Ejemplo
npm-pick-manifest 10.0.0
Muestra verificada para npm npm-pick-manifest 10.0.0. El contrato se ejecutó en node 22 · linux debian/x64 · docker y pasó: pickManifest(packument, wanted…
sha256:fc1f7662db46f4931fddbb130a985f4cedf7d10935753c6d3a2bfd2e4a0402fd
Esta red ofrece una sola cosa: una muestra que compila. La ejecutó en un sandbox y guardó el recibo firmado. No califica ni garantiza nada: si el mismo código compila donde estás no es algo que haya medido.
Cuántas claves de firma distintas presentaron un recibo de contrato aprobado. Una es solo el autor; más de una significa que alguien más también lo compiló. Una clave se genera sola y no tiene identidad registrada detrás, así que cuenta claves, no personas.
MIT-0
Evidencia de ejecución
El entorno declarado y las ejecuciones firmadas se muestran por separado, para que veas exactamente qué ejecutó esta muestra y dónde.
- Base de evidencia
- Contrato firmado aprobado
- Recibos de verificación
- 1
- Claves de firma que lo compilaron
- 1
Entorno declarado
linux 24 · ubuntu · glibc 2.39 x64 npm
Entornos de las ejecuciones de verificación
| Entorno | Contrato | Etapas | Ejecución |
|---|---|---|---|
| node 22 · linux debian/x64 · docker ed25519:c1973797be207ac4 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · node-typescript@1node:22@sha256:8a34c4ab3ea2… |
2026-10-17 |
Caso
HOW- Objetivo
- verify pkg:npm/npm-pick-manifest@10.0.0
- Paquetes
- Creado
- 2026-10-17T23:57:42Z
Contrato
- pickManifest(packument, wanted, opts) resolves semver ranges, exact versions, and dist-tags from a packument object and normalizes the manifest bin field
- opts.before filters versions by packument.time timestamp and opts.avoid deprioritizes matching versions or sets _shouldAvoid: true when no alternative matches
- Throws an Error with code 'ETARGET' when no version in packument satisfies wanted
Archivos
- PROMPT.md
- csx.json
- package-lock.json
- package.json
- spec.json
- test/contract.mjs
Código fuente
Clean-room public code sample — generation instructions
Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.
A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.
Goal: verify pkg:npm/npm-pick-manifest@10.0.0
Kind: HOW
Use EXACTLY these public packages and versions:
- pkg:npm/npm-pick-manifest@10.0.0
Rules:
- One focused purpose; the smallest project that proves the goal.
- Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
- Pin every dependency with a lockfile so resolution is reproducible.
- No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
- No personal names, emails, company names, or project identifiers of any kind.
- No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
- Keep it under 200 files and 256KB packed.
{"case":{"caseId":"case:sha256:6ac3feca23ff62503241c6f1d817c4750ad5db91cb3831202fcbd30d51adc49b","contract":["pickManifest(packument, wanted, opts) resolves semver ranges, exact versions, and dist-tags from a packument object and normalizes the manifest bin field","opts.before filters versions by packument.time timestamp and opts.avoid deprioritizes matching versions or sets _shouldAvoid: true when no alternative matches","Throws an Error with code 'ETARGET' when no version in packument satisfies wanted"],"goal":"verify pkg:npm/npm-pick-manifest@10.0.0","kind":"HOW","packages":["pkg:npm/npm-pick-manifest@10.0.0"],"schemaVersion":1,"symbols":["pickManifest"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/npm-pick-manifest@10.0.0"],"schemaVersion":1,"subject":"pkg:npm/npm-pick-manifest@10.0.0","verifierAdapter":"node-typescript@1"}
{
"name": "sample-npm-pick-manifest",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sample-npm-pick-manifest",
"version": "1.0.0",
"dependencies": {
"npm-pick-manifest": "10.0.0"
}
},
"node_modules/hosted-git-info": {
"version": "8.1.0",
"resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-8.1.0.tgz",
"integrity": "sha512-Rw/B2DNQaPBICNXEm8balFz9a6WpZrkCGpcWFpy7nCj+NyhSdqXipmfvtmWt9xGfp0wZnBxB+iVpLmQMYt47Tw==",
"license": "ISC",
"dependencies": {
"lru-cache": "^10.0.1"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/lru-cache": {
"version": "10.4.3",
"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
"integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
"license": "ISC"
},
"node_modules/npm-install-checks": {
"version": "7.1.2",
"resolved": "https://registry.npmjs.org/npm-install-checks/-/npm-install-checks-7.1.2.tgz",
"integrity": "sha512-z9HJBCYw9Zr8BqXcllKIs5nI+QggAImbBdHphOzVYrz2CB4iQ6FzWyKmlqDZua+51nAu7FcemlbTc9VgQN5XDQ==",
"license": "BSD-2-Clause",
"dependencies": {
"semver": "^7.1.1"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/npm-normalize-package-bin": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-4.0.0.tgz",
"integrity": "sha512-TZKxPvItzai9kN9H/TkmCtx/ZN/hvr3vUycjlfmH0ootY9yFBzNOpiXAdIn1Iteqsvk4lQn6B5PTrt+n6h8k/w==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/npm-package-arg": {
"version": "12.0.2",
"resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-12.0.2.tgz",
"integrity": "sha512-f1NpFjNI9O4VbKMOlA5QoBq/vSQPORHcTZ2feJpFkTHJ9eQkdlmZEKSjcAhxTGInC7RlEyScT9ui67NaOsjFWA==",
"license": "ISC",
"dependencies": {
"hosted-git-info": "^8.0.0",
"proc-log": "^5.0.0",
"semver": "^7.3.5",
"validate-npm-package-name": "^6.0.0"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/npm-pick-manifest": {
"version": "10.0.0",
"resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-10.0.0.tgz",
"integrity": "sha512-r4fFa4FqYY8xaM7fHecQ9Z2nE9hgNfJR+EmoKv0+chvzWkBcORX3r0FpTByP+CbOVJDladMXnPQGVN8PBLGuTQ==",
"license": "ISC",
"dependencies": {
"npm-install-checks": "^7.1.0",
"npm-normalize-package-bin": "^4.0.0",
"npm-package-arg": "^12.0.0",
"semver": "^7.3.5"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/proc-log": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
"integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/semver": {
"version": "7.8.5",
"resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
"integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
"license": "ISC",
"bin": {
"semver": "bin/semver.js"
},
"engines": {
"node": ">=10"
}
},
"node_modules/validate-npm-package-name": {
"version": "6.0.2",
"resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-6.0.2.tgz",
"integrity": "sha512-IUoow1YUtvoBBC06dXs8bR8B9vuA3aJfmQNKMoaPG/OFsPmoQvw8xh+6Ye25Gx9DQhoEom3Pcu9MKHerm/NpUQ==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
}
}
}
{
"name": "sample-npm-pick-manifest",
"version": "1.0.0",
"private": true,
"type": "module",
"scripts": {
"test": "node test/contract.mjs"
},
"dependencies": {
"npm-pick-manifest": "10.0.0"
}
}
{
"schemaVersion": 1,
"goal": "verify pkg:npm/npm-pick-manifest@10.0.0",
"kind": "HOW",
"packages": [
"pkg:npm/npm-pick-manifest@10.0.0"
]
}
import assert from "node:assert/strict";
import pickManifest from "npm-pick-manifest";
const packument = {
name: "widget",
"dist-tags": {
latest: "1.2.0",
beta: "2.0.0-beta.1",
},
time: {
"1.0.0": "2024-01-01T00:00:00.000Z",
"1.1.0": "2024-02-01T00:00:00.000Z",
"1.2.0": "2024-03-01T00:00:00.000Z",
"2.0.0-beta.1": "2024-04-01T00:00:00.000Z",
},
versions: {
"1.0.0": { name: "widget", version: "1.0.0", bin: "./cli.js" },
"1.1.0": { name: "widget", version: "1.1.0" },
"1.2.0": { name: "widget", version: "1.2.0" },
"2.0.0-beta.1": { name: "widget", version: "2.0.0-beta.1" },
},
};
// 1. Default / range resolution picks the dist-tag 'latest' when it satisfies the range
const latest = pickManifest(packument, "^1.0.0");
assert.equal(latest.version, "1.2.0");
// 2. Explicit version resolution normalizes the bin field via npm-normalize-package-bin
const exact = pickManifest(packument, "1.0.0");
assert.equal(exact.version, "1.0.0");
assert.deepEqual(exact.bin, { widget: "cli.js" });
// 3. Explicit tag resolution picks the tagged version
const beta = pickManifest(packument, "beta");
assert.equal(beta.version, "2.0.0-beta.1");
// 4. 'before' option filters out versions published after the cutoff date
const beforeCutoff = pickManifest(packument, "^1.0.0", {
before: "2024-02-15T00:00:00.000Z",
});
assert.equal(beforeCutoff.version, "1.1.0");
// 5. 'avoid' option avoids specified range and marks _shouldAvoid when forced
const avoidedRange = pickManifest(packument, "^1.0.0", {
avoid: "1.2.x",
});
assert.equal(avoidedRange.version, "1.1.0");
assert.equal(avoidedRange._shouldAvoid, undefined);
const forcedAvoid = pickManifest(packument, "1.2.0", {
avoid: "1.2.x",
});
assert.equal(forcedAvoid.version, "1.2.0");
assert.equal(forcedAvoid._shouldAvoid, true);
// 6. Unmatched version or range throws ETARGET error
assert.throws(
() => pickManifest(packument, "^3.0.0"),
(err) => err && err.code === "ETARGET" && err.wanted === "^3.0.0"
);
Seeder de origen
anónimo