@cesteral/contract-hash - npm Package Compare versions

Comparing version 1.2.0 to 2.0.0

dist/cross-repo-golden.d.ts

@@ -6,2 +6,16 @@ import type { HashableToolDefinition } from "./index.js";
 };
+export interface CrossRepoGoldenVector {
+    label: string;
+    expectedDefinitionHash: string;
+    fixture: HashableToolDefinition;
+}
+export declare const CROSS_REPO_DEFINITION_HASH_GOLDEN_VECTORS: readonly CrossRepoGoldenVector[];
+export declare const CROSS_REPO_GOLDEN_DISTINCTNESS_PAIRS: ReadonlyArray<readonly [string, string]>;
+export interface CrossRepoProtoPollutionVector {
+    label: string;
+    pollutedJson: string;
+    cleanJson: string;
+    expectedPollutedHash: string;
+}
+export declare const CROSS_REPO_PROTO_POLLUTION_VECTORS: readonly CrossRepoProtoPollutionVector[];
 //# sourceMappingURL=cross-repo-golden.d.ts.map

dist/cross-repo-golden.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"cross-repo-golden.d.ts","sourceRoot":"","sources":["../src/cross-repo-golden.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAwBzD,eAAO,MAAM,iCAAiC,EAAE;IAC9C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,sBAAsB,CAAC;CA+BjC,CAAC"}
+{"version":3,"file":"cross-repo-golden.d.ts","sourceRoot":"","sources":["../src/cross-repo-golden.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAwBzD,eAAO,MAAM,iCAAiC,EAAE;IAC9C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,sBAAsB,CAAC;CA+BjC,CAAC;AAqBF,MAAM,WAAW,qBAAqB;IAEpC,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED,eAAO,MAAM,yCAAyC,EAAE,SAAS,qBAAqB,EAsFrF,CAAC;AAQF,eAAO,MAAM,oCAAoC,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CASzF,CAAC;AAiBF,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IAEd,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;IAElB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,kCAAkC,EAAE,SAAS,6BAA6B,EA6BtF,CAAC"}

dist/cross-repo-golden.js

@@ -32,2 +32,118 @@ export const CROSS_REPO_DEFINITION_HASH_GOLDEN = {
 };
+export const CROSS_REPO_DEFINITION_HASH_GOLDEN_VECTORS = [
+    {
+        label: "deep key ordering + array element order preserved",
+        expectedDefinitionHash: "cdeac55f10ac5e21827ae0cb6ce838f4b16e81258c2fdacb3a0e818a2f6a2f39",
+        fixture: {
+            name: "vec_key_ordering",
+            inputSchema: {
+                zeta: 1,
+                alpha: 2,
+                nested: { yankee: true, bravo: false, mike: { delta: 4, charlie: 3 } },
+                tags: ["z", "a", "m"],
+            },
+            annotations: { cesteral: { schemaVersion: 1, platform: "vec", contractId: "vec.a.v1" } },
+        },
+    },
+    {
+        label: "number encoding (int, negative, zero, fraction, exponent, >2^53)",
+        expectedDefinitionHash: "cc1b6c9444553fb3cd1d06d8492ab8873428753a33a5eb5622d85a3e13e07972",
+        fixture: {
+            name: "vec_numbers",
+            inputSchema: {
+                zero: 0,
+                neg: -42,
+                frac: 1.5,
+                small: 0.000001,
+                expo: 1e21,
+                big: 9007199254740993,
+            },
+        },
+    },
+    {
+        label: "boolean + explicit null preserved",
+        expectedDefinitionHash: "a1bb62ca8428ce17947bfbb516aa62fcbe4480bc6c1f5ba513112b0f296dab0e",
+        fixture: {
+            name: "vec_bool_null",
+            inputSchema: { t: true, f: false, n: null, present: "x" },
+        },
+    },
+    {
+        label: "explicit null present (pairs with omitted — must differ)",
+        expectedDefinitionHash: "d58137c899d011347bc0aa85a2be5b0fbb243c0efcdde25b01f42c870d874227",
+        fixture: {
+            name: "vec_null_vs_omitted",
+            inputSchema: { a: 1, b: null },
+        },
+    },
+    {
+        label: "property omitted (pairs with explicit-null — must differ)",
+        expectedDefinitionHash: "ae46e31bf86f3675dd50ec8a2f444fa73b368db690e71f7156cb1e4419bea39d",
+        fixture: {
+            name: "vec_null_vs_omitted",
+            inputSchema: { a: 1 },
+        },
+    },
+    {
+        label: "empty object + empty array preserved",
+        expectedDefinitionHash: "74514e995a1eff54f1bd1c4fb13e4d8be1b6f4792d253f6eeb8e3c9066b6c6a7",
+        fixture: {
+            name: "vec_empty",
+            inputSchema: { obj: {}, arr: [] },
+            annotations: {},
+        },
+    },
+    {
+        label: "unicode NFC (U+00E9) — pairs with NFD, must differ (no normalization)",
+        expectedDefinitionHash: "e256c2438e8390e75d0ed3fa6a6d6f2d237cab73403ae7e0030b1266fb085056",
+        fixture: {
+            name: "vec_unicode",
+            description: "caf\u00E9",
+        },
+    },
+    {
+        label: "unicode NFD (e + U+0301) — pairs with NFC, must differ (no normalization)",
+        expectedDefinitionHash: "711053ce16c5e04c9d4c2a975732d7e2a92f34174f9b63dd6eb097fd1a36005b",
+        fixture: {
+            name: "vec_unicode",
+            description: "cafe\u0301",
+        },
+    },
+];
+export const CROSS_REPO_GOLDEN_DISTINCTNESS_PAIRS = [
+    [
+        "unicode NFC (U+00E9) — pairs with NFD, must differ (no normalization)",
+        "unicode NFD (e + U+0301) — pairs with NFC, must differ (no normalization)",
+    ],
+    [
+        "explicit null present (pairs with omitted — must differ)",
+        "property omitted (pairs with explicit-null — must differ)",
+    ],
+];
+export const CROSS_REPO_PROTO_POLLUTION_VECTORS = [
+    {
+        label: "own __proto__ nested in inputSchema.properties",
+        cleanJson: '{"name":"vec_pp","inputSchema":{"type":"object","properties":{"a":{"type":"string"}}}}',
+        pollutedJson: '{"name":"vec_pp","inputSchema":{"type":"object","properties":{"a":{"type":"string"},"__proto__":{"type":"number"}}}}',
+        expectedPollutedHash: "170b510bc0cb8394633f1347fd4643cfb901737c96e15be7bb055e7e95e01dad",
+    },
+    {
+        label: "own __proto__ in annotations.cesteral.capabilityDispatch.entityKindValueMap",
+        cleanJson: '{"name":"vec_pp","annotations":{"cesteral":{"schemaVersion":1,"platform":"x","contractId":"x.y.v1","capabilityDispatch":{"entityKindValueMap":{"campaign":"CAMPAIGN"}}}}}',
+        pollutedJson: '{"name":"vec_pp","annotations":{"cesteral":{"schemaVersion":1,"platform":"x","contractId":"x.y.v1","capabilityDispatch":{"entityKindValueMap":{"campaign":"CAMPAIGN","__proto__":"campaign"}}}}}',
+        expectedPollutedHash: "b906a2b6ae2677cde13d9c65640f70886b5c0986dc88f593463b5a59f3b4065f",
+    },
+    {
+        label: "own __proto__ at inputSchema top level",
+        cleanJson: '{"name":"vec_pp","inputSchema":{"type":"object"}}',
+        pollutedJson: '{"name":"vec_pp","inputSchema":{"type":"object","__proto__":{"evil":true}}}',
+        expectedPollutedHash: "1b377d1126d5a56c70fad4d90b773645a2eddaee27c8f726c46977d0deed07f9",
+    },
+    {
+        label: "own constructor key retained (defensive; always distinct)",
+        cleanJson: '{"name":"vec_pp","inputSchema":{"type":"object"}}',
+        pollutedJson: '{"name":"vec_pp","inputSchema":{"type":"object","constructor":{"x":1}}}',
+        expectedPollutedHash: "538fd756d27d2432eedf89c5ab08a3cf6fd6d3af607115a3bf9ce6e478d968d3",
+    },
+];
 //# sourceMappingURL=cross-repo-golden.js.map

dist/cross-repo-golden.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"cross-repo-golden.js","sourceRoot":"","sources":["../src/cross-repo-golden.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,iCAAiC,GAG1C;IACF,sBAAsB,EAAE,kEAAkE;IAC1F,OAAO,EAAE;QACP,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,kEAAkE;QAC/E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE;aACnE;YACD,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;SACrE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,YAAY;gBACtB,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,IAAI;gBACpB,qBAAqB,EAAE,CAAC,SAAS,CAAC;gBAClC,UAAU,EAAE,qBAAqB;aAClC;SACF;KACF;CACF,CAAC"}
+{"version":3,"file":"cross-repo-golden.js","sourceRoot":"","sources":["../src/cross-repo-golden.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,iCAAiC,GAG1C;IACF,sBAAsB,EAAE,kEAAkE;IAC1F,OAAO,EAAE;QACP,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,kEAAkE;QAC/E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE;aACnE;YACD,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;SACrE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,YAAY;gBACtB,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,IAAI;gBACpB,qBAAqB,EAAE,CAAC,SAAS,CAAC;gBAClC,UAAU,EAAE,qBAAqB;aAClC;SACF;KACF;CACF,CAAC;AA4BF,MAAM,CAAC,MAAM,yCAAyC,GAAqC;IACzF;QACE,KAAK,EAAE,mDAAmD;QAC1D,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,kBAAkB;YAIxB,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;gBACtE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;aACtB;YACD,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE;SACzF;KACF;IACD;QACE,KAAK,EAAE,kEAAkE;QACzE,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC;gBACP,GAAG,EAAE,CAAC,EAAE;gBACR,IAAI,EAAE,GAAG;gBACT,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,gBAAgB;aACtB;SACF;KACF;IACD;QACE,KAAK,EAAE,mCAAmC;QAC1C,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;SAC1D;KACF;IACD;QACE,KAAK,EAAE,0DAA0D;QACjE,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE;SAC/B;KACF;IACD;QACE,KAAK,EAAE,2DAA2D;QAClE,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;SACtB;KACF;IACD;QACE,KAAK,EAAE,sCAAsC;QAC7C,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACjC,WAAW,EAAE,EAAE;SAChB;KACF;IACD;QACE,KAAK,EAAE,uEAAuE;QAC9E,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,aAAa;YAGnB,WAAW,EAAE,WAAW;SACzB;KACF;IACD;QACE,KAAK,EAAE,2EAA2E;QAClF,sBAAsB,EAAE,kEAAkE;QAC1F,OAAO,EAAE;YACP,IAAI,EAAE,aAAa;YAGnB,WAAW,EAAE,YAAY;SAC1B;KACF;CACF,CAAC;AAQF,MAAM,CAAC,MAAM,oCAAoC,GAA6C;IAC5F;QACE,uEAAuE;QACvE,2EAA2E;KAC5E;IACD;QACE,0DAA0D;QAC1D,2DAA2D;KAC5D;CACF,CAAC;AA2BF,MAAM,CAAC,MAAM,kCAAkC,GAA6C;IAC1F;QACE,KAAK,EAAE,gDAAgD;QACvD,SAAS,EACP,wFAAwF;QAC1F,YAAY,EACV,sHAAsH;QACxH,oBAAoB,EAAE,kEAAkE;KACzF;IACD;QACE,KAAK,EAAE,6EAA6E;QACpF,SAAS,EACP,2KAA2K;QAC7K,YAAY,EACV,kMAAkM;QACpM,oBAAoB,EAAE,kEAAkE;KACzF;IACD;QACE,KAAK,EAAE,wCAAwC;QAC/C,SAAS,EAAE,mDAAmD;QAC9D,YAAY,EAAE,6EAA6E;QAC3F,oBAAoB,EAAE,kEAAkE;KACzF;IACD;QACE,KAAK,EAAE,2DAA2D;QAClE,SAAS,EAAE,mDAAmD;QAC9D,YAAY,EAAE,yEAAyE;QACvF,oBAAoB,EAAE,kEAAkE;KACzF;CACF,CAAC"}

dist/index.d.ts

@@ -15,3 +15,3 @@ export interface HashableToolDefinition {
 export declare function computeDefinitionHash(tool: HashableToolDefinition): string;
-export { CROSS_REPO_DEFINITION_HASH_GOLDEN } from "./cross-repo-golden.js";
+export { CROSS_REPO_DEFINITION_HASH_GOLDEN, CROSS_REPO_DEFINITION_HASH_GOLDEN_VECTORS, CROSS_REPO_GOLDEN_DISTINCTNESS_PAIRS, CROSS_REPO_PROTO_POLLUTION_VECTORS, type CrossRepoGoldenVector, type CrossRepoProtoPollutionVector, } from "./cross-repo-golden.js";
 //# sourceMappingURL=index.d.ts.map

dist/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAqCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKtD;AAqDD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAUjG;AAWD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAqBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAU1E;AAGD,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAqDD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKtD;AAqDD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAUjG;AAWD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAqBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAU1E;AAGD,OAAO,EACL,iCAAiC,EACjC,yCAAyC,EACzC,oCAAoC,EACpC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,GACnC,MAAM,wBAAwB,CAAC"}

dist/index.js

@@ -16,3 +16,8 @@ import { createHash } from "node:crypto";
         for (const key of Object.keys(value).sort()) {
-            sorted[key] = sortKeysDeep(value[key]);
+            Object.defineProperty(sorted, key, {
+                value: sortKeysDeep(value[key]),
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
         }
@@ -90,3 +95,3 @@ return sorted;
 }
-export { CROSS_REPO_DEFINITION_HASH_GOLDEN } from "./cross-repo-golden.js";
+export { CROSS_REPO_DEFINITION_HASH_GOLDEN, CROSS_REPO_DEFINITION_HASH_GOLDEN_VECTORS, CROSS_REPO_GOLDEN_DISTINCTNESS_PAIRS, CROSS_REPO_PROTO_POLLUTION_VECTORS, } from "./cross-repo-golden.js";
 //# sourceMappingURL=index.js.map

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgBzC,MAAM,iBAAiB,GAAG;IACxB,MAAM;IACN,aAAa;IACb,aAAa;IACb,cAAc;IACd,aAAa;CACL,CAAC;AAEX,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC5F,IAAI,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAe,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,KAAK,YAAY,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;YACvE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;gBACnB,IAAI,OAAO,EAAE,KAAK,WAAW;oBAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBAChF,oBAAoB,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;gBAChE,IAAI,OAAO,CAAC,KAAK,WAAW;oBAAE,SAAS;gBACvC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAyBD,MAAM,UAAU,0BAA0B,CAAC,IAA6C;IACtF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9F,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAqBD,MAAM,UAAU,qBAAqB,CAAC,IAA4B;IAChE,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAqC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAGD,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgBzC,MAAM,iBAAiB,GAAG;IACxB,MAAM;IACN,aAAa;IACb,aAAa;IACb,cAAc;IACd,aAAa;CACL,CAAC;AAEX,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAYvE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;gBACjC,KAAK,EAAE,YAAY,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC;gBAC5D,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,IAAI;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC5F,IAAI,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAe,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,KAAK,YAAY,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;YACvE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;gBACnB,IAAI,OAAO,EAAE,KAAK,WAAW;oBAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBAChF,oBAAoB,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;gBAChE,IAAI,OAAO,CAAC,KAAK,WAAW;oBAAE,SAAS;gBACvC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAyBD,MAAM,UAAU,0BAA0B,CAAC,IAA6C;IACtF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9F,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAqBD,MAAM,UAAU,qBAAqB,CAAC,IAA4B;IAChE,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAqC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAGD,OAAO,EACL,iCAAiC,EACjC,yCAAyC,EACzC,oCAAoC,EACpC,kCAAkC,GAGnC,MAAM,wBAAwB,CAAC"}

package.json

 {
   "name": "@cesteral/contract-hash",
-  "version": "1.2.0",
+  "version": "2.0.0",
   "description": "Canonical MCP tool-definition hash shared by Cesteral MCP servers and governance",
@@ -5,0 +5,0 @@ "license": "Apache-2.0",

README.md

@@ -18,1 +18,28 @@ # @cesteral/contract-hash
 ```
+
+## Version coordination (cross-repo parity)
+
+Parity is now single-sourced: both repos consume `computeDefinitionHash` and the
+`CROSS_REPO_DEFINITION_HASH_GOLDEN` vector from this one published package, so
+there is no hand-copied fixture to drift. The residual failure mode is a
+**version skew** — the two repos resolving _different_ releases of this package.
+Each repo's golden test only proves its installed package is internally
+consistent, so a one-sided bump to a release that changed the canonicalization
+would pass on both sides while the repos silently computed different hashes,
+halting every tool's promotion to `attested`.
+
+To prevent that:
+
+- Both repos pin `@cesteral/contract-hash` to an **exact** version (no `^`/`~`).
+  `cesteral-intelligence` enforces this with a version-pin test
+  (`contract-hash-version-pin.test.ts`) that fails if the declared or installed
+  version drifts from its parity-validated constant.
+- **Any change to the canonical byte output is a breaking change.** Bump this
+  package's version, update `src/cross-repo-golden.ts` (`expectedDefinitionHash`)
+  in the same release — the producer self-test
+  (`tests/cross-repo-definition-hash.test.ts`) enforces that pairing — then
+  upgrade both repos in lockstep and update the consumer's pinned constant.
+
+A canonicalization change therefore cannot silently reach `attested` admission:
+the consumer's pin test trips on the version bump, and its golden test then
+forces a re-validation against the package's re-pinned golden.

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

33587

45.94%

Lines of code

275

96.43%

Number of lines in readme file

45

150%

Worsened metrics

Number of low supply chain risk alerts

1

Infinity%

No dependency changes