tracegrove 0.0.0-stage → 0.3.0

package/dist/core/bundleEvidence.js

@@ -0,0 +1,169 @@
+/** Reconstruct verdict inputs from evidence records, never from outcome labels. */
+import { BoundaryObservation, FidelityPlan, FixtureManifest, HostCapabilityObservation, HostLease, HostPlan, IdentityAttestation, CaseFixturePlan, SeedRecipe, CaseSpec, digestOfValue, refKey, sameDigest, verifySelfDigest, parseAs, digestOfBytes, } from "../protocol/index.js";
+import { compareTargets, evaluateAssertions, REDUCER_REF, reduceCell } from "./reducer.js";
+import { compileCase } from "./compiler.js";
+import { frozenRunnerCapabilities } from "./runnerCapabilities.js";
+import { videoBundlePath } from "./bundlePaths.js";
+import { targetFromComponentAttestations } from "./targetObservation.js";
+import { snapshotAttestationProblems } from "./snapshotEvidence.js";
+import { isInfrastructureStepFailure } from "./errors.js";
+import { repositorySelectionProblems } from "./repositorySelectionEvidence.js";
+export function checkCellEvidence(input) {
+    const { name, receipt: r, request, selection, documents, problems } = input;
+    const problem = (message) => problems.push(`cell ${name}: ${message}`);
+    const read = (file) => input.readJson(`cells/${name}/${file}`);
+    const exact = (a, b) => refKey(a) === refKey(b);
+    const nullableExact = (a, b) => a === null ? b === null : b !== null && exact(a, b);
+    const record = (doc, ref, label) => {
+        if (!verifySelfDigest(doc) || !exact(doc.ref, ref))
+            problem(`${label} digest or reference mismatch`);
+    };
+    const cell = selection.cells.find((c) => c.selectionCellId === r.selectionCellId);
+    if (!cell) {
+        problem('unknown selection cell');
+        return;
+    }
+    if (!exact(r.caseRef, cell.caseRef) || !exact(r.personaRef, cell.personaRef) || !exact(r.surfaceBindingRef, cell.surfaceBindingRef) ||
+        !nullableExact(r.variantRef, cell.variantRef))
+        problem('case/persona/binding/variant differs from selected cell');
+    if (!exact(r.requestRef, request.ref) || r.campaignId !== request.campaignId)
+        problem('foreign request or campaign');
+    if (!nullableExact(r.qualificationRoundRef, request.qualificationRoundRef))
+        problem('qualification admission binding mismatch');
+    if (digestOfValue(r.scope).hex !== digestOfValue(request.requestedScope).hex)
+        problem('scope mismatch');
+    if (!exact(r.environment.planRef, cell.environmentRef) || !exact(r.executionHostRef, cell.executionHostRef))
+        problem('foreign environment or host');
+    const spec = parseAs(CaseSpec, documents[refKey(cell.caseRef)], 'case');
+    record(spec, cell.caseRef, 'case');
+    const fidelity = parseAs(FidelityPlan, documents[refKey(request.fidelityPlanRef)], 'fidelity');
+    record(fidelity, request.fidelityPlanRef, 'fidelity');
+    const fidelityCell = fidelity.cells.find((c) => c.selectionCellId === cell.selectionCellId);
+    if (!fidelityCell) {
+        problem('missing fidelity cell');
+        return;
+    }
+    const plan = parseAs(HostPlan, documents[refKey(cell.executionHostRef)], 'host plan');
+    record(plan, cell.executionHostRef, 'host plan');
+    for (const message of repositorySelectionProblems(request, cell, plan, documents))
+        problem(message);
+    record(r.environment, r.environment.ref, 'environment');
+    if (digestOfValue(read('environment.json')).hex !== digestOfValue(r.environment).hex)
+        problem('environment records disagree');
+    if (digestOfValue(r.environment.expected).hex !== digestOfValue(cell.expectedTarget).hex)
+        problem('expected identity differs from selection');
+    if (r.environment.executionId !== r.executionId || r.environment.attemptId !== r.attemptId || r.environment.campaignId !== r.campaignId ||
+        digestOfValue(r.environment.scope).hex !== digestOfValue(r.scope).hex)
+        problem('foreign environment attempt or scope');
+    const host = read('host.json');
+    let capabilitiesObserved = false;
+    if (host.lease && host.observation) {
+        const lease = parseAs(HostLease, host.lease, 'host lease');
+        const observation = parseAs(HostCapabilityObservation, host.observation, 'host observation');
+        record(lease, r.hostLeaseRef, 'host lease');
+        if (!r.hostObservationRefs.some((ref) => exact(ref, observation.ref)))
+            problem('unbound host observation');
+        record(observation, observation.ref, 'host observation');
+        if (lease.executionId !== r.executionId || lease.attemptId !== r.attemptId || lease.campaignId !== r.campaignId)
+            problem('foreign host lease');
+        if (!exact(lease.hostPlanRef, plan.ref) || !exact(observation.hostPlanRef, plan.ref) || !observation.hostLeaseRef || !exact(observation.hostLeaseRef, lease.ref))
+            problem('host observation lease/plan mismatch');
+        const observedAt = Date.parse(observation.observedAt);
+        const kickoff = Date.parse(r.startedAt ?? r.finalizedAt);
+        const fresh = observedAt >= kickoff - 1000 && observedAt < Date.parse(observation.expiresAt);
+        capabilitiesObserved = fresh && plan.requiredCapabilities.every((cap) => observation.capabilities.some((o) => o.capability === cap && o.state === 'supported' && o.probe === 'probed'));
+    }
+    const attestations = host.attestations.map((a) => parseAs(IdentityAttestation, a, 'attestation'));
+    for (const a of attestations)
+        record(a, a.ref, 'attestation');
+    const observed = r.environment.observed;
+    if (observed && digestOfValue(observed).hex !== digestOfValue(targetFromComponentAttestations(cell.expectedTarget, attestations, plan.launch, r.scope)).hex) {
+        problem('target differs from host observations');
+    }
+    if (observed && r.environment.provenance.runtime === 'live') {
+        for (const id of cell.expectedTarget.requiredComponents) {
+            const attestation = attestations.find((a) => a.componentId === id);
+            if (!attestation || attestation.issuer !== 'local_launcher' || attestation.trustPolicy !== 'launcher_computed_source_digest') {
+                problem(`required identity ${id} lacks trusted attestation`);
+                continue;
+            }
+            const identity = observed.components.find((c) => c.componentId === id)?.identity;
+            const sourceProblems = plan.launch?.componentId === id ? snapshotAttestationProblems(plan.launch, attestation, r.scope) : [];
+            if (identity !== null && identity !== undefined)
+                for (const message of sourceProblems)
+                    problem(message);
+            if (!sourceProblems.length && digestOfValue(identity ?? null).hex !== digestOfValue(attestation.identity).hex)
+                problem(`identity ${id} differs from attestation`);
+        }
+    }
+    const boundaries = read('boundaries.json').map((b) => parseAs(BoundaryObservation, b, 'boundary'));
+    for (const b of boundaries) {
+        record(b, b.ref, 'boundary');
+        if (!r.boundaryObservationRefs.some((ref) => exact(ref, b.ref)))
+            problem('unbound boundary');
+        if (b.executionId !== r.executionId || b.attemptId !== r.attemptId || b.selectionCellId !== r.selectionCellId || !exact(b.fidelityPlanRef, fidelity.ref))
+            problem('foreign boundary observation');
+    }
+    const fidelityMatched = fidelityCell.claimBoundaryIds.every((id) => {
+        const matches = boundaries.filter((b) => b.boundaryId === id);
+        const rule = fidelityCell.boundaries.find((b) => b.boundaryId === id);
+        return matches.length === 1 && !!rule && matches[0].observedMode === rule.mode && matches[0].observedAccountClass === rule.accountClass;
+    });
+    let fixtureState = 'not_required';
+    let recipe = null;
+    if (spec.fixturePlanRef) {
+        const fixturePlan = parseAs(CaseFixturePlan, documents[refKey(spec.fixturePlanRef)], 'fixture plan');
+        record(fixturePlan, spec.fixturePlanRef, 'fixture plan');
+        recipe = parseAs(SeedRecipe, documents[refKey(fixturePlan.seedRecipeRef)], 'recipe');
+        record(recipe, fixturePlan.seedRecipeRef, 'recipe');
+        if (!r.fixtureManifestRef)
+            fixtureState = 'unknown';
+        else {
+            const manifest = parseAs(FixtureManifest, read('fixtures.json'), 'fixtures');
+            record(manifest, r.fixtureManifestRef, 'fixture manifest');
+            if (manifest.executionId !== r.executionId || manifest.attemptId !== r.attemptId || !exact(manifest.caseFixturePlanRef, fixturePlan.ref))
+                problem('foreign fixture manifest');
+            fixtureState = manifest.state;
+            if (fixtureState === 'verified' && (manifest.missingEntityKeys.length || recipe.entities.some((entity) => !manifest.entities.some((e) => e.entityKey === entity.entityKey && (!entity.readback || e.readbackEvidenceRefs.length > 0)))))
+                problem('fixture manifest omits required starting state');
+        }
+    }
+    const compiled = compileCase(spec, frozenRunnerCapabilities(documents, cell.expectedTarget.runner), recipe);
+    const rederived = evaluateAssertions(spec, r.environment.class, r.steps, REDUCER_REF, r.startedAt ?? r.finalizedAt, r.finalizedAt);
+    if (digestOfValue(rederived).hex !== digestOfValue(r.assertions).hex)
+        problem('assertions disagree with independent reduction');
+    const events = input.readBytes(`cells/${name}/events.jsonl`);
+    const eventArtifacts = r.artifacts.filter(a => a.mediaType === 'application/x-ndjson');
+    const videos = r.artifacts.filter(a => a.mediaType === 'video/webm');
+    const artifactsVerified = eventArtifacts.length === 1
+        && (spec.capture.video !== 'required' || videos.length === 1)
+        && r.artifacts.reduce((sum, a) => sum + a.byteCount, 0) <= spec.limits.maxArtifactBytes
+        && r.artifacts.every(a => {
+            if (a.mediaType === 'application/x-ndjson')
+                return sameDigest(a.ref.digest, r.eventsDigest) && a.byteCount === events.length;
+            if (a.mediaType !== 'video/webm' || !exact(a.producerRef, cell.expectedTarget.runner))
+                return false;
+            const bytes = input.readBytes(videoBundlePath(r.selectionCellId, a.ref.digest.hex));
+            return a.byteCount === bytes.length && sameDigest(a.ref.digest, digestOfBytes(bytes))
+                && bytes.subarray(0, 4).toString('hex') === '1a45dfa3'
+                && a.stepIds.every(id => compiled.stepsById.get(id)?.kind.startsWith('ui.'));
+        });
+    const reduction = reduceCell({
+        spec, expectedStepIds: compiled.orderedStepIds, steps: r.steps, assertions: rederived,
+        cancelled: r.steps.some((s) => s.result === 'cancelled'), fixtureState,
+        identityMatched: compareTargets(cell.expectedTarget, observed).matched,
+        fidelityMatched, requiredCapabilitiesObserved: capabilitiesObserved, artifactsVerified,
+        unknownMutations: r.cleanup.remainingUnknownMutations,
+        criticalCleanupConfirmed: r.cleanup.critical.every((k) => r.cleanup.confirmed.includes(k)),
+        // A host that never started leaves every step not_run; its sealed host.failed event is the
+        // evidence. It can only move a cell away from passed, never towards it.
+        infrastructureFailure: r.steps.some((s) => isInfrastructureStepFailure(s.reasonCode))
+            || events.toString('utf8').split('\n').some((line) => line.includes('"kind":"host.failed"') || line.includes('"kind":"browser.failed"')),
+        blockedReasons: r.outcome === 'blocked' ? r.reasonCodes : [],
+    });
+    if (reduction.outcome !== r.outcome || reduction.proofEligible !== r.proofEligible)
+        problem(`recorded outcome ${r.outcome} differs from evidence reduction ${reduction.outcome}`);
+    if (digestOfValue(reduction.coverage).hex !== digestOfValue(r.coverage).hex)
+        problem('coverage differs from evidence');
+}
+//# sourceMappingURL=bundleEvidence.js.map

package/dist/core/bundleEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleEvidence.js","sourceRoot":"","sources":["../../src/core/bundleEvidence.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EACL,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,yBAAyB,EAAE,SAAS,EACxF,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EACnF,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,GAE7D,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,CAAC,CAAM,EAAE,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,CAAC,CAAa,EAAE,CAAa,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,CAAC,GAAiB,EAAE,GAAQ,EAAE,KAAa,EAAE,EAAE;QAC5D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IACvG,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC;QAC/H,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,yDAAyD,CAAC,CAAC;IACtH,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACrH,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,CAAC;QAAE,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAChI,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACpJ,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/F,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;QAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IACjD,KAAK,MAAM,OAAO,IAAI,2BAA2B,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC9H,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC9I,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QACnI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAE3H,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAsE,CAAC;IACpG,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC3G,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/I,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;QAClN,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,UAAU,IAAI,OAAO,GAAG,IAAI,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC7F,oBAAoB,GAAG,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC1L,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;IACxC,IAAI,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,+BAA+B,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5J,OAAO,CAAC,uCAAuC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5D,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;YACxD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,gBAAgB,IAAI,WAAW,CAAC,WAAW,KAAK,iCAAiC,EAAE,CAAC;gBAAC,OAAO,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzM,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC;YACjF,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7H,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;gBAAE,KAAK,MAAM,OAAO,IAAI,cAAc;oBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACxG,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,aAAa,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG;gBAAE,OAAO,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;QACpK,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAI,IAAI,CAAC,iBAAiB,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC7F,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACpM,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE;QACjE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,oBAAoB,KAAK,IAAI,CAAC,YAAY,CAAC;IAC5I,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,GAAiF,cAAc,CAAC;IAChH,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACrG,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,CAAC,kBAAkB;YAAE,YAAY,GAAG,SAAS,CAAC;aAC/C,CAAC;YACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,CAAC;YAC7E,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YAC3D,IAAI,QAAQ,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,QAAQ,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAC9K,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC9B,IAAI,YAAY,KAAK,UAAU,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,gDAAgD,CAAC,CAAC;QACrS,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5G,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACnI,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAChI,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC;WAChD,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;WAC1D,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;WACpF,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACvB,IAAI,CAAC,CAAC,SAAS,KAAK,sBAAsB;gBAAE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC;YAC7H,IAAI,CAAC,CAAC,SAAS,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpG,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;mBAChF,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU;mBACnD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,UAAU,CAAC;QAC3B,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS;QACrF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,YAAY;QACtE,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,OAAO;QACtE,eAAe,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,iBAAiB;QACtF,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB;QACrD,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1F,2FAA2F;QAC3F,wEAAwE;QACxE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;eAChF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAC1I,cAAc,EAAE,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;KAC7D,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,oCAAoC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAClL,IAAI,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,gCAAgC,CAAC,CAAC;AACzH,CAAC"}

package/dist/core/bundleExport.d.ts

@@ -0,0 +1,12 @@
+import { VerifiedBundleSnapshot } from './bundle.ts';
+/** Export only sealed captured bytes. Existing destinations are never merged, followed or removed. */
+export declare function exportVerifiedBundle(snapshot: VerifiedBundleSnapshot, output: string): {
+    output: string;
+    manifestDigest: {
+        algorithm: "sha256";
+        hex: string;
+    };
+    verification: import("./bundle.ts").BundleVerification & {
+        ok: true;
+    };
+};

package/dist/core/bundleExport.js

@@ -0,0 +1,36 @@
+import { mkdirSync, rmSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { sameDigest } from "../protocol/index.js";
+import { VerifiedBundleSnapshot } from "./bundle.js";
+import { ensureBundleDirectory, writeCapturedBundleFiles } from "./bundleFiles.js";
+import { Conflict } from "./errors.js";
+import { syncPath } from "./fsDurability.js";
+/** Export only sealed captured bytes. Existing destinations are never merged, followed or removed. */
+export function exportVerifiedBundle(snapshot, output) {
+    if (!(snapshot instanceof VerifiedBundleSnapshot))
+        throw new Conflict('Export requires a captured verified bundle');
+    const target = resolve(output);
+    const parent = dirname(target);
+    ensureBundleDirectory(parent);
+    try {
+        mkdirSync(target, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            throw new Conflict('Export destination already exists; choose a new directory');
+        throw error;
+    }
+    try {
+        writeCapturedBundleFiles(snapshot, target);
+        const checked = VerifiedBundleSnapshot.open(target);
+        if (!sameDigest(checked.manifestDigest, snapshot.manifestDigest))
+            throw new Conflict('Exported bundle differs from captured evidence');
+        syncPath(parent);
+        return { output: target, manifestDigest: checked.manifestDigest, verification: checked.records.verification };
+    }
+    catch (error) {
+        rmSync(target, { recursive: true, force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=bundleExport.js.map

package/dist/core/bundleExport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleExport.js","sourceRoot":"","sources":["../../src/core/bundleExport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,sGAAsG;AACtG,MAAM,UAAU,oBAAoB,CAAC,QAAgC,EAAE,MAAc;IACnF,IAAI,CAAC,CAAC,QAAQ,YAAY,sBAAsB,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,4CAA4C,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC;QAAC,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,QAAQ,CAAC,2DAA2D,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACvK,IAAI,CAAC;QACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,gDAAgD,CAAC,CAAC;QACvI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAChH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACpF,CAAC"}

package/dist/core/bundleFiles.d.ts

@@ -0,0 +1,5 @@
+import type { VerifiedBundleSnapshot } from './bundle.ts';
+export declare function ensureBundleDirectory(path: string): void;
+export declare function bundlePathPresent(path: string): boolean;
+/** Internal writer for an already allocated, owned empty directory. Reads captured bytes only. */
+export declare function writeCapturedBundleFiles(snapshot: VerifiedBundleSnapshot, ownedDirectory: string): void;

package/dist/core/bundleFiles.js

@@ -0,0 +1,47 @@
+import { existsSync, lstatSync, mkdirSync, readdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { Conflict } from "./errors.js";
+import { syncPath } from "./fsDurability.js";
+export function ensureBundleDirectory(path) {
+    if (!existsSync(path))
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Conflict('Bundle archive path is not a real directory');
+}
+export function bundlePathPresent(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Internal writer for an already allocated, owned empty directory. Reads captured bytes only. */
+export function writeCapturedBundleFiles(snapshot, ownedDirectory) {
+    ensureBundleDirectory(ownedDirectory);
+    if (readdirSync(ownedDirectory).length)
+        throw new Conflict('Captured bundle destination must be empty');
+    const directories = new Set([ownedDirectory]);
+    // A partially written export must never expose a complete manifest.
+    const paths = snapshot.paths().filter(path => path !== 'manifest.json');
+    paths.push('manifest.json');
+    for (const path of paths) {
+        const parts = path.split('/');
+        let parent = ownedDirectory;
+        for (const part of parts.slice(0, -1)) {
+            parent = join(parent, part);
+            ensureBundleDirectory(parent);
+            directories.add(parent);
+        }
+        const file = join(ownedDirectory, ...parts);
+        writeFileSync(file, snapshot.read(path), { flag: 'wx', mode: 0o600 });
+        syncPath(file);
+    }
+    for (const path of [...directories].sort((a, b) => b.length - a.length))
+        syncPath(path);
+}
+//# sourceMappingURL=bundleFiles.js.map

package/dist/core/bundleFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleFiles.js","sourceRoot":"","sources":["../../src/core/bundleFiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AACtH,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACrC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACtG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,QAAgC,EAAE,cAAsB;IAC/F,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,QAAQ,CAAC,2CAA2C,CAAC,CAAC;IACxG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,oEAAoE;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,MAAM,GAAG,cAAc,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,CAAC;QAC5C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC"}

package/dist/core/bundlePaths.d.ts

@@ -0,0 +1,2 @@
+export declare function cellBundleName(id: string): string;
+export declare function videoBundlePath(cellId: string, digest: string): string;

package/dist/core/bundlePaths.js

@@ -0,0 +1,7 @@
+export function cellBundleName(id) { return id.replace(/[^A-Za-z0-9._-]/g, '_'); }
+export function videoBundlePath(cellId, digest) {
+    if (!/^[a-f0-9]{64}$/.test(digest))
+        throw new Error('invalid video digest');
+    return `cells/${cellBundleName(cellId)}/media/${digest}.webm`;
+}
+//# sourceMappingURL=bundlePaths.js.map

package/dist/core/bundlePaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundlePaths.js","sourceRoot":"","sources":["../../src/core/bundlePaths.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,cAAc,CAAC,EAAU,IAAY,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAElG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,MAAc;IAC5D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5E,OAAO,SAAS,cAAc,CAAC,MAAM,CAAC,UAAU,MAAM,OAAO,CAAC;AAChE,CAAC"}

package/dist/core/bundleSnapshot.d.ts

@@ -0,0 +1,26 @@
+import { type Digest } from '../protocol/index.ts';
+export declare const BUNDLE_SCHEMA_VERSION = "workflow.evidence-bundle/v1";
+export declare const BUNDLE_LIMITS: {
+    readonly manifestBytes: number;
+    readonly fileBytes: number;
+    readonly totalBytes: number;
+    readonly files: 10000;
+};
+declare const CANDIDATE: unique symbol;
+/** Sealed bytes, not issuer authority. Caller owns/authorizes the quiescent artifact directory. */
+export declare class BundleSnapshot {
+    #private;
+    readonly manifestDigest: Digest;
+    /** Internal writer readback only; public verification still requires the committed manifest. */
+    static fromCandidateManifest(dir: string, bytes: Uint8Array): BundleSnapshot;
+    constructor(dir: string, candidate?: {
+        token: typeof CANDIDATE;
+        bytes: Uint8Array;
+    });
+    has(path: string): boolean;
+    manifestBytes(): Buffer;
+    paths(): string[];
+    read(path: string): Buffer;
+    json(path: string): unknown;
+}
+export {};

package/dist/core/bundleSnapshot.js

@@ -0,0 +1,71 @@
+import { lstatSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { z } from 'zod';
+import { digestOfBytes } from "../protocol/index.js";
+import { readBoundedFile as readBounded } from "./boundedFile.js";
+export const BUNDLE_SCHEMA_VERSION = 'workflow.evidence-bundle/v1';
+export const BUNDLE_LIMITS = { manifestBytes: 1024 * 1024, fileBytes: 16 * 1024 * 1024, totalBytes: 64 * 1024 * 1024, files: 10000 };
+const Manifest = z.object({ schemaVersion: z.literal(BUNDLE_SCHEMA_VERSION), executionId: z.string().nullable(), campaignId: z.string(),
+    reducer: z.unknown(), runner: z.unknown(), createdAt: z.string(),
+    files: z.array(z.object({ path: z.string().min(1).max(2048), sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        bytes: z.number().int().nonnegative().max(BUNDLE_LIMITS.fileBytes) }).strict()).min(1).max(BUNDLE_LIMITS.files),
+}).strict();
+const CANDIDATE = Symbol('internal candidate manifest');
+function json(bytes, path) {
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new Error(`invalid JSON or UTF-8 in sealed file ${path}`);
+    }
+}
+/** Sealed bytes, not issuer authority. Caller owns/authorizes the quiescent artifact directory. */
+export class BundleSnapshot {
+    manifestDigest;
+    #manifestBytes;
+    #files = new Map();
+    /** Internal writer readback only; public verification still requires the committed manifest. */
+    static fromCandidateManifest(dir, bytes) {
+        return new BundleSnapshot(dir, { token: CANDIDATE, bytes });
+    }
+    constructor(dir, candidate) {
+        if (!lstatSync(dir).isDirectory())
+            throw new Error('bundle root must be a real directory');
+        if (candidate && (candidate.token !== CANDIDATE || candidate.bytes.byteLength > BUNDLE_LIMITS.manifestBytes))
+            throw new Error('invalid bounded candidate manifest');
+        const manifestBytes = candidate ? Buffer.from(candidate.bytes) : readBounded(join(dir, 'manifest.json'), BUNDLE_LIMITS.manifestBytes);
+        this.#manifestBytes = manifestBytes;
+        this.manifestDigest = digestOfBytes(manifestBytes);
+        const manifest = Manifest.parse(json(manifestBytes, 'manifest.json'));
+        let total = 0;
+        for (const file of manifest.files) {
+            if (file.path === 'manifest.json' || isAbsolute(file.path) || file.path.includes('\\') || /[\x00-\x1f\x7f]/.test(file.path) || file.path.split('/').some(part => !part || part === '.' || part === '..') || this.#files.has(file.path)) {
+                throw new Error(`unsafe or duplicate manifest path ${file.path}`);
+            }
+            total += file.bytes;
+            if (total > BUNDLE_LIMITS.totalBytes)
+                throw new Error('bundle exceeds the total byte bound');
+            let segment = dir;
+            for (const part of file.path.split('/')) {
+                segment = join(segment, part);
+                if (lstatSync(segment).isSymbolicLink())
+                    throw new Error(`symlink in bundle ${file.path}`);
+            }
+            const bytes = readBounded(join(dir, file.path), BUNDLE_LIMITS.fileBytes, file.bytes);
+            if (digestOfBytes(bytes).hex !== file.sha256)
+                throw new Error(`hash mismatch ${file.path}`);
+            this.#files.set(file.path, bytes);
+        }
+    }
+    has(path) { return this.#files.has(path); }
+    manifestBytes() { return Buffer.from(this.#manifestBytes); }
+    paths() { return [...this.#files.keys()]; }
+    read(path) {
+        const bytes = this.#files.get(path);
+        if (!bytes)
+            throw new Error(`unsealed required file ${path}`);
+        return Buffer.from(bytes);
+    }
+    json(path) { return json(this.read(path), path); }
+}
+//# sourceMappingURL=bundleSnapshot.js.map

package/dist/core/bundleSnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleSnapshot.js","sourceRoot":"","sources":["../../src/core/bundleSnapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAe,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,CAAC,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AACnE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,aAAa,EAAE,IAAI,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAW,CAAC;AAC9I,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACrI,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAChE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACrG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC;CAClH,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,SAAS,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAExD,SAAS,IAAI,CAAC,KAAiB,EAAE,IAAY;IAC3C,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;IACnF,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAC5E,CAAC;AAED,mGAAmG;AACnG,MAAM,OAAO,cAAc;IAChB,cAAc,CAAS;IACvB,cAAc,CAAS;IACvB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,gGAAgG;IAChG,MAAM,CAAC,qBAAqB,CAAC,GAAW,EAAE,KAAiB;QACzD,OAAO,IAAI,cAAc,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,YAAY,GAAW,EAAE,SAA0D;QACjF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC3F,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpK,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QACtI,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;QACtE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvO,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YACpB,IAAI,KAAK,GAAG,aAAa,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC7F,IAAI,OAAO,GAAG,GAAG,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC9B,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACrF,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAY,IAAa,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5D,aAAa,KAAa,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACpE,KAAK,KAAe,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,IAAY;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,IAAY,IAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;CACpE"}