diff --git a/.gitleaks.toml b/.gitleaks.toml index 2e0eee6..32907ac 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -3,9 +3,9 @@ useDefault = true [[allowlists]] -description = "Verified SHA-256 of protobuf 2.15.0 api_pb.js in five immutable reviewed profiles" +description = "Verified SHA-256 of protobuf 2.15.0 api_pb.js in six immutable reviewed profiles" targetRules = ["generic-api-key"] condition = "AND" -paths = ['''^eng/provenance/artifact-profiles/ai-worker-r[12345]\.json$'''] +paths = ['''^eng/provenance/artifact-profiles/ai-worker-r[123456]\.json$'''] regexTarget = "line" regexes = ['''^\s*"node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/api_pb\.js": "73e489001027c703bc0224ae73f78ecefe028e88284bd06952e8603c3d81472c",?\s*$'''] diff --git a/README.md b/README.md index ff25fcf..8a8896f 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ npm run build These commands need no Cloudflare account. Default tests run pure offline units in Node. Workflow engine and bundle runtime tests are separate explicit local opt-in commands, never CI gates. The build produces `artifacts/candidate/`, including the deployable bundle, configuration, hashes, provenance, licenses and runtime SBOM. -The toolchain pins TypeScript **7.0.2**, Wrangler **4.131.2** and `@arcforges/proto` **1.0.0-ci.25.1**. See [development](docs/development.md) for tool compatibility, local health testing and dependency updates. +The toolchain pins TypeScript **7.0.2**, Wrangler **4.131.2** and `@arcforges/proto` **1.0.0-ci.44.1**. See [development](docs/development.md) for tool compatibility, local health testing and dependency updates. ## Hello Agent diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index ec36793..bb3316a 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -6,6 +6,6 @@ The deployed bundle consumes `@arcforges/proto` under Apache-2.0 and `@bufbuild/ Cloudflare Wrangler, Vitest integration, Workerd, TypeScript, Biome and Prettier are development/build tools with their own licenses recorded in installed packages and the lockfile. They are not an additional production AI service. Model weights are hosted by Workers AI and are not bundled or redistributed here; Cloudflare model/account terms apply to actual inference. -The actual Worker includes an esbuild MIT helper, and its archive includes a generated Wrangler MIT README. Complete Evan Wallace and Cloudflare terms are retained under `third-party/` and copied into every candidate. The full Buf Apache-2.0 document, including Copyright 2021-2026 Buf Technologies, Inc., and original Google Protocol Buffers BSD terms are retained separately. Both protobuf 2.14.1 and 2.15.0 are present in the current bundle and runtime SBOM; their varint headers retain Copyright 2008 Google Inc. +The actual Worker includes an esbuild MIT helper, and its archive includes a generated Wrangler MIT README. Complete Evan Wallace and Cloudflare terms are retained under `third-party/` and copied into every candidate. The full Buf Apache-2.0 document, including Copyright 2021-2026 Buf Technologies, Inc., and original Google Protocol Buffers BSD terms are retained separately. The current bundle and runtime SBOM contain one deduplicated protobuf 2.15.0 runtime; its varint header retains Copyright 2008 Google Inc. The source provenance checker and its failure tests are an explicitly reviewed AGPL-3.0-only port from ArcForges Cloud. Their immutable upstream identity and adapted target hashes are recorded under `eng/provenance/records/`. The source notice summary and complete records accompany candidate provenance; a summary never replaces full licence terms. See [the owning process](docs/provenance.md). diff --git a/docs/development.md b/docs/development.md index dcfe8f9..7b81394 100644 --- a/docs/development.md +++ b/docs/development.md @@ -11,7 +11,7 @@ | Cloudflare Vitest plugin | 1.1.9 | Local Workerd/Workflow integration | | Vitest | 4.1.11 | Plugin requires Vitest 4.1; latest Vitest 5 is not a compatible upgrade | | Biome / Prettier | 2.5.14 / 3.9.8 | Lint/format without depending on the removed TypeScript JavaScript compiler API | -| ArcForges proto / protobuf runtime | 1.0.0-ci.25.1 / 2.15.0 | Published Contracts messages, not sibling source | +| ArcForges proto / protobuf runtime | 1.0.0-ci.44.1 / 2.15.0 | Published Contracts messages, not sibling source | `npm ci --ignore-scripts` restores the committed dependency graph on Windows and Linux without lifecycle scripts. The selected tools work with this installation mode. `package-lock.json` includes transitive/platform packages for reproducibility; do not shorten it by hand. Platform-independent source checks run once on Linux CI; no Windows duplicate or macOS job is required. diff --git a/docs/provenance.md b/docs/provenance.md index 046feb6..116955d 100644 --- a/docs/provenance.md +++ b/docs/provenance.md @@ -17,14 +17,14 @@ Used records are immutable. Changed material or intent requires a new reviewed r - The canonical AGPL document is matched to a pinned authoritative template, without inventing its historical acquisition path. - The existing binding declaration is reproduced by pinned Wrangler with `--include-runtime=false`. Its owned configuration and small MIT template are recorded; the declaration is absent from the deployed Worker. - The source checker, its failure tests and policy/template structure are an explicitly reviewed AGPL port from merged Cloud source. They execute as owned AI tooling with no sibling import or runtime dependency. -- The artifact profile binds every actual bundler input, output, external runtime import, source-map body and generator/package identity, including both protobuf versions. The 37 parsed modules from protobuf 2.14.1 and 60 from 2.15.0 were independently reproduced against their published bytes. Their upstream compiler was TypeScript 6.0.3; this audit-only compiler is separate from AI's pinned TypeScript 7.0.2 and is not added to its dependency graph. -- The esbuild helper, generated Wrangler README, Buf copyright, explicit Google BSD varint/descriptor scope, Contracts legal texts and original licences are retained in the actual candidate. Parsed material that is not emitted is distinguished from the 43 source bodies actually carried by its source map. +- The artifact profile binds every actual bundler input, output, external runtime import, source-map body and generator/package identity, including the deduplicated protobuf 2.15.0 runtime. Its 66 parsed modules retain prior reviewed bytes: 60 already at 2.15.0 and six codegenv2 modules identical to their prior nested 2.14.1 copies. Their upstream compiler was TypeScript 6.0.3; this audit-only compiler is separate from AI's pinned TypeScript 7.0.2 and is not added to its dependency graph. +- The esbuild helper, generated Wrangler README, Buf copyright, explicit Google BSD varint/descriptor scope, Contracts legal texts and original licences are retained in the actual candidate. Parsed material that is not emitted is distinguished from the 31 source bodies actually carried by its source map. ## Candidate and continuing verification `npm run check` includes source audit and failure tests. Normal tooling tests are offline source/policy fixtures without a candidate build. `npm run types` and the CI diff check reproduce the tracked declaration. The candidate job builds once and checks provenance; deployment performs one trust-handoff check. `test:artifact`, `test:runtime` and `test:bundle` remain explicit local diagnostics. Real model execution is not a CI or publication gate. -The candidate includes `provenance.json`, the full active records, source identity, source NOTICE and complete applicable legal texts. The verifier checks the Worker against its independently reviewed hash, the closed parsed/emitted graph, source-map bodies and mappings, generated README template, locked package graph, exact deployment-configuration transformation and runtime SBOM. Recomputing the outer manifest cannot authorize changed code, missing notices, new resources or altered source records. SBOM root identity uses `@arcforges/ai`, independent of checkout directory names. Both protobuf runtime versions and their dependency edges must remain represented. +The candidate includes `provenance.json`, the full active records, source identity, source NOTICE and complete applicable legal texts. The verifier checks the Worker against its independently reviewed hash, the closed parsed/emitted graph, source-map bodies and mappings, generated README template, locked package graph, exact deployment-configuration transformation and runtime SBOM. Recomputing the outer manifest cannot authorize changed code, missing notices, new resources or altered source records. SBOM root identity uses `@arcforges/ai`, independent of checkout directory names. The exact current protobuf runtime and both direct/transitive dependency edges must remain represented. Deployment verifies the same candidate again and promotes it without rebuilding. Source checks, optional local runtime observations and provider deployment completion remain separate; public-release byte downloads are not routine checks. A newly observed dependency, upstream revision, generated resource, legal-text change or configuration requires a newly reviewed profile and superseding record before promotion. Models hosted by Workers AI and development-tool implementations are not bundled by this Worker. diff --git a/eng/provenance/NOTICE.txt b/eng/provenance/NOTICE.txt index dec65de..57dd277 100644 --- a/eng/provenance/NOTICE.txt +++ b/eng/provenance/NOTICE.txt @@ -2,8 +2,8 @@ AI source provenance Original material retains its recorded licence and full legal text. -ai-worker-bundle-r5 -https://github.com/ArcForges/AI @ 943169b9e363393d76c5faf9fbb5ec9990b94c34 +ai-worker-bundle-r6 +https://github.com/ArcForges/AI @ 41241c4fb93cdef6c538d051fbc0a19f3194696f AGPL-3.0-only Worker: Copyright ArcForges contributors, AGPL-3.0-only. Contracts: ArcForges contributors, Apache-2.0. Protobuf runtimes: Copyright 2021-2026 Buf Technologies, Inc., Apache-2.0; varint/descriptor material: Copyright 2008 Google Inc., BSD-3-Clause. Helpers: Copyright 2020 Evan Wallace, MIT. Generated README: Copyright 2020 Cloudflare, Inc., MIT. Complete respective texts and source-bound records accompany the actual candidate. diff --git a/eng/provenance/artifact-profiles/ai-worker-r6.json b/eng/provenance/artifact-profiles/ai-worker-r6.json new file mode 100644 index 0000000..a5f13b2 --- /dev/null +++ b/eng/provenance/artifact-profiles/ai-worker-r6.json @@ -0,0 +1,344 @@ +{ + "schemaVersion": 1, + "id": "ai-worker-r6", + "ownerCommit": "41241c4fb93cdef6c538d051fbc0a19f3194696f", + "lockSha256": "52d49317ea62995b22f0d135c1f3278a7a4f6c7e5b45bf7a468d1ecfa456567a", + "worker": { + "sha256": "8c3c32fb0d7e37238eb52c882ca74f80e3d7be70447a0fed00e426a63f607e93", + "inputs": { + "node_modules/@arcforges/proto/dist/gen/arcforges/hello/v1/hello_pb.js": "f3dafd3d279a0ebeab2dec446ba19d4ea097d611ae55b23282b0e230e6c91e77", + "node_modules/@arcforges/proto/dist/index.js": "feaf0b95c9d3f9f111a06829053c0d5773e85a8a5db4c20e2077ad8a7b73d240", + "node_modules/@bufbuild/protobuf/dist/esm/clone.js": "d2750ac2748256be73650606472cbbab097951f100c1dff684cf46e92415908e", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/boot.js": "b4c474e617f91b74f99322f19561ad699933becf7efe73f0582da94db1bec465", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/embed.js": "ff8a37b2bb8113ae3e6414150d1b7e67cf505a49c3c1853bf1eecd61070c4ff7", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/enum.js": "50e504430270aecdea3794d30f17911099946f38eee258b5837967cb989abd93", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/extension.js": "33e7d6bdd22396057d3f8db92384079f7ec2fda4b3582709de2d43fccacc4a9c", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/file.js": "c36e59c8d61f99cb02cc1c1736175b98c95a8cd85517ddedaa0ce53382828d18", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/index.js": "5d00c6d55312c689ae7f1f4b5319a08a844e59a47c1e7e4c1aa823c14785c374", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/message.js": "01bbb6d0134c43ca84f4eb8efe7514106294f4b50208047cd3031dde24ae5ece", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/restore-json-names.js": "59dd7fdcd3eac52054ff1edd4667fbadb66c851a66f60ec528f9db6421a0eed9", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/scalar.js": "0b2994ee1fee5c72c7f27881aea421bdb1757b0c8c4042f155c433015b0b2455", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/service.js": "d4b90e97ac754d086a6ec26756bb2d5cff563396434f16aee3ae34d913d756b9", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/symbols.js": "330dd51c5ed866affe7ab19e38cad9fb9204847a51cc86e932c02771bcfcd702", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/types.js": "d414a5afba053da6809763cf1d29d2255ed6649347a1e0f0c62c8c74f78fb0c6", + "node_modules/@bufbuild/protobuf/dist/esm/create.js": "fcc95cb58ba11aabc809d9e199e0918d9a696d495d87e969f18c683483a978b3", + "node_modules/@bufbuild/protobuf/dist/esm/descriptors.js": "92884553e5d2d46ea273441deb32dc07187dc8ded3524356fa68536d1f2fc435", + "node_modules/@bufbuild/protobuf/dist/esm/equals.js": "630032abddfaaf6bc05e2069c060983e055bcce535f9ccf9c0d742b1f2806936", + "node_modules/@bufbuild/protobuf/dist/esm/extensions.js": "3d05089a8c1008f20e06da9907eec7f8824f871edfc95e907c15dc8e2bdf43e7", + "node_modules/@bufbuild/protobuf/dist/esm/fields.js": "9c4c967ea6c149011acb8aabfbadb73651f84d572335c48391d627e5283c0cd0", + "node_modules/@bufbuild/protobuf/dist/esm/from-binary.js": "819e9bf5bc421bdbe2e3c6f41e419883ffa34c3ad8ba93fef254747634e6dee3", + "node_modules/@bufbuild/protobuf/dist/esm/from-json.js": "d363744f2b3485546508c5668c22bfc812936b8c34021b98ddeeeaa09f8079b7", + "node_modules/@bufbuild/protobuf/dist/esm/index.js": "8682a066cf855574abf093eb0c0aec93399a9ea135b9641977c5cec90b1400a8", + "node_modules/@bufbuild/protobuf/dist/esm/is-message.js": "eda289d9ef0e979fe77a578ffbbf8012cadcfec4629b66cd98c27d6229a9f020", + "node_modules/@bufbuild/protobuf/dist/esm/merge.js": "83f6bd206b77bfab38d03069a14f1d0c9e5d998b65716642fab5cf8b4d4f75c5", + "node_modules/@bufbuild/protobuf/dist/esm/proto-int64.js": "cdb1f7869edc7171b689fd532fcaa4fa039680e1af44b32cce227cf61ca3fe05", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/error.js": "6ec9654705968f0c75cb0b184d4bb6629a932c05e3d27d603eb42a3cb9447f6f", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/guard.js": "f3b9324922e08cffcc4c7ae3c6e08454f62e187a37404df31a00160cddf34d77", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/message.js": "86c765f093f02c0ec837eebf90458a783537d6acb497a54430ff1417e1d6aad4", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/names.js": "c16595e9f98db8f01f32ed210fca177aa89816ce95303d0520556d31243a9150", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/nested-types.js": "1d1f03bc86ea3788b57b43c7720de2c41a7b133d852262a7615b3b152777cdef", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/reflect-check.js": "247cb28c0ac729c097f0a5de3ee3b9b52fa1a178c05535f074bdf154918a4844", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/reflect.js": "d21865e03a3a9f6348f4979fa77ddb13df7851f3917e89cda131cc5f30ce9e1c", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/scalar.js": "cb095614d5f901cd00d46b930a23c64ebd909a77831aa666768fca47f3e7745f", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/unsafe.js": "be7b00368ec24ab7ccb2f776b7478fa97cffd83772a0489bd80f81955d553326", + "node_modules/@bufbuild/protobuf/dist/esm/registry.js": "6a5c9d0cd7855504e9e2ba1cbce64fa7a056a49e989ff66902b972cc2f636e90", + "node_modules/@bufbuild/protobuf/dist/esm/to-binary.js": "63241fb54445dbb81561236f074d1a031735ad8cc0abc93269b014e8a9661886", + "node_modules/@bufbuild/protobuf/dist/esm/to-json.js": "1c2c618dc490c9b0682ca1f6d0e13c480a0840d6f18b2338ad00ebab116f7e67", + "node_modules/@bufbuild/protobuf/dist/esm/types.js": "d414a5afba053da6809763cf1d29d2255ed6649347a1e0f0c62c8c74f78fb0c6", + "node_modules/@bufbuild/protobuf/dist/esm/unknown-enum.js": "475e62094c73367833cec6253c5834a887cae9bcfa43a691a9fe3b7495c19106", + "node_modules/@bufbuild/protobuf/dist/esm/wire/base64-encoding.js": "d65944009ab55b40661572a8bdcaf0374de8566e2bc4a0dc11d7790e79cf9eeb", + "node_modules/@bufbuild/protobuf/dist/esm/wire/binary-encoding.js": "84ad0859d5ddd83ad2132c729ddc9cf07e3969ebff9229ae027623305e8a7ffc", + "node_modules/@bufbuild/protobuf/dist/esm/wire/index.js": "4cc137a3eb782f0ab9e8d02f6c5975e55f721f2d63ce2186f0fd6014af9b9bd5", + "node_modules/@bufbuild/protobuf/dist/esm/wire/size-delimited.js": "1c364712aa61711ce0e654ed81e26fe821e8f7b6dac9c31fe6d49fc184dbacd2", + "node_modules/@bufbuild/protobuf/dist/esm/wire/text-encoding.js": "145fc2c8a2ee92148dd9fd595b250591574c9b1271a8db7ffb95c78353962cb5", + "node_modules/@bufbuild/protobuf/dist/esm/wire/text-format.js": "92aa7e4df3bf7dfc02235174f297dcbff6bd02f7eb6325876cbb24ada6d51414", + "node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js": "5a78ffe702716989b7c1d5f5deb73f7283655af5a7ecb3d885ae0b19f59eeaeb", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/any.js": "f8b97660653e1826c51166d4700d079d2fc89dd923ee522706b11297e06f3165", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/duration.js": "d730efb4ee5b52c492c1d04859568461a4efbfa7474048afa5f8f776a3b6d55b", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/any_pb.js": "8a7db66448dd118e7bc64730a298e9d747cb78bd9604c12bd6ee22de19b64b5c", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/api_pb.js": "73e489001027c703bc0224ae73f78ecefe028e88284bd06952e8603c3d81472c", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/compiler/plugin_pb.js": "25d57b7e880708c04738087de674a8c98092e5bfd39d5193cdb63a2f1e33871e", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/cpp_features_pb.js": "89f8c8a3ca87eacd6d1787156d8a950ce0e3ad85894ed94140f4c696ee142147", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/descriptor_pb.js": "1feb293fbfd20018e4a3790168737afa3705e7bd22dbcf2a6fd4b0cdb7bfac0c", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/duration_pb.js": "fbc88bbf3cea189f0494b0949049ffeac334b8c5015ebfc988217f2fcdb3262b", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/empty_pb.js": "98f5abf9a7fb522aab513ef3831dd9c5837cebcb38a960cb546ffd084926d746", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/field_mask_pb.js": "f793995a80fb30a168ac2ab10f29587e8b5f472464372429468db59af650dd5d", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/go_features_pb.js": "dd9f3f24fb154cfbfbde94e8f2647647c80c8ca050b98e981a407e760a4b9c1e", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/java_features_pb.js": "caa925cb881f7586e9e01f09325f09ebdecf742debbfff21eb7c4c49ea09ef02", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/source_context_pb.js": "063a8e43056578ecec6ba95eb1a9f28d8b704daea2260ef2943840def1cf9526", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/struct_pb.js": "efce20f9f127263ca66d855115e01b37af0afb8b8baafeba7dcc2e0834e99e4f", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/timestamp_pb.js": "b09ee99807e1edeb746b4a4a1e41519edaff1fed9f71a170bc15e8835af93e25", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/type_pb.js": "589afd70975c49b5d8856a85ffb597b1412f04b35b6234c324564d8640fcae15", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/wrappers_pb.js": "f5f56922916f3b22e72a37521c5ca915506b8b205fe28e89a1986dbce15d4b47", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/index.js": "96cb2eb563ccb18dc23fd9f8fb0f65193a1b90f39758a561eed747368ead00b3", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/json.js": "75930436cfbd374ae28c27f8ee5358e15409d8373875951fbce8b425a1e984d0", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/timestamp.js": "3c98fa838c05abcfd8dfda1128f2d1fca9b196a371fe9751abbd8f4c3b9d04ec", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/wrappers.js": "5f084c743c64707a1861d4e6ce05fcc5aede31838e03f13f2882b02dab7e945a", + "src/deployment.ts": "5fd095303987e78b909981f2f57aa73e7440867086dd04249161999ed7ccbdd4", + "src/hello.ts": "17f81aabf05f4f2c8246f52e29e6a968287edc50088c0544a2bf7b0c3a9f213a", + "src/index.ts": "8cc863cd51caa0fa3aa0ce8a4e809e41c2cb133631e72e0737f5344b803a420c", + "src/model-diagnostics.ts": "27797ad98123828afb4f7bbf21ec5272001aff8e616a432408674ff1d859429b", + "src/model.ts": "4679c94a66195738500763902623de8c98fd3fae85417e9fbdfac6bd41ad2767" + }, + "outputInputs": [ + "node_modules/@arcforges/proto/dist/gen/arcforges/hello/v1/hello_pb.js", + "node_modules/@arcforges/proto/dist/index.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/boot.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/file.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/message.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/restore-json-names.js", + "node_modules/@bufbuild/protobuf/dist/esm/create.js", + "node_modules/@bufbuild/protobuf/dist/esm/descriptors.js", + "node_modules/@bufbuild/protobuf/dist/esm/from-binary.js", + "node_modules/@bufbuild/protobuf/dist/esm/index.js", + "node_modules/@bufbuild/protobuf/dist/esm/is-message.js", + "node_modules/@bufbuild/protobuf/dist/esm/proto-int64.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/error.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/guard.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/message.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/names.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/nested-types.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/scalar.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/unsafe.js", + "node_modules/@bufbuild/protobuf/dist/esm/registry.js", + "node_modules/@bufbuild/protobuf/dist/esm/to-binary.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/base64-encoding.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/binary-encoding.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/text-encoding.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/text-format.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/descriptor_pb.js", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/wrappers.js", + "src/deployment.ts", + "src/hello.ts", + "src/index.ts", + "src/model-diagnostics.ts", + "src/model.ts" + ], + "exports": [ + "HelloAgentWorkflow", + "default" + ], + "externalImports": [ + "cloudflare:workers", + "cloudflare:workflows" + ], + "sourceMap": { + "version": 3, + "sources": [ + "src/index.ts", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/names.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js", + "node_modules/@bufbuild/protobuf/dist/esm/proto-int64.js", + "node_modules/@bufbuild/protobuf/dist/esm/descriptors.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/scalar.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/unsafe.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/restore-json-names.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/text-format.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/nested-types.js", + "node_modules/@bufbuild/protobuf/dist/esm/registry.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/boot.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/base64-encoding.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/text-encoding.js", + "node_modules/@bufbuild/protobuf/dist/esm/wire/binary-encoding.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/error.js", + "node_modules/@bufbuild/protobuf/dist/esm/is-message.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/guard.js", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/wrappers.js", + "node_modules/@bufbuild/protobuf/dist/esm/create.js", + "node_modules/@bufbuild/protobuf/dist/esm/reflect/message.js", + "node_modules/@bufbuild/protobuf/dist/esm/to-binary.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/message.js", + "node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/descriptor_pb.js", + "node_modules/@bufbuild/protobuf/dist/esm/from-binary.js", + "node_modules/@bufbuild/protobuf/dist/esm/codegenv2/file.js", + "node_modules/@arcforges/proto/dist/gen/arcforges/hello/v1/hello_pb.js", + "src/model-diagnostics.ts", + "src/hello.ts", + "src/deployment.ts", + "src/model.ts" + ], + "mappingsSha256": "36ae8ce95f19e4e8496f7ca1d395d274ffd075b558d1264432aedd0db0727346", + "names": [ + "ScalarType", + "_a", + "label", + "boot", + "WireType", + "isMessage", + "messageDesc", + "EDITION_PROTO3", + "EDITION_PROTO2", + "IMPLICIT", + "messageDesc", + "IMPLICIT", + "LEGACY_REQUIRED", + "record", + "ExtensionRangeOptions_VerificationState", + "FieldDescriptorProto_Type", + "FieldDescriptorProto_Label", + "FileOptions_OptimizeMode", + "FieldOptions_CType", + "FieldOptions_JSType", + "FieldOptions_OptionRetention", + "FieldOptions_OptionTargetType", + "MethodOptions_IdempotencyLevel", + "FeatureSet_VisibilityFeature_DefaultSymbolVisibility", + "FeatureSet_FieldPresence", + "FeatureSet_EnumType", + "FeatureSet_RepeatedFieldEncoding", + "FeatureSet_Utf8Validation", + "FeatureSet_MessageEncoding", + "FeatureSet_JsonFormat", + "FeatureSet_EnforceNamingStyle", + "GeneratedCodeInfo_Annotation_Semantic", + "Edition", + "SymbolVisibility", + "compileMessage", + "_a", + "record" + ], + "sourceRootMode": "output-directory" + }, + "readmePrefix": "This folder contains the built output assets for the worker \"arcforges-ai-hello\" generated at " + }, + "packages": { + "node_modules/@arcforges/proto": { + "version": "1.0.0-ci.44.1", + "integrity": "sha512-GJc6x7TRFT1N9H7mlKAPf2+p+55arUOLaaGR+2AdzrRvJ3AnCAM8a7pG8C3CN+KiaXYVFkUKtyKZl9SivJC4Lw==" + }, + "node_modules/@bufbuild/protobuf": { + "version": "2.15.0", + "integrity": "sha512-DAheWUkVr/SJTWCc+lg9dhY0eN4SaWlf4+bG1KzHeXbnqt0AfB/NX0Z+VunGlM1ki1B4zVvye27MpKh/svySUA==" + }, + "node_modules/wrangler": { + "version": "4.131.2", + "integrity": "sha512-jmkGE7monbPKyYQr1FPQN+SARVhddqw2fhXOmTKCw4lroqlFGSS6rit/RTvPi/qzNLKrXxkS8DhWXasJnStplg==" + }, + "node_modules/esbuild": { + "version": "0.28.1", + "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==" + } + }, + "fixedLegal": { + "LICENSE": { + "source": "LICENSE", + "sha256": "8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef" + }, + "licenses/Apache-2.0.txt": { + "source": "node_modules/@arcforges/proto/LICENSE", + "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30" + }, + "licenses/Contracts-NOTICE.txt": { + "source": "node_modules/@arcforges/proto/NOTICE", + "sha256": "2ac2bdb26034eb9632f24af77e757be8d752347e994f9f446aaca5d8955bda24" + }, + "third-party/Wrangler.LICENSE.txt": { + "source": "third-party/Wrangler.LICENSE.txt", + "sha256": "9bb3b077cc8628334bab25961223dd8207252c8a56aa054195be38f1c042aaf4" + }, + "third-party/Esbuild.LICENSE.txt": { + "source": "third-party/Esbuild.LICENSE.txt", + "sha256": "b40ec5baec7bb34fa5b1c09521fa3cd52d5fad7adafed74932a2010d3612a681" + }, + "third-party/Buf.LICENSE.txt": { + "source": "third-party/Buf.LICENSE.txt", + "sha256": "c04b4216f1cd4c5a4f7fb2f2a1b0ae70d847e9e0cac7c9dee9bf8cc03177c449" + }, + "third-party/Protobuf.LICENSE.txt": { + "source": "third-party/Protobuf.LICENSE.txt", + "sha256": "6e5e117324afd944dcf67f36cf329843bc1a92229a8cd9bb573d7a83130fea7d" + }, + "licenses/protobuf-BSD-3-Clause.txt": { + "source": "node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js", + "sha256": "0e952cb110ff6944789fbe47c25b38819a3866c04c7c5cbea8d0c0d8f3a92f0e", + "transform": "initial-comment-header" + } + }, + "authoredLegal": [ + "THIRD_PARTY_NOTICES.md", + "eng/provenance/NOTICE.txt" + ], + "contracts": { + "repository": "https://github.com/ArcForges/Contracts", + "commit": "199e61565aff33db425f6148a55a7676388a8e8c", + "dirty": false, + "version": "1.0.0-ci.44.1", + "schema": "arcforges.hello.v1", + "descriptorSha256": "7219a8d730978bcc3b7b8769e159d06711dff3f2b07715a6d487589f8c09b99c", + "dependencyLocks": { + "package-lock.json": "5ccbb6790ac9f6995b28d33a66f9c06192eeed2434892bdae8f9badde1614f7d", + "PublicApi/packages.lock.json": "6081ad4fb578234a0fb55b07cc28f635269fc9441be05a1d7c484bc423c25706", + "gradle.lockfile": "410eb7817f1bdf23eb5c2563b1953c4c2ee0403d54f687cb1ccdf82c0bd816de", + "src/public/kotlin/contract-fixtures/gradle.lockfile": "5f5cc6b71ccc86d6de0e8314029384c790605f1d930bacb8560fd8ee57bded1c", + "src/public/kotlin/contracts-client/gradle.lockfile": "8f73565fdf42782b54bc63075e9daa435f7301dcee0654657f47235975e640ce", + "src/public/kotlin/contracts-connect-client/gradle.lockfile": "560f3bf8fa2d38cc4b9a87717342c7a3e003ed1243f405519f5b73e6de0acfb9", + "src/public/kotlin/contracts-proto/gradle.lockfile": "766ba7a9c4101ae5149d0200ddc2bfc45d54aa1e3187717171a1dfab28a1ec4b" + } + }, + "sbom": { + "bomFormat": "CycloneDX", + "specVersion": "1.5", + "rootRef": "@arcforges/ai@0.0.0", + "rootPurl": "pkg:npm/%40arcforges/ai@0.0.0", + "rootName": "@arcforges/ai", + "components": [ + { + "bom-ref": "@arcforges/proto@1.0.0-ci.44.1", + "name": "@arcforges/proto", + "version": "1.0.0-ci.44.1", + "purl": "pkg:npm/%40arcforges/proto@1.0.0-ci.44.1", + "hashes": [ + { + "alg": "SHA-512", + "content": "18973ac7b4d1153d4df47ee694a00f7f6fa9fb9e5aad438b69a191fb601dceb46f27702708033c6bba46f02dc237e2a269761516450ab7229997d4a2bc90b82f" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ] + }, + { + "bom-ref": "@bufbuild/protobuf@2.15.0", + "name": "@bufbuild/protobuf", + "version": "2.15.0", + "purl": "pkg:npm/%40bufbuild/protobuf@2.15.0", + "hashes": [ + { + "alg": "SHA-512", + "content": "0c085e594915aff4894d609cfa583d76163478de1269695fe3e6c6d4acc77976e7aadd007c1fcd5f467e56e9c694cd648b5078cd5bf27b6ecca4a87fb2fc9250" + } + ], + "licenses": [ + { + "expression": "(Apache-2.0 AND BSD-3-Clause)" + } + ] + } + ], + "dependencies": [ + { + "ref": "@arcforges/ai@0.0.0", + "dependsOn": [ + "@arcforges/proto@1.0.0-ci.44.1", + "@bufbuild/protobuf@2.15.0" + ] + }, + { + "ref": "@arcforges/proto@1.0.0-ci.44.1", + "dependsOn": [ + "@bufbuild/protobuf@2.15.0" + ] + }, + { + "ref": "@bufbuild/protobuf@2.15.0", + "dependsOn": [] + } + ] + }, + "configurationSha256": "9778f643f32d148fe064986cec486c5ba6f5a107cb2b2adc9c85951cf8c08c40" +} diff --git a/eng/provenance/files.json b/eng/provenance/files.json index bc3213c..0116e1a 100644 --- a/eng/provenance/files.json +++ b/eng/provenance/files.json @@ -50,12 +50,14 @@ "eng/provenance/artifact-profiles/ai-worker-r3.json", "eng/provenance/artifact-profiles/ai-worker-r4.json", "eng/provenance/artifact-profiles/ai-worker-r5.json", + "eng/provenance/artifact-profiles/ai-worker-r6.json", "eng/provenance/files.json", "eng/provenance/records/ai-worker-bundle-r1.json", "eng/provenance/records/ai-worker-bundle-r2.json", "eng/provenance/records/ai-worker-bundle-r3.json", "eng/provenance/records/ai-worker-bundle-r4.json", "eng/provenance/records/ai-worker-bundle-r5.json", + "eng/provenance/records/ai-worker-bundle-r6.json", "eng/provenance/records/buf-legal-r1.json", "eng/provenance/records/canonical-agpl-legal-r1.json", "eng/provenance/records/cloud-build-identity-r1.json", @@ -104,5 +106,5 @@ "eng/tests/build-identity.test.mjs": "cloud-build-identity-r1", "eng/version-sources.json": "cloud-build-identity-r1" }, - "artifacts": ["ai-worker-bundle-r5"] + "artifacts": ["ai-worker-bundle-r6"] } diff --git a/eng/provenance/records/ai-worker-bundle-r6.json b/eng/provenance/records/ai-worker-bundle-r6.json new file mode 100644 index 0000000..bf753e0 --- /dev/null +++ b/eng/provenance/records/ai-worker-bundle-r6.json @@ -0,0 +1,291 @@ +{ + "schemaVersion": 1, + "id": "ai-worker-bundle-r6", + "kind": "generated", + "sourceRepository": "https://github.com/ArcForges/AI", + "sourceCommit": "41241c4fb93cdef6c538d051fbc0a19f3194696f", + "sourcePaths": [ + "src/deployment.ts", + "src/hello.ts", + "src/index.ts", + "src/model-diagnostics.ts", + "src/model.ts" + ], + "licence": { + "spdx": "AGPL-3.0-only", + "category": "agpl-compatible", + "evidence": [ + { + "path": "LICENSE", + "sha256": "8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef", + "finding": "Unchanged owner AGPL legal text and explicit SPDX headers on authored inputs; the current baseline contains these exact inputs." + } + ], + "scope": "Actual Worker closure: five unchanged owned inputs, published Contracts 1.0.0-ci.44.1 and one deduplicated protobuf 2.15.0 runtime with Apache and explicit BSD varint/descriptor scopes, esbuild MIT helpers and Wrangler MIT README. All 73 parsed inputs, 33 emitted inputs and 31 source-map bodies are reviewed. Every input retains an accepted byte identity; six codegenv2 modules move from the former nested 2.14.1 path with identical bytes. Development tools and hosted models are not bundled.", + "copyingPermission": null + }, + "attribution": [ + "Worker: Copyright ArcForges contributors, AGPL-3.0-only. Contracts: ArcForges contributors, Apache-2.0. Protobuf runtimes: Copyright 2021-2026 Buf Technologies, Inc., Apache-2.0; varint/descriptor material: Copyright 2008 Google Inc., BSD-3-Clause. Helpers: Copyright 2020 Evan Wallace, MIT. Generated README: Copyright 2020 Cloudflare, Inc., MIT. Complete respective texts and source-bound records accompany the actual candidate." + ], + "targets": [], + "artifactTargets": [ + { + "project": "package.json", + "package": "@arcforges/ai", + "kind": "worker-bundle", + "profile": "eng/provenance/artifact-profiles/ai-worker-r6.json", + "sha256": "07a50826733d787ae61fe9d58ac4b93b25d29670d2ad90df52ed3c45e88fee78" + } + ], + "disposition": "Rewrite", + "verification": { + "kind": "regeneration", + "command": "Locked restore, targeted offline checks and one candidate build. Derive retained/moved inputs from r5, review Contracts source/NOTICE metadata and require actual Wrangler output/maps to match independently generated locked esbuild expectations. No runtime or public-download test.", + "expected": "Every target and distributed legal/resource member matches its reviewed immutable source; unclassified or changed bytes fail.", + "artifacts": [] + }, + "notice": { + "required": true, + "text": "Worker: Copyright ArcForges contributors, AGPL-3.0-only. Contracts: ArcForges contributors, Apache-2.0. Protobuf runtimes: Copyright 2021-2026 Buf Technologies, Inc., Apache-2.0; varint/descriptor material: Copyright 2008 Google Inc., BSD-3-Clause. Helpers: Copyright 2020 Evan Wallace, MIT. Generated README: Copyright 2020 Cloudflare, Inc., MIT. Complete respective texts and source-bound records accompany the actual candidate.", + "files": [ + "eng/provenance/NOTICE.txt" + ], + "distribution": "source-and-applicable-artifacts", + "reason": "Actual Worker closure: five unchanged owned inputs, published Contracts 1.0.0-ci.44.1 and one deduplicated protobuf 2.15.0 runtime with Apache and explicit BSD varint/descriptor scopes, esbuild MIT helpers and Wrangler MIT README. All 73 parsed inputs, 33 emitted inputs and 31 source-map bodies are reviewed. Every input retains an accepted byte identity; six codegenv2 modules move from the former nested 2.14.1 path with identical bytes. Development tools and hosted models are not bundled." + }, + "lifetime": { + "status": "permanent", + "owner": "AI Licensing and Provenance Owner", + "removalTrigger": null + }, + "generation": { + "generators": [ + { + "repository": "https://github.com/cloudflare/workers-sdk", + "commit": "a256f9556bb24081e01281284056c6d370992cd7", + "paths": [ + "packages/wrangler/src/deployment-bundle/bundle.ts", + "packages/wrangler/src/deployment-bundle/maybe-build-worker.ts" + ], + "spdx": "MIT", + "evidence": [ + { + "path": "LICENSE-MIT", + "sha256": "9bb3b077cc8628334bab25961223dd8207252c8a56aa054195be38f1c042aaf4", + "finding": "Reviewed the particular type-generation, bundling and README-template paths; no subordinate override was found. Select the compatible MIT alternative and retain its full terms." + } + ] + }, + { + "repository": "https://github.com/evanw/esbuild", + "commit": "bb9db84c02433fbe37b3509f53f9f3e3cc48725e", + "paths": [ + "internal/runtime/runtime.go" + ], + "spdx": "MIT", + "evidence": [ + { + "path": "LICENSE.md", + "sha256": "b40ec5baec7bb34fa5b1c09521fa3cd52d5fad7adafed74932a2010d3612a681", + "finding": "The generated __defProp/__name helpers come from internal/runtime/runtime.go and retain MIT terms; compiler implementation is not bundled." + } + ] + }, + { + "repository": "https://github.com/microsoft/TypeScript", + "commit": "050880ce59e30b356b686bd3144efe24f875ebc8", + "paths": [ + "src/compiler/transformers/ts.ts" + ], + "spdx": "Apache-2.0", + "evidence": [ + { + "path": "LICENSE.txt", + "sha256": "a5e9f9b1575301c7a7a03508fdaa2e05a918cc17fd21c6e898096a96d6a34f61", + "finding": "Only independent upstream reproduction uses 6.0.3; the application stays on 7.0.2. No compiler implementation is distributed." + } + ] + }, + { + "repository": "https://github.com/bufbuild/protobuf-es", + "commit": "f72f5295c853b7be8c0828f350e4f2803c8afdde", + "paths": [ + "packages/protoc-gen-es/src/protoc-gen-es-plugin.ts" + ], + "spdx": "Apache-2.0", + "evidence": [ + { + "path": "LICENSE", + "sha256": "c04b4216f1cd4c5a4f7fb2f2a1b0ae70d847e9e0cac7c9dee9bf8cc03177c449", + "finding": "Generated descriptor source retains the plugin Apache position; the actual bundled original descriptor schema has separately preserved Google BSD terms." + } + ] + } + ], + "inputs": [ + { + "repository": "https://github.com/ArcForges/AI", + "commit": "41241c4fb93cdef6c538d051fbc0a19f3194696f", + "paths": [ + "src/deployment.ts", + "src/hello.ts", + "src/index.ts", + "src/model-diagnostics.ts", + "src/model.ts", + "wrangler.json" + ], + "spdx": "AGPL-3.0-only", + "evidence": [ + { + "path": "LICENSE", + "sha256": "8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef", + "finding": "Unchanged owner AGPL legal text and explicit SPDX headers on authored inputs; the current baseline contains these exact inputs." + } + ] + }, + { + "repository": "https://github.com/ArcForges/Contracts", + "commit": "199e61565aff33db425f6148a55a7676388a8e8c", + "paths": [ + "public/proto/arcforges/hello/v1/hello.proto", + "src/public/ts/proto/src/index.ts", + "eng/contracts.py" + ], + "spdx": "Apache-2.0", + "evidence": [ + { + "path": "LICENSE", + "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30", + "finding": "Exact npm package 1.0.0-ci.44.1 remains Apache-2.0, with unchanged generated hello/index inputs and descriptor. Source receipt identifies this producer commit; NOTICE changes only package/protobuf version labels. Dependencies resolve to protobuf 2.15.0 with prior accepted input bytes." + }, + { + "path": "public/proto/arcforges/hello/v1/hello.proto", + "sha256": "92489f89d1898a3d3bbea56c72116416cd0152ae8866c98745739437020c67d9", + "finding": "Authored public Hello schema under the Contracts Apache boundary." + } + ] + }, + { + "repository": "https://github.com/bufbuild/protobuf-es", + "commit": "f72f5295c853b7be8c0828f350e4f2803c8afdde", + "paths": [ + "packages/protobuf/src/clone.ts", + "packages/protobuf/src/codegenv2/boot.ts", + "packages/protobuf/src/codegenv2/embed.ts", + "packages/protobuf/src/codegenv2/enum.ts", + "packages/protobuf/src/codegenv2/extension.ts", + "packages/protobuf/src/codegenv2/file.ts", + "packages/protobuf/src/codegenv2/index.ts", + "packages/protobuf/src/codegenv2/message.ts", + "packages/protobuf/src/codegenv2/restore-json-names.ts", + "packages/protobuf/src/codegenv2/scalar.ts", + "packages/protobuf/src/codegenv2/service.ts", + "packages/protobuf/src/codegenv2/symbols.ts", + "packages/protobuf/src/codegenv2/types.ts", + "packages/protobuf/src/create.ts", + "packages/protobuf/src/descriptors.ts", + "packages/protobuf/src/equals.ts", + "packages/protobuf/src/extensions.ts", + "packages/protobuf/src/fields.ts", + "packages/protobuf/src/from-binary.ts", + "packages/protobuf/src/from-json.ts", + "packages/protobuf/src/index.ts", + "packages/protobuf/src/is-message.ts", + "packages/protobuf/src/merge.ts", + "packages/protobuf/src/proto-int64.ts", + "packages/protobuf/src/reflect/error.ts", + "packages/protobuf/src/reflect/guard.ts", + "packages/protobuf/src/reflect/message.ts", + "packages/protobuf/src/reflect/names.ts", + "packages/protobuf/src/reflect/nested-types.ts", + "packages/protobuf/src/reflect/reflect-check.ts", + "packages/protobuf/src/reflect/reflect.ts", + "packages/protobuf/src/reflect/scalar.ts", + "packages/protobuf/src/reflect/unsafe.ts", + "packages/protobuf/src/registry.ts", + "packages/protobuf/src/to-binary.ts", + "packages/protobuf/src/to-json.ts", + "packages/protobuf/src/types.ts", + "packages/protobuf/src/unknown-enum.ts", + "packages/protobuf/src/wire/base64-encoding.ts", + "packages/protobuf/src/wire/binary-encoding.ts", + "packages/protobuf/src/wire/index.ts", + "packages/protobuf/src/wire/size-delimited.ts", + "packages/protobuf/src/wire/text-encoding.ts", + "packages/protobuf/src/wire/text-format.ts", + "packages/protobuf/src/wkt/any.ts", + "packages/protobuf/src/wkt/duration.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/any_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/api_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/compiler/plugin_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/cpp_features_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/descriptor_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/duration_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/empty_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/field_mask_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/go_features_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/java_features_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/source_context_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/struct_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/timestamp_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/type_pb.ts", + "packages/protobuf/src/wkt/gen/google/protobuf/wrappers_pb.ts", + "packages/protobuf/src/wkt/index.ts", + "packages/protobuf/src/wkt/json.ts", + "packages/protobuf/src/wkt/timestamp.ts", + "packages/protobuf/src/wkt/wrappers.ts" + ], + "spdx": "Apache-2.0", + "evidence": [ + { + "path": "LICENSE", + "sha256": "c04b4216f1cd4c5a4f7fb2f2a1b0ae70d847e9e0cac7c9dee9bf8cc03177c449", + "finding": "The previously reviewed 60 protobuf 2.15.0 parsed modules and six codegenv2 modules byte-identical to their prior reviewed nested 2.14.1 copies form the new 66-module closure. Apache headers and explicit separate BSD varint terms are preserved; no new implementation bytes were introduced." + } + ] + }, + { + "repository": "https://github.com/bufbuild/protobuf-es", + "commit": "f72f5295c853b7be8c0828f350e4f2803c8afdde", + "paths": [ + "packages/protobuf/src/wire/varint.ts" + ], + "spdx": "BSD-3-Clause", + "evidence": [ + { + "path": "packages/protobuf/src/wire/varint.ts", + "sha256": "794a4cffb99eb15483efa73ee038e493d28bea3d247c0be9f13740c546b0c259", + "finding": "This particular varint source has its own complete Google BSD header; the Apache repository label is not substituted for it." + } + ] + }, + { + "repository": "https://github.com/protocolbuffers/protobuf", + "commit": "4b0c3aacf0657fbf38253b38918d3358dd4319ec", + "paths": [ + "src/google/protobuf/descriptor.proto" + ], + "spdx": "BSD-3-Clause", + "evidence": [ + { + "path": "src/google/protobuf/descriptor.proto", + "sha256": "32f3df357257f556b311c7e4ad33625a7aa13de541cb53a29ae85ac746c11a07", + "finding": "The only generated well-known type emitted in this Worker/source map is descriptor.proto; its own Google BSD header is preserved with the complete upstream licence." + } + ] + } + ], + "command": "Derive the permitted parsed set from r5 by normalizing nested protobuf paths to the root and deduplicating identical admitted bytes. Generate Worker/map with locked esbuild using reviewed Wrangler es2024/conditions/keepNames/source-map options; require actual Wrangler candidate equality. Runtime SBOM derives from prior closure by updating Contracts coordinate/integrity and deleting redundant protobuf 2.14.1.", + "outputSpdx": "AGPL-3.0-only" + }, + "review": { + "owner": "Licensing and Provenance Owner", + "reviewer": "Codex, acting under the maintainer's implementation/review authorization", + "reviewedOn": "2026-09-21", + "decision": "approved", + "rationale": "Actual Worker closure: five unchanged owned inputs, published Contracts 1.0.0-ci.44.1 and one deduplicated protobuf 2.15.0 runtime with Apache and explicit BSD varint/descriptor scopes, esbuild MIT helpers and Wrangler MIT README. All 73 parsed inputs, 33 emitted inputs and 31 source-map bodies are reviewed. Every input retains an accepted byte identity; six codegenv2 modules move from the former nested 2.14.1 path with identical bytes. Development tools and hosted models are not bundled. Producer 199e61565aff33db425f6148a55a7676388a8e8c retains the hello descriptor and updates its recorded dependency locks. Full legal terms and generator versions remain unchanged. The independently generated Worker/map, deduplicated SBOM and version-only NOTICE delta are explicitly admitted. Prior profiles and records remain immutable; no new runtime acceptance is claimed. Dependabot refreshed the same PR from 38.1 to 44.1 during review. All 73 compiled inputs and generators remain identical, so the existing independent Worker/map oracle is reused; only producer/package/lock/NOTICE/SBOM metadata is advanced. Clean hosted CI validates the final candidate.", + "baselineCommit": "41241c4fb93cdef6c538d051fbc0a19f3194696f", + "reconciliation": false + }, + "supersedes": "ai-worker-bundle-r5" +} diff --git a/eng/tests/release-provenance.test.mjs b/eng/tests/release-provenance.test.mjs index b03e61b..af32667 100644 --- a/eng/tests/release-provenance.test.mjs +++ b/eng/tests/release-provenance.test.mjs @@ -41,24 +41,24 @@ function scenario(name, change, expected) { }); } -test("actual locked candidate retains both protobuf runtimes and all packaged provenance", () => { +test("actual locked candidate retains the deduplicated protobuf runtime and all packaged provenance", () => { const manifest = verifyCandidate(); const receipt = readJson(path.join(CANDIDATE, "provenance.json")); assert.equal(receipt.sourceCommit, manifest.sourceCommit); assert.equal( receipt.worker.sha256, - "fa719bbbd6ae9c5a3cbec7e6080d385845c680995799cbf9de796db91679a52a", + "8c3c32fb0d7e37238eb52c882ca74f80e3d7be70447a0fed00e426a63f607e93", ); - assert.equal(receipt.worker.parsedInputs, 104); - assert.equal(receipt.worker.emittedInputs, 45); - assert.equal(receipt.worker.sourceMapBodies, 43); + assert.equal(receipt.worker.parsedInputs, 73); + assert.equal(receipt.worker.emittedInputs, 33); + assert.equal(receipt.worker.sourceMapBodies, 31); const sbom = readJson(path.join(CANDIDATE, "sbom.cdx.json")); assert.deepEqual( sbom.components .filter((entry) => entry.name === "@bufbuild/protobuf") .map((entry) => entry.version) .sort(), - ["2.14.1", "2.15.0"], + ["2.15.0"], ); assert.equal(sbom.metadata.component.name, "@arcforges/ai"); }); @@ -184,10 +184,10 @@ scenario( ); scenario( - "reject omission of the nested protobuf runtime from the SBOM", + "reject omission of the protobuf runtime from the SBOM", ({ read, write }) => { const sbom = read("sbom.cdx.json"); - sbom.components = sbom.components.filter((entry) => entry.version !== "2.14.1"); + sbom.components = sbom.components.filter((entry) => entry.name !== "@bufbuild/protobuf"); write("sbom.cdx.json", sbom); }, /Changed runtime SBOM component closure/u, diff --git a/package-lock.json b/package-lock.json index 29298ac..4ad8c79 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "0.0.0", "license": "AGPL-3.0-only", "dependencies": { - "@arcforges/proto": "1.0.0-ci.25.1", + "@arcforges/proto": "1.0.0-ci.44.1", "@bufbuild/protobuf": "2.15.0" }, "devDependencies": { @@ -28,20 +28,14 @@ } }, "node_modules/@arcforges/proto": { - "version": "1.0.0-ci.25.1", - "resolved": "https://registry.npmjs.org/@arcforges/proto/-/proto-1.0.0-ci.25.1.tgz", - "integrity": "sha512-UH6TNbDtpCAn83CgL71DvD4tc5KQqZNdmkV5wwfXVP002x31RMZ+qUmq/Si0xvrDjZY8+mwsimk/ST4GXHV3Rg==", + "version": "1.0.0-ci.44.1", + "resolved": "https://registry.npmjs.org/@arcforges/proto/-/proto-1.0.0-ci.44.1.tgz", + "integrity": "sha512-GJc6x7TRFT1N9H7mlKAPf2+p+55arUOLaaGR+2AdzrRvJ3AnCAM8a7pG8C3CN+KiaXYVFkUKtyKZl9SivJC4Lw==", "license": "Apache-2.0", "dependencies": { - "@bufbuild/protobuf": "2.14.1" + "@bufbuild/protobuf": "2.15.0" } }, - "node_modules/@arcforges/proto/node_modules/@bufbuild/protobuf": { - "version": "2.14.1", - "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.14.1.tgz", - "integrity": "sha512-agRJn3+EJDUe8AvxTx/LnHA/GErvLE62pSaSk7+MwFOtOv8eWBu/qCq2qoZjBjVZ3C2aiFJCveuSs17KMkYGOw==", - "license": "(Apache-2.0 AND BSD-3-Clause)" - }, "node_modules/@biomejs/biome": { "version": "2.5.14", "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.14.tgz", diff --git a/package.json b/package.json index 5ff201d..39a2628 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,7 @@ "test:runtime": "vitest run --config vitest.runtime.config.ts" }, "dependencies": { - "@arcforges/proto": "1.0.0-ci.25.1", + "@arcforges/proto": "1.0.0-ci.44.1", "@bufbuild/protobuf": "2.15.0" }, "devDependencies": {