-
-export function canonicalSourceManifest(root, references, failures) {
-  if (!Array.isArray(references) || references.length === 0 || new Set(references).size !== references.length) {
-    failures.push(finding("page_evidence_source_list_invalid", "relevant sources must be a nonempty unique path list", "<conformance-record>"));
-    return undefined;
-  }
-  const files = [];
-  let totalBytes = 0;
-  for (const reference of [...references].sort()) {
-    const resolved = readContainedBytes({ prefix: "page_evidence_source", reference, root }, failures);
-    if (!resolved) continue;
-    const size = resolved.bytes.length;
-    totalBytes += size;
-    if (size > MAX_ARTIFACT_FILE_BYTES || totalBytes > PAGE_EVIDENCE_MAX_PACKET_BYTES) {
-      failures.push(finding("page_evidence_source_limit", "relevant sources exceed the bounded file or aggregate byte budget", reference));
-      continue;
-    }
-    const bytes = resolved.bytes;
-    files.push({ byte_length: bytes.length, path: reference, sha256: digest(bytes) });
-  }
-  return files.length === references.length ? { files, sha256: digest(Buffer.from(JSON.stringify(files))) } : undefined;
-}
-
-function git(root, ...args) {
-  return execFileSync("git", ["-c", `safe.directory=${path.resolve(root)}`, ...args], { cwd: root, encoding: "utf8" }).trim();
-}
-
-function remoteIdentity(remote) {
-  if (!remote) return undefined;
-  const cleaned = remote.replace(/\.git$/, "");
-  const scp = cleaned.match(/^[^@]+@[^:]+:(.+)$/);
-  if (scp) return scp[1];
-  try {
-    const parsed = new URL(cleaned);
-    return parsed.pathname.replace(/^\//, "");
-  } catch {
-    return undefined;
-  }
-}
-
-export function gitIdentity(root, failures) {
-  try {
-    const canonical = git(root, "rev-parse", "--show-toplevel");
-    if (path.resolve(canonical) !== path.resolve(root) || fs.realpathSync(canonical) !== path.resolve(root)) throw new Error("--root must be the canonical Git worktree root");
-    let remote;
-    try { remote = git(root, "config", "--get", "remote.origin.url"); } catch { remote = ""; }
-    return {
-      branch: git(root, "branch", "--show-current") || "detached",
-      repository: remoteIdentity(remote),
-      revision: git(root, "rev-parse", "HEAD"),
-    };
-  } catch (error) {
-    failures.push(finding("page_evidence_git_invalid", error instanceof Error ? error.message : String(error), path.resolve(root)));
-    return undefined;
-  }
-}
-
-export function dirtyRelevantSources(root, references) {
-  const dirty = [];
-  for (const reference of references) {
-    try { git(root, "ls-files", "--error-unmatch", "--", reference); }
-    catch { dirty.push(`untracked:${reference}`); }
-  }
-  const status = git(root, "status", "--porcelain=v1", "--untracked-files=all", "--", ...references);
-  return [...new Set([...dirty, ...status.split("\n").filter(Boolean)])].sort();
-}
-
-export function readReceipt(artifactRoot, schemas, failures) {
-  const record = readJsonFile({ prefix: "page_evidence_session", reference: PAGE_EVIDENCE_RECEIPT, root: artifactRoot }, failures);
-  if (!record) return undefined;
-  const valid = addSchemaFindings(schemas.session, record.value, record.reference, "page_evidence_session_schema_invalid", failures);
-  const artifact = metadata(record.bytes, "application/json", PAGE_EVIDENCE_RECEIPT);
-  return { ...record, artifact, digest: artifact.sha256, valid };
-}
-
-export function withinSession(recordedAt, startedAt, completedAt) {
-  const recorded = Date.parse(recordedAt);
-  const started = Date.parse(startedAt);
-  const completed = Date.parse(completedAt);
-  return Number.isFinite(recorded) && Number.isFinite(started) && Number.isFinite(completed) && recorded >= started && recorded <= completed;
-}
-
-export function listArtifactFiles(root, failures) {
-  const files = [];
-  let visited = 0;
-  let limitReported = false;
-  let totalBytes = 0;
-  function visit(directory, prefix = "", depth = 0) {
-    if (depth > 16) {
-      failures.push(finding("page_evidence_artifact_limit", "artifact tree exceeds the maximum directory depth", prefix));
-      return;
-    }
-    const handle = fs.opendirSync(directory);
-    try {
-      let entry;
-      while ((entry = handle.readSync()) !== null) {
-        if (limitReported) return;
-        const reference = prefix ? `${prefix}/${entry.name}` : entry.name;
-        visited += 1;
-        if (visited > 4096) {
-          if (!limitReported) failures.push(finding("page_evidence_artifact_limit", "artifact tree exceeds 4096 entries", reference));
-          limitReported = true;
-          return;
-        }
-        const absolute = path.join(directory, entry.name);
-        const stat = fs.lstatSync(absolute);
-        if (stat.isSymbolicLink()) failures.push(finding("page_evidence_artifact_symlink", "artifact root must not contain symbolic links", reference));
-        else if (stat.isDirectory()) visit(absolute, reference, depth + 1);
-        else if (stat.isFile()) {
-          totalBytes += stat.size;
-          if (stat.size > MAX_ARTIFACT_FILE_BYTES || totalBytes > PAGE_EVIDENCE_MAX_PACKET_BYTES) {
-            if (!limitReported) failures.push(finding("page_evidence_artifact_limit", "artifact packet exceeds the bounded file or aggregate byte budget", reference));
-            limitReported = true;
-            return;
-          }
-          files.push(reference);
-        }
-        else failures.push(finding("page_evidence_artifact_type_invalid", "artifact root contains a non-regular entry", reference));
-      }
-    } finally {
-      handle.closeSync();
-    }
-  }
-  visit(root);
-  return files.sort();
-}