
Product
Introducing Manifest Alerts
Socket now detects supply chain risks in project manifests, starting with missing lockfiles that can make dependency installs non-reproducible.
@isl-lang/evidence-schema
Advanced tools
Evidence schema with zod validation and stable canonical serialization for ISL verification reports
Evidence schema with Zod validation and stable canonical serialization for ISL verification reports.
pnpm add @isl-lang/evidence
import { validateEvidenceReport, safeValidateEvidenceReport } from '@isl-lang/evidence';
// Throws on invalid data
const report = validateEvidenceReport(jsonData);
// Returns result object
const result = safeValidateEvidenceReport(jsonData);
if (result.success) {
console.log(result.data.verdict);
} else {
console.error(result.error);
}
import { serialize, deserialize, computeHash } from '@isl-lang/evidence';
// Canonical JSON serialization (deterministic output)
const json = serialize(report);
// Compact serialization
const compact = serialize(report, { pretty: false });
// Compute content hash
const hash = await computeHash(report);
import {
createReport,
createClause,
createEvidence,
addClause,
finalizeReport
} from '@isl-lang/evidence';
// Create a new report
let report = createReport({
contractName: 'UserAuthentication',
contractFile: 'contracts/auth.isl',
gitCommit: 'abc1234',
});
// Add clauses
const clause = createClause({
id: 'auth-001',
name: 'Valid credentials return token',
status: 'PASS',
durationMs: 50,
});
// Add evidence to clause
clause.evidence.push(createEvidence({
type: 'assertion',
description: 'Response contains valid JWT',
location: {
file: 'src/auth/login.ts',
line: 42,
snippet: 'return { token: jwt.sign(payload, secret) }',
},
}));
// Add clause to report (updates summary and verdict)
report = addClause(report, clause);
// Or finalize manually
report = finalizeReport(report);
import { areEqual, diff, stripTimestamps } from '@isl-lang/evidence';
// Check equality (ignores property order)
const equal = areEqual(report1, report2);
// Get detailed diff
const changes = diff(before, after);
if (changes.verdictChanged) {
console.log('Verdict changed!');
}
// Strip timestamps for snapshot testing
const stripped = stripTimestamps(report);
The current schema version is 1.0.0. Reports include a schemaVersion field for forward compatibility.
EvidenceReport - Complete verification reportClauseResult - Individual clause verification resultEvidenceItem - Supporting evidence for a clauseAssumption - Documented assumptionOpenQuestion - Unresolved questionReproCommand - Reproduction commandVerdict: 'SHIP' | 'NO_SHIP'ClauseStatus: 'PASS' | 'PARTIAL' | 'FAIL'| Function | Description |
|---|---|
validateEvidenceReport(data) | Validate and parse data (throws on error) |
safeValidateEvidenceReport(data) | Validate and parse data (returns result object) |
validatePartialReport(data) | Validate partial report data |
| Function | Description |
|---|---|
serialize(report, options?) | Serialize to canonical JSON |
deserialize(json) | Parse JSON to report |
computeHash(report) | Compute SHA-256 hash |
areEqual(a, b) | Compare reports for equality |
diff(before, after) | Compute differences between reports |
stripTimestamps(report) | Remove timestamps for testing |
| Function | Description |
|---|---|
createReport(options) | Create new empty report |
createClause(options) | Create clause result |
createEvidence(options) | Create evidence item |
addClause(report, clause) | Add clause and update summary |
addAssumption(report, assumption) | Add assumption |
addOpenQuestion(report, question) | Add open question |
addReproCommand(report, command) | Add reproduction command |
finalizeReport(report) | Compute summary and verdict |
MIT
FAQs
Evidence schema with zod validation and stable canonical serialization for ISL verification reports
We found that @isl-lang/evidence-schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket now detects supply chain risks in project manifests, starting with missing lockfiles that can make dependency installs non-reproducible.

Research
/Security News
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.

Security News
Anthropic says the directive cited national security concerns over a narrow jailbreak, but offered no specific technical details.