tracegrove 0.0.0-stage → 0.3.0

package/dist/core/scenarioStructure.d.ts

@@ -0,0 +1,400 @@
+import { z } from 'zod';
+import { ScenarioProjection, ScenarioRevisionToken, ScenarioStructuralValidation, type Digest, type Ref, type Scope, type ScenarioDefinition, type SelectionManifest } from '../protocol/index.ts';
+import type { FrozenBundle } from './planner.ts';
+import { type ScenarioReadPorts } from './scenario.ts';
+export declare const StructuralActor: z.ZodObject<{
+    actorId: z.ZodString;
+    policyRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodString;
+        digest: z.ZodObject<{
+            algorithm: z.ZodLiteral<"sha256">;
+            hex: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export interface ScenarioStructurePorts extends ScenarioReadPorts {
+    authorizeValidation(scope: Scope, intentDigest: Digest): Promise<z.infer<typeof StructuralActor>>;
+    readStructuralValidation(id: string, scope: Scope): Promise<unknown | null>;
+    /** Recompile and recheck authority; atomically persist the receipt and validating projection, or neither. */
+    compareAndSwapStructuralValidation(token: ScenarioRevisionToken, next: ScenarioProjection, validation: ScenarioStructuralValidation, bundle: FrozenBundle): Promise<boolean>;
+}
+export declare function structuralIntentBinding(snapshot: ScenarioRevisionToken, requestRef: Ref, executableClosureDigest: Digest): {
+    digest: {
+        algorithm: "sha256";
+        hex: string;
+    };
+    id: string;
+};
+export declare function structuralIntent(token: ScenarioRevisionToken, bundle: FrozenBundle): {
+    digest: {
+        algorithm: "sha256";
+        hex: string;
+    };
+    id: string;
+    request: {
+        schemaVersion: "workflow.request/v1";
+        ref: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        clientRequestId: string;
+        idempotencyKey: string;
+        requestedScope: {
+            ownerId: string;
+            tenantId: string | null;
+            visibility: "public" | "owner_private" | "tenant_private";
+        };
+        campaignId: string;
+        purpose: "trial" | "work_proof" | "qualification" | "regression";
+        sourcePlanRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        reviewRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        scenarioRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        qualificationRoundRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        effectiveConfigRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        sourceSelectionRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        executionHostRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        intelligencePolicyRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        fidelityPlanRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        fixturePlanRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        caseRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        personaRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        environmentRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+        expectedTarget: {
+            componentProfileRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            requiredComponents: string[];
+            excludedComponents: {
+                component: string;
+                reason: string;
+            }[];
+            components: {
+                componentId: string;
+                kind: "schema" | "application" | "service" | "worker" | "flag_set" | "protocol_server" | "host" | "widget" | "mobile_binary" | "device_runtime" | "model_endpoint" | "other";
+                identity: {
+                    kind: "source_digest";
+                    sourceDigest: {
+                        algorithm: "sha256";
+                        hex: string;
+                    };
+                    runtime: string;
+                } | {
+                    kind: "declared_release";
+                    release: string;
+                } | null;
+            }[];
+            repositories: {
+                repositoryRole: string;
+                canonicalUrl: string;
+                requestedRef: string;
+                resolvedCommit: string;
+                origin: "remote_object" | "snapshot_bundle";
+                sourceObjectsRef: {
+                    id: string;
+                    revision: string;
+                    digest: {
+                        algorithm: "sha256";
+                        hex: string;
+                    };
+                } | null;
+                lockfileDigest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+                dirty: false;
+            }[];
+            corpus: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            runner: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            evaluator: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            frontendRelease: string | null;
+            backendRelease: string | null;
+            workerRelease: string | null;
+            schemaFingerprint: {
+                algorithm: "sha256";
+                hex: string;
+            } | null;
+            featureFlagsDigest: {
+                algorithm: "sha256";
+                hex: string;
+            } | null;
+            capabilityVersionsDigest: {
+                algorithm: "sha256";
+                hex: string;
+            } | null;
+            browserVersion: string | null;
+            containerImageDigest: string | null;
+            modelConfigDigest: {
+                algorithm: "sha256";
+                hex: string;
+            } | null;
+        } | null;
+        selectionManifestRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        workBinding: {
+            workId: string;
+            requirementRefs: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            }[];
+        } | null;
+        limits: {
+            deadlineMs: number;
+            maxProviderRequests: number;
+            maxTokens: number;
+            costCeilingCents: number;
+            maxBrowserActions: number;
+            maxArtifactBytes: number;
+            diagnosticRetries: number;
+            concurrencyGroup: string;
+        };
+        replayOf: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+    };
+    executableClosureDigest: {
+        algorithm: "sha256";
+        hex: string;
+    };
+};
+export declare function deriveScenarioStructure(token: ScenarioRevisionToken, projection: ScenarioProjection, definition: ScenarioDefinition, matrix: SelectionManifest, bundle: FrozenBundle, actor: z.infer<typeof StructuralActor>, validatedAt: string): {
+    validation: {
+        schemaVersion: "workflow.scenario-structure/v1";
+        ref: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        scope: {
+            ownerId: string;
+            tenantId: string | null;
+            visibility: "public" | "owner_private" | "tenant_private";
+        };
+        snapshot: {
+            id: string;
+            scope: {
+                ownerId: string;
+                tenantId: string | null;
+                visibility: "public" | "owner_private" | "tenant_private";
+            };
+            expectedAggregateVersion: number;
+            expectedDefinitionRef: {
+                id: string;
+                revision: string;
+                digest: {
+                    algorithm: "sha256";
+                    hex: string;
+                };
+            };
+            expectedInvalidationEpoch: number;
+            expectedLatestRoundSequence: number;
+        };
+        requestRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        qualificationMatrixRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        executableClosureDigest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+        actorId: string;
+        authorizationPolicyRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        validatedAt: string;
+    };
+    next: {
+        id: string;
+        scope: {
+            ownerId: string;
+            tenantId: string | null;
+            visibility: "public" | "owner_private" | "tenant_private";
+        };
+        aggregateVersion: number;
+        definitionRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        };
+        state: "proposed" | "validating" | "active" | "degraded" | "retired";
+        invalidationEpoch: number;
+        latestRoundSequence: number;
+        qualificationRoundRefs: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        }[];
+        activationDecisionRef: {
+            id: string;
+            revision: string;
+            digest: {
+                algorithm: "sha256";
+                hex: string;
+            };
+        } | null;
+    };
+};
+/** Static validation grants neither effect permission nor live qualification. Historical retries cannot reverse edits. */
+export declare function validateScenarioStructure(ports: ScenarioStructurePorts, input: ScenarioRevisionToken, rawBundle: FrozenBundle): Promise<ScenarioStructuralValidation>;

package/dist/core/scenarioStructure.js

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+import { IdString, RefSchema, RunRequest, ScenarioProjection, ScenarioRevisionToken, ScenarioStructuralValidation, digestOfValue, freeze, refKey, sameDigest, sameRef, sameScope, verifySelfDigest } from "../protocol/index.js";
+import { checkedFrozenRequest, prepareFrozenCells } from "./executionPreparation.js";
+import { readScenarioSnapshot, resolveScenarioDefinition, resolveQualificationSelection, validateQualificationMatrix } from "./scenario.js";
+import { Blocked, Conflict } from "./errors.js";
+import { nowIso } from "./clock.js";
+export const StructuralActor = z.object({ actorId: IdString, policyRef: RefSchema }).strict();
+export function structuralIntentBinding(snapshot, requestRef, executableClosureDigest) {
+    const digest = digestOfValue({ snapshot, requestRef, executableClosureDigest });
+    return { digest, id: `structural-validation-${digest.hex}` };
+}
+export function structuralIntent(token, bundle) {
+    const request = RunRequest.parse(checkedFrozenRequest(bundle, token.scope));
+    const executableClosureDigest = digestOfValue({ request, documents: bundle.documents });
+    return { request, executableClosureDigest, ...structuralIntentBinding(token, request.ref, executableClosureDigest) };
+}
+export function deriveScenarioStructure(token, projection, definition, matrix, bundle, actor, validatedAt) {
+    const intent = structuralIntent(token, bundle);
+    const { request } = intent;
+    if (!['proposed', 'degraded'].includes(projection.state))
+        throw new Conflict('structural validation requires a proposed or degraded scenario');
+    if (!['trial', 'work_proof'].includes(request.purpose) || request.sourcePlanRef || request.reviewRef || request.scenarioRefs.length || request.qualificationRoundRef)
+        throw new Conflict('structural validation requires an unchanged non-lifecycle frozen plan');
+    if (bundle.blockers.length)
+        throw new Blocked(bundle.blockers);
+    validateQualificationMatrix(definition, matrix, matrix);
+    const { selection } = prepareFrozenCells(bundle, token.scope, request);
+    const cells = (s) => ({ cells: s.cells, excludedCells: s.excludedCells });
+    if (digestOfValue(cells(selection)).hex !== digestOfValue(cells(matrix)).hex ||
+        digestOfValue([...request.caseRefs].map(refKey).sort()).hex !== digestOfValue([...definition.caseRefs].map(refKey).sort()).hex)
+        throw new Conflict('structural plan differs from the scenario case/persona/target matrix');
+    const validation = ScenarioStructuralValidation.parse(freeze({ schemaVersion: 'workflow.scenario-structure/v1',
+        ref: { id: intent.id, revision: '1' }, scope: token.scope, snapshot: token, requestRef: request.ref,
+        qualificationMatrixRef: definition.qualificationMatrixRef, executableClosureDigest: intent.executableClosureDigest,
+        actorId: actor.actorId, authorizationPolicyRef: actor.policyRef, validatedAt }));
+    const next = ScenarioProjection.parse({ ...projection, aggregateVersion: projection.aggregateVersion + 1,
+        state: 'validating', qualificationRoundRefs: [], activationDecisionRef: null });
+    return { validation, next };
+}
+/** Static validation grants neither effect permission nor live qualification. Historical retries cannot reverse edits. */
+export async function validateScenarioStructure(ports, input, rawBundle) {
+    const token = ScenarioRevisionToken.parse(input);
+    const bundle = structuredClone(rawBundle);
+    const intent = structuralIntent(token, bundle);
+    const actor = StructuralActor.parse(await ports.authorizeValidation(structuredClone(token.scope), structuredClone(intent.digest)));
+    const prior = async () => {
+        const raw = await ports.readStructuralValidation(intent.id, structuredClone(token.scope));
+        if (raw === null)
+            return null;
+        const stored = ScenarioStructuralValidation.parse(raw);
+        if (!verifySelfDigest(stored) || stored.ref.id !== intent.id || stored.ref.revision !== '1' || !sameScope(stored.scope, token.scope) ||
+            digestOfValue(stored.snapshot).hex !== digestOfValue(token).hex || !sameRef(stored.requestRef, intent.request.ref) ||
+            !sameDigest(stored.executableClosureDigest, intent.executableClosureDigest))
+            throw new Conflict('structural validation history differs from the frozen intent');
+        return stored;
+    };
+    const existing = await prior();
+    if (existing)
+        return existing;
+    const { projection } = await readScenarioSnapshot(ports, token);
+    const definition = await resolveScenarioDefinition(ports, projection.definitionRef, token.scope);
+    const matrix = await resolveQualificationSelection(ports, definition.qualificationMatrixRef, token.scope);
+    const { validation, next } = deriveScenarioStructure(token, projection, definition, matrix, bundle, actor, nowIso());
+    if (!await ports.compareAndSwapStructuralValidation(token, structuredClone(next), structuredClone(validation), structuredClone(bundle))) {
+        const raced = await prior();
+        if (raced)
+            return raced;
+        throw new Conflict('scenario changed during structural validation');
+    }
+    return validation;
+}
+//# sourceMappingURL=scenarioStructure.js.map

package/dist/core/scenarioStructure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarioStructure.js","sourceRoot":"","sources":["../../src/core/scenarioStructure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,4BAA4B,EAC/G,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EACK,MAAM,sBAAsB,CAAC;AACnH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,2BAA2B,EAA0B,MAAM,eAAe,CAAC;AACpK,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAQ9F,MAAM,UAAU,uBAAuB,CAAC,QAA+B,EAAE,UAAe,EAAE,uBAA+B;IACvH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,yBAAyB,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC/D,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,KAA4B,EAAE,MAAoB;IACjF,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,MAAM,uBAAuB,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,CAAC;AACvH,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,KAA4B,EAAE,UAA8B,EAAE,UAA8B,EAClI,MAAyB,EAAE,MAAoB,EAAE,KAAsC,EAAE,WAAmB;IAC5G,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3E,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,gEAAgE,CAAC,CAAC;IAC/I,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,qBAAqB;QAAE,MAAM,IAAI,QAAQ,CAAC,uEAAuE,CAAC,CAAC;IAClQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC7F,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG;QACxE,aAAa,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,sEAAsE,CAAC,CAAC;IAC/N,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,gCAAgC;QAC5G,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG;QACnG,sBAAsB,EAAE,UAAU,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QAClH,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,GAAG,CAAC;QACtG,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AACD,0HAA0H;AAC1H,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAA6B,EAAE,KAA4B,EAAE,SAAuB;IAClI,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnI,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YAChI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAClH,CAAC,UAAU,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,8DAA8D,CAAC,CAAC;QACpK,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,EAAE,CAAC;IAAC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,UAAU,CAAC,sBAAsB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1G,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACrH,IAAI,CAAC,MAAM,KAAK,CAAC,kCAAkC,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACxI,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;QAAC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/core/snapshotEvidence.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityAttestation, LaunchRecipe, Scope } from '../protocol/index.ts';
+/** Recheck source-manifest bindings from frozen bytes, independent of the launch directory. */
+export declare function snapshotAttestationProblems(launch: LaunchRecipe, attestation: IdentityAttestation, scope: Scope): string[];

package/dist/core/snapshotEvidence.js

@@ -0,0 +1,37 @@
+import { posix } from 'node:path';
+import { digestOfValue, sameRef, sameScope, verifySelfDigest } from "../protocol/canonical.js";
+import { identityFromEntries } from "../hosts/sourceIdentity.js";
+import { verifyGitSnapshotProofMetadata } from "../source/gitObjectProof.js";
+/** Recheck source-manifest bindings from frozen bytes, independent of the launch directory. */
+export function snapshotAttestationProblems(launch, attestation, scope) {
+    const pin = launch.sourceSnapshot;
+    const observed = attestation.evidence.sourceSnapshotRef;
+    if (!pin)
+        return observed ? ['unbound source snapshot observation'] : [];
+    const problems = [];
+    if (!verifySelfDigest(pin.snapshot) || !sameScope(pin.snapshot.scope, scope))
+        problems.push('source snapshot digest or scope mismatch');
+    if (!observed || !sameRef(pin.snapshot.ref, observed))
+        problems.push('source snapshot lacks its supervisor observation');
+    try {
+        const expected = pin.snapshot.commitProof ? { ...verifyGitSnapshotProofMetadata(pin.snapshot).binding, verification: 'actual_file_bytes' } : null;
+        if (digestOfValue(attestation.evidence.gitSource ?? null).hex !== digestOfValue(expected).hex)
+            problems.push('source snapshot lacks its matching Git object observation');
+    }
+    catch {
+        problems.push('source snapshot Git object proof is invalid');
+    }
+    const files = attestation.evidence.files;
+    const declared = [...launch.identitySourceFiles].sort();
+    if (JSON.stringify(files.map(file => file.path).sort()) !== JSON.stringify(declared))
+        problems.push('source snapshot identity file closure differs');
+    for (const file of files) {
+        const path = posix.normalize(posix.join(pin.cwd, file.path));
+        if (!pin.snapshot.files.some(entry => entry.path === path && entry.digest.hex === file.sha256))
+            problems.push('source snapshot identity bytes differ');
+    }
+    if (attestation.identity.kind !== 'source_digest' || attestation.identity.sourceDigest.hex !== identityFromEntries(files).hex)
+        problems.push('source snapshot digest differs from observed files');
+    return problems;
+}
+//# sourceMappingURL=snapshotEvidence.js.map

package/dist/core/snapshotEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshotEvidence.js","sourceRoot":"","sources":["../../src/core/snapshotEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAE7E,+FAA+F;AAC/F,MAAM,UAAU,2BAA2B,CAAC,MAAoB,EAAE,WAAgC,EAAE,KAAY;IAC9G,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC3F,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACxI,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACzH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClJ,IAAI,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC5K,CAAC;IAAC,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAAC,CAAC;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACrJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,KAAK,mBAAmB,CAAC,KAAK,CAAC,CAAC,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnM,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/snapshotRepository.d.ts

@@ -0,0 +1,48 @@
+import { SourceSelection, TargetTuple, type GitSnapshotBinding, type RevisionMatrix } from '../protocol/index.ts';
+/** Expected descriptor only. Callers must independently establish actual_file_bytes before observing it. */
+export declare function snapshotRepository(pin: GitSnapshotBinding): TargetTuple['repositories'][number];
+export declare function snapshotRevision(pin: GitSnapshotBinding, matrix: RevisionMatrix): {
+    repositoryRef: {
+        id: string;
+        revision: string;
+        digest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+    };
+    requestedRef: string;
+    requestedBaseRef: string;
+    headCommit: string;
+    baseCommit: string;
+    mergeBaseCommit: string | null;
+    mergeBaseAbsentReason: string | null;
+    diffRef: {
+        id: string;
+        revision: string;
+        digest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+    };
+    changedFileRefs: {
+        id: string;
+        revision: string;
+        digest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+    }[];
+    resolverRef: {
+        id: string;
+        revision: string;
+        digest: {
+            algorithm: "sha256";
+            hex: string;
+        };
+    };
+};
+/** One opt-in source selection for one complete pinned repository. Never invent remote provenance. */
+export declare function snapshotSourceSelection(pin: GitSnapshotBinding, input: unknown): {
+    selection: SourceSelection;
+    matrix: RevisionMatrix;
+};

package/dist/core/snapshotRepository.js

@@ -0,0 +1,47 @@
+import { posix } from 'node:path';
+import { GitSourceResolution, SourceSelection, TargetTuple, digestOfValue, freeze, sameRef, sameScope, verifySelfDigest } from "../protocol/index.js";
+import { verifyGitSnapshotProofMetadata } from "../source/gitObjectProof.js";
+import { GIT_RESOLVER_REF } from "./gitSources.js";
+import { Conflict } from "./errors.js";
+// v1: all recognized lockfiles at any depth, with their complete pinned path/mode/digest.
+// An empty manifest has an explicit digest; this is not dependency-install evidence.
+const LOCKFILES = new Set(['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb',
+    'uv.lock', 'poetry.lock', 'Pipfile.lock', 'Cargo.lock', 'Gemfile.lock', 'composer.lock', 'go.sum']);
+/** Expected descriptor only. Callers must independently establish actual_file_bytes before observing it. */
+export function snapshotRepository(pin) {
+    if (!pin.repositoryRole || !verifySelfDigest(pin.snapshot))
+        throw new Conflict('repository binding needs a sealed snapshot and explicit role');
+    const proof = verifyGitSnapshotProofMetadata(pin.snapshot).binding;
+    const lockfiles = pin.snapshot.files.filter(file => LOCKFILES.has(posix.basename(file.path)))
+        .map(({ path, mode, digest }) => ({ path, mode, digest })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    return TargetTuple.shape.repositories.element.parse({ repositoryRole: pin.repositoryRole,
+        canonicalUrl: `urn:tracegrove:git-object:${proof.algorithm}:${proof.commit}`, requestedRef: proof.commit,
+        resolvedCommit: proof.commit, origin: 'snapshot_bundle', sourceObjectsRef: pin.snapshot.ref,
+        lockfileDigest: digestOfValue({ schemaVersion: 'tracegrove.lockfile-manifest/v1', files: lockfiles }), dirty: false });
+}
+export function snapshotRevision(pin, matrix) {
+    if (!verifySelfDigest(matrix) || !sameScope(matrix.scope, pin.snapshot.scope) || matrix.repositories.length !== 1)
+        throw new Conflict('snapshot repository binding requires one sealed, same-scope revision matrix');
+    const row = matrix.repositories[0];
+    if (pin.snapshot.side !== 'head' || !sameRef(row.repositoryRef, pin.snapshot.repositoryRef) || row.headCommit !== pin.snapshot.commit || !sameRef(row.resolverRef, GIT_RESOLVER_REF))
+        throw new Conflict('snapshot repository binding must run the registered resolver matrix head');
+    return row;
+}
+/** One opt-in source selection for one complete pinned repository. Never invent remote provenance. */
+export function snapshotSourceSelection(pin, input) {
+    const resolution = GitSourceResolution.parse(input);
+    if (!verifySelfDigest(resolution) || !sameRef(resolution.ref, pin.snapshot.resolutionRef) || !sameScope(resolution.scope, pin.snapshot.scope))
+        throw new Conflict('snapshot resolution sidecar differs from the sealed source binding');
+    const row = snapshotRevision(pin, resolution.matrix);
+    const repository = snapshotRepository(pin);
+    const selection = SourceSelection.parse(freeze({ schemaVersion: 'workflow.source-selection/v1',
+        ref: { id: `snapshot-selection-${digestOfValue({ snapshot: pin.snapshot.ref, role: pin.repositoryRole }).hex}`, revision: '1' },
+        scope: pin.snapshot.scope, draftRevision: 0, strategy: 'commit_pair',
+        repositories: [{ repositoryRole: repository.repositoryRole, canonicalUrl: repository.canonicalUrl,
+                requestedExpression: row.requestedRef, headCommit: row.headCommit, baseCommit: row.baseCommit,
+                origin: repository.origin, sourceObjectsRef: pin.snapshot.ref, lockfileDigest: repository.lockfileDigest,
+                resolvedAt: resolution.matrix.resolvedAt, resolverRef: row.resolverRef }],
+        excludedRoles: [], compatibilityRuleRefs: [], revisionMatrixRef: resolution.matrix.ref }));
+    return { selection, matrix: resolution.matrix };
+}
+//# sourceMappingURL=snapshotRepository.js.map

package/dist/core/snapshotRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshotRepository.js","sourceRoot":"","sources":["../../src/core/snapshotRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EACvE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,0FAA0F;AAC1F,qFAAqF;AACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW;IAC3H,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtG,4GAA4G;AAC5G,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,8DAA8D,CAAC,CAAC;IAC/I,MAAM,KAAK,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;IACnE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAC1F,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,OAAO,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc;QACtF,YAAY,EAAE,6BAA6B,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM;QACxG,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG;QAC3F,cAAc,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,iCAAiC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAuB,EAAE,MAAsB;IAC9E,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/G,MAAM,IAAI,QAAQ,CAAC,6EAA6E,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC;IACpC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC;QAClL,MAAM,IAAI,QAAQ,CAAC,0EAA0E,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,uBAAuB,CAAC,GAAuB,EAAE,KAAc;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3I,MAAM,IAAI,QAAQ,CAAC,oEAAoE,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,8BAAuC;QACrG,GAAG,EAAE,EAAE,EAAE,EAAE,sBAAsB,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC/H,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAsB;QAC7E,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY;gBAC/F,mBAAmB,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC7F,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc;gBACxG,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3E,aAAa,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC"}

package/dist/core/source-analysis.d.ts

@@ -0,0 +1,18 @@
+import { ChangeModel, PlanSourceValidation, RevisionMatrix, SourcePlan, type ChangeElement, type Ref, type Scope } from '../protocol/index.ts';
+import { SourceCitation, type SourceCitationPorts } from './source-citation.ts';
+export interface SourceAnalysisPorts extends SourceCitationPorts {
+    resolveDocument(ref: Ref, scope: Scope): Promise<unknown>;
+    readDiff(scope: Scope, repository: RevisionMatrix['repositories'][number]): Promise<Uint8Array>;
+    /** Registered policy owns missing-base alternatives; absence cannot invent an empty diff. */
+    verifyRevisionPolicy(scope: Scope, matrix: RevisionMatrix, policyRef: Ref): Promise<void>;
+    /** Independent AST/schema/route oracle, never another unsupported model opinion. */
+    verifyElement(scope: Scope, element: ChangeElement, citations: SourceCitation[], policyRef: Ref): Promise<{
+        verified: boolean;
+        evidenceRefs: Ref[];
+    }>;
+    /** Frozen requirement policy admits exclusions/no-E2E reasoning and retains unresolved questions. */
+    verifyCoverage(scope: Scope, plan: SourcePlan, model: ChangeModel, policyRef: Ref): Promise<void>;
+}
+export declare const MAX_SOURCE_DIFF_BYTES: number;
+/** Checks selected immutable source facts and derivations; supplies no execution authority. */
+export declare function validatePlanSources(ports: SourceAnalysisPorts, input: unknown, policy: Ref): Promise<PlanSourceValidation>;