Sample
@npmcli/node-gyp 4.0.0: defaultGypInstallScript, isNodeGypPackage
Verified sample for npm @npmcli/node-gyp 4.0.0: defaultGypInstallScript, isNodeGypPackage. The contract ran on node 22 · linux debian/x64 · docker and passed.
sha256:70f0960b088f0303546513e0ab571088b96f41120b818f910f14447e5e9f66c8
This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured.
How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people.
MIT-0
Execution evidence
The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.
- Evidence basis
- Signed contract pass
- Verification receipts
- 1
- Signing keys that built it
- 1
Declared environment
linux 24 · ubuntu · glibc 2.39 x64 npm
Verification-run environments
| Environment | Contract | Stages | Run |
|---|---|---|---|
| node 22 · linux debian/x64 · docker ed25519:c1973797be207ac4 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · node-typescript@1node:22@sha256:8a34c4ab3ea2… |
2026-10-18 |
Case
HOW- Goal
- verify pkg:npm/%40npmcli/node-gyp@4.0.0
- Packages
- Symbols
-
- defaultGypInstallScript
- isNodeGypPackage
- Created
- 2026-10-18T02:15:31Z
Contract
- defaultGypInstallScript equals 'node-gyp rebuild'
- isNodeGypPackage(dirPath) resolves to true when dirPath/binding.gyp exists and is a regular file
- isNodeGypPackage(dirPath) resolves to false when dirPath/binding.gyp does not exist, is a directory, or dirPath is missing
Files
- PROMPT.md
- csx.json
- package-lock.json
- package.json
- spec.json
- src/index.mjs
- test/contract.mjs
Source
Clean-room public code sample — generation instructions
Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.
A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.
Goal: verify pkg:npm/%40npmcli/node-gyp@4.0.0
Kind: HOW
Use EXACTLY these public packages and versions:
- pkg:npm/%40npmcli/node-gyp@4.0.0
Rules:
- One focused purpose; the smallest project that proves the goal.
- Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
- Pin every dependency with a lockfile so resolution is reproducible.
- No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
- No personal names, emails, company names, or project identifiers of any kind.
- No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
- Keep it under 200 files and 256KB packed.
{"case":{"caseId":"case:sha256:33bb4ee8985f707aa3e594ce8484652ccb26aab7e4e0ca3cfc53865ae22c0e21","contract":["defaultGypInstallScript equals 'node-gyp rebuild'","isNodeGypPackage(dirPath) resolves to true when dirPath/binding.gyp exists and is a regular file","isNodeGypPackage(dirPath) resolves to false when dirPath/binding.gyp does not exist, is a directory, or dirPath is missing"],"goal":"verify pkg:npm/%40npmcli/node-gyp@4.0.0","kind":"HOW","packages":["pkg:npm/%40npmcli/node-gyp@4.0.0"],"schemaVersion":1,"symbols":["defaultGypInstallScript","isNodeGypPackage"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40npmcli/node-gyp@4.0.0"],"schemaVersion":1,"subject":"pkg:npm/%40npmcli/node-gyp@4.0.0","symbols":["defaultGypInstallScript","isNodeGypPackage"],"verifierAdapter":"node-typescript@1"}
{
"name": "sample-npmcli-node-gyp",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sample-npmcli-node-gyp",
"version": "1.0.0",
"dependencies": {
"@npmcli/node-gyp": "4.0.0"
}
},
"node_modules/@npmcli/node-gyp": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/@npmcli/node-gyp/-/node-gyp-4.0.0.tgz",
"integrity": "sha512-+t5DZ6mO/QFh78PByMq1fGSAub/agLJZDRfJRMeOSNCt8s9YVlTjmGpIPwPhvXTGUIJk+WszlT0rQa1W33yzNA==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
}
}
}
{
"name": "sample-npmcli-node-gyp",
"version": "1.0.0",
"private": true,
"type": "module",
"scripts": {
"test": "node test/contract.mjs"
},
"dependencies": {
"@npmcli/node-gyp": "4.0.0"
}
}
{
"schemaVersion": 1,
"goal": "verify pkg:npm/%40npmcli/node-gyp@4.0.0",
"kind": "HOW",
"packages": [
"pkg:npm/%40npmcli/node-gyp@4.0.0"
]
}
import nodeGyp from '@npmcli/node-gyp';
export const { isNodeGypPackage, defaultGypInstallScript } = nodeGyp;
export async function inspectPackageDirectory(dirPath) {
const hasGyp = await isNodeGypPackage(dirPath);
return {
isGyp: hasGyp,
installScript: hasGyp ? defaultGypInstallScript : null,
};
}
import assert from 'node:assert/strict';
import fs from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';
import {
isNodeGypPackage,
defaultGypInstallScript,
inspectPackageDirectory,
} from '../src/index.mjs';
const tmpRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'node-gyp-contract-'));
try {
// 1. defaultGypInstallScript constant equals 'node-gyp rebuild'
assert.equal(defaultGypInstallScript, 'node-gyp rebuild');
// 2. Directory with a regular binding.gyp file resolves to true
const gypPkgDir = path.join(tmpRoot, 'with-gyp');
await fs.mkdir(gypPkgDir, { recursive: true });
await fs.writeFile(path.join(gypPkgDir, 'binding.gyp'), '{"targets": []}\n', 'utf8');
assert.equal(await isNodeGypPackage(gypPkgDir), true);
const inspectedGyp = await inspectPackageDirectory(gypPkgDir);
assert.deepEqual(inspectedGyp, {
isGyp: true,
installScript: 'node-gyp rebuild',
});
// 3. Directory without binding.gyp resolves to false
const plainPkgDir = path.join(tmpRoot, 'without-gyp');
await fs.mkdir(plainPkgDir, { recursive: true });
assert.equal(await isNodeGypPackage(plainPkgDir), false);
const inspectedPlain = await inspectPackageDirectory(plainPkgDir);
assert.deepEqual(inspectedPlain, {
isGyp: false,
installScript: null,
});
// 4. Directory where binding.gyp is a directory (not a file) resolves to false
const dirBindingPkg = path.join(tmpRoot, 'dir-binding');
await fs.mkdir(path.join(dirBindingPkg, 'binding.gyp'), { recursive: true });
assert.equal(await isNodeGypPackage(dirBindingPkg), false);
// 5. Non-existent path resolves to false without rejecting
const missingDir = path.join(tmpRoot, 'missing-dir');
assert.equal(await isNodeGypPackage(missingDir), false);
} finally {
await fs.rm(tmpRoot, { recursive: true, force: true });
}
Origin Seeder
anonymous