wt
e2b4dbdb76
Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR. Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested. Task: S00-018 Agent: auto-protocol-89fe6563092c Role: protocol Action: claim Status: review Task title: Validate bounded standalone XML ingress for the XMPP candidate
43 lines
2.0 KiB
Python
43 lines
2.0 KiB
Python
"""Check exact installed graph, preserved notices, and unchanged candidate files."""
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
|
|
root = Path(__file__).resolve().parent
|
|
lock = json.loads((root / 'package-lock.json').read_text())
|
|
manifest = json.loads((root / 'package.json').read_text())
|
|
assert manifest['engines'] == {'node': '24.21.0', 'npm': '11.19.0'}
|
|
assert manifest['dependencies'] == {'saxes': '6.0.0', 'stanza': '12.22.1', 'xmlchars': '2.2.0'}
|
|
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
|
|
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
|
|
count = 0
|
|
for key, entry in lock['packages'].items():
|
|
if not key:
|
|
continue
|
|
count += 1
|
|
assert entry['resolved'].startswith('https://registry.npmjs.org/')
|
|
assert entry['integrity'].startswith('sha512-')
|
|
installed = root / key
|
|
meta = json.loads((installed / 'package.json').read_text())
|
|
assert meta['version'] == entry['version']
|
|
assert meta['license'] == entry['license']
|
|
assert f"| {meta['name']} | {meta['version']} | {meta['license']} |" in inventory
|
|
files = [p for p in installed.iterdir() if p.is_file() and
|
|
(p.name.lower().startswith('license') or p.name.lower().startswith('notice'))]
|
|
if meta['name'] == 'saxes':
|
|
files = [root / 'licenses/saxes-6.0.0-LICENSE']
|
|
assert files
|
|
for path in files:
|
|
assert path.read_text().strip() in notices
|
|
assert count == 10
|
|
# Independent previously installed candidate; no ignored vendor patches.
|
|
candidate = root / 'node_modules/stanza'
|
|
original = root.parent / 'node_modules/stanza'
|
|
files = [p for p in candidate.rglob('*') if p.is_file()]
|
|
assert files
|
|
for path in files:
|
|
assert path.read_bytes() == (original / path.relative_to(candidate)).read_bytes(), path
|
|
print(f'{count} exact dependency licenses/integrities; {len(files)} unchanged Stanza files')
|
|
for name in ['package-lock.json', 'bounded-ingress.mjs', 'licenses/saxes-6.0.0-LICENSE']:
|
|
print(f'{name} SHA256 {hashlib.sha256((root / name).read_bytes()).hexdigest()}')
|