Exemple
@npmcli/node-gyp 4.0.0: defaultGypInstallScript, isNodeGypPackage
Échantillon vérifié pour npm @npmcli/node-gyp 4.0.0: defaultGypInstallScript, isNodeGypPackage. Le contrat s'est exécuté sur node 22 · linux debian/x64 …
sha256:70f0960b088f0303546513e0ab571088b96f41120b818f910f14447e5e9f66c8
Ce réseau offre une seule chose : un échantillon qui compile. Il l'a exécuté dans un bac à sable et conservé le reçu signé. Il ne note rien et ne garantit rien : si le même code compile chez vous, il ne l'a pas mesuré.
Combien de clés de signature distinctes ont déposé un reçu de contrat réussi. Une seule, c'est l'auteur ; plus d'une signifie que quelqu'un d'autre l'a compilé aussi. Une clé est auto-générée sans identité enregistrée derrière, donc on compte des clés, pas des personnes.
MIT-0
Preuves d'exécution
L'environnement déclaré et les exécutions signées sont séparés, pour que vous voyiez exactement ce que cet échantillon a exécuté et où.
- Base de preuve
- Contrat signé réussi
- Reçus de vérification
- 1
- Clés de signature qui l’ont compilé
- 1
Environnement déclaré
linux 24 · ubuntu · glibc 2.39 x64 npm
Environnements des exécutions de vérification
| Environnement | Contrat | Étapes | Exécution |
|---|---|---|---|
| node 22 · linux debian/x64 · docker ed25519:c1973797be207ac4 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · node-typescript@1node:22@sha256:8a34c4ab3ea2… |
2026-10-18 |
Cas
HOW- Objectif
- verify pkg:npm/%40npmcli/node-gyp@4.0.0
- Paquets
- Symboles
-
- defaultGypInstallScript
- isNodeGypPackage
- Créé
- 2026-10-18T02:15:31Z
Contrat
- defaultGypInstallScript equals 'node-gyp rebuild'
- isNodeGypPackage(dirPath) resolves to true when dirPath/binding.gyp exists and is a regular file
- isNodeGypPackage(dirPath) resolves to false when dirPath/binding.gyp does not exist, is a directory, or dirPath is missing
Fichiers
- PROMPT.md
- csx.json
- package-lock.json
- package.json
- spec.json
- src/index.mjs
- test/contract.mjs
Code source
Clean-room public code sample — generation instructions
Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.
A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.
Goal: verify pkg:npm/%40npmcli/node-gyp@4.0.0
Kind: HOW
Use EXACTLY these public packages and versions:
- pkg:npm/%40npmcli/node-gyp@4.0.0
Rules:
- One focused purpose; the smallest project that proves the goal.
- Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
- Pin every dependency with a lockfile so resolution is reproducible.
- No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
- No personal names, emails, company names, or project identifiers of any kind.
- No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
- Keep it under 200 files and 256KB packed.
{"case":{"caseId":"case:sha256:33bb4ee8985f707aa3e594ce8484652ccb26aab7e4e0ca3cfc53865ae22c0e21","contract":["defaultGypInstallScript equals 'node-gyp rebuild'","isNodeGypPackage(dirPath) resolves to true when dirPath/binding.gyp exists and is a regular file","isNodeGypPackage(dirPath) resolves to false when dirPath/binding.gyp does not exist, is a directory, or dirPath is missing"],"goal":"verify pkg:npm/%40npmcli/node-gyp@4.0.0","kind":"HOW","packages":["pkg:npm/%40npmcli/node-gyp@4.0.0"],"schemaVersion":1,"symbols":["defaultGypInstallScript","isNodeGypPackage"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40npmcli/node-gyp@4.0.0"],"schemaVersion":1,"subject":"pkg:npm/%40npmcli/node-gyp@4.0.0","symbols":["defaultGypInstallScript","isNodeGypPackage"],"verifierAdapter":"node-typescript@1"}
{
"name": "sample-npmcli-node-gyp",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sample-npmcli-node-gyp",
"version": "1.0.0",
"dependencies": {
"@npmcli/node-gyp": "4.0.0"
}
},
"node_modules/@npmcli/node-gyp": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/@npmcli/node-gyp/-/node-gyp-4.0.0.tgz",
"integrity": "sha512-+t5DZ6mO/QFh78PByMq1fGSAub/agLJZDRfJRMeOSNCt8s9YVlTjmGpIPwPhvXTGUIJk+WszlT0rQa1W33yzNA==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
}
}
}
{
"name": "sample-npmcli-node-gyp",
"version": "1.0.0",
"private": true,
"type": "module",
"scripts": {
"test": "node test/contract.mjs"
},
"dependencies": {
"@npmcli/node-gyp": "4.0.0"
}
}
{
"schemaVersion": 1,
"goal": "verify pkg:npm/%40npmcli/node-gyp@4.0.0",
"kind": "HOW",
"packages": [
"pkg:npm/%40npmcli/node-gyp@4.0.0"
]
}
import nodeGyp from '@npmcli/node-gyp';
export const { isNodeGypPackage, defaultGypInstallScript } = nodeGyp;
export async function inspectPackageDirectory(dirPath) {
const hasGyp = await isNodeGypPackage(dirPath);
return {
isGyp: hasGyp,
installScript: hasGyp ? defaultGypInstallScript : null,
};
}
import assert from 'node:assert/strict';
import fs from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';
import {
isNodeGypPackage,
defaultGypInstallScript,
inspectPackageDirectory,
} from '../src/index.mjs';
const tmpRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'node-gyp-contract-'));
try {
// 1. defaultGypInstallScript constant equals 'node-gyp rebuild'
assert.equal(defaultGypInstallScript, 'node-gyp rebuild');
// 2. Directory with a regular binding.gyp file resolves to true
const gypPkgDir = path.join(tmpRoot, 'with-gyp');
await fs.mkdir(gypPkgDir, { recursive: true });
await fs.writeFile(path.join(gypPkgDir, 'binding.gyp'), '{"targets": []}\n', 'utf8');
assert.equal(await isNodeGypPackage(gypPkgDir), true);
const inspectedGyp = await inspectPackageDirectory(gypPkgDir);
assert.deepEqual(inspectedGyp, {
isGyp: true,
installScript: 'node-gyp rebuild',
});
// 3. Directory without binding.gyp resolves to false
const plainPkgDir = path.join(tmpRoot, 'without-gyp');
await fs.mkdir(plainPkgDir, { recursive: true });
assert.equal(await isNodeGypPackage(plainPkgDir), false);
const inspectedPlain = await inspectPackageDirectory(plainPkgDir);
assert.deepEqual(inspectedPlain, {
isGyp: false,
installScript: null,
});
// 4. Directory where binding.gyp is a directory (not a file) resolves to false
const dirBindingPkg = path.join(tmpRoot, 'dir-binding');
await fs.mkdir(path.join(dirBindingPkg, 'binding.gyp'), { recursive: true });
assert.equal(await isNodeGypPackage(dirBindingPkg), false);
// 5. Non-existent path resolves to false without rejecting
const missingDir = path.join(tmpRoot, 'missing-dir');
assert.equal(await isNodeGypPackage(missingDir), false);
} finally {
await fs.rm(tmpRoot, { recursive: true, force: true });
}
Seeder d'origine
anonyme