ssri 12.0.0: parse

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify ssri.parse in pkg:npm/ssri@12.0.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/ssri@12.0.0
Demonstrate these symbols/APIs:
  - ssri.parse

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:32c56b730bab27ce9e54ddefbde6203b7cb17fefb59fdf7b6913ecdccf5da607","contract":["ssri.parse parses multi-algorithm SRI strings into an Integrity object with per-algorithm Hash arrays and options","ssri.parse with { single: true } returns a single Hash object with algorithm, base64 digest, options, and hexDigest()","ssri.parse with { strict: true } filters out non-Subresource-Integrity-spec algorithms while retaining spec-compliant hashes","ssri.parse accepts existing Integrity or Hash instances and normalizes them into Integrity or single Hash objects"],"goal":"verify ssri.parse in pkg:npm/ssri@12.0.0","kind":"HOW","packages":["pkg:npm/ssri@12.0.0"],"schemaVersion":1,"symbols":["ssri.parse"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/ssri@12.0.0"],"schemaVersion":1,"subject":"pkg:npm/ssri@12.0.0","symbols":["ssri.parse"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-ssri-parse",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-ssri-parse",
      "version": "1.0.0",
      "dependencies": {
        "ssri": "12.0.0"
      }
    },
    "node_modules/minipass": {
      "version": "7.1.3",
      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
      "license": "BlueOak-1.0.0",
      "engines": {
        "node": ">=16 || 14 >=14.17"
      }
    },
    "node_modules/ssri": {
      "version": "12.0.0",
      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
      "license": "ISC",
      "dependencies": {
        "minipass": "^7.0.3"
      },
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    }
  }
}

{
  "name": "sample-ssri-parse",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node test/contract.mjs"
  },
  "dependencies": {
    "ssri": "12.0.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify ssri.parse in pkg:npm/ssri@12.0.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/ssri@12.0.0"
  ],
  "symbols": [
    "ssri.parse"
  ]
}

import assert from 'node:assert/strict'
import * as ssri from 'ssri'

const data = Buffer.from('sample payload for ssri.parse')
const generated = ssri.fromData(data, {
  algorithms: ['sha256', 'sha512'],
  options: ['optA', 'optB'],
})
const sriText = generated.toString()

// 1. Default parse returns an Integrity map containing arrays of Hash objects per algorithm
const integrity = ssri.parse(sriText)
assert.equal(integrity.isIntegrity, true)
assert.equal(integrity.isEmpty(), false)
assert.equal(Array.isArray(integrity.sha256), true)
assert.equal(Array.isArray(integrity.sha512), true)
assert.equal(integrity.sha256.length, 1)
assert.equal(integrity.sha256[0].isHash, true)
assert.equal(integrity.sha256[0].algorithm, 'sha256')
assert.equal(integrity.sha256[0].digest, generated.sha256[0].digest)
assert.deepEqual(integrity.sha256[0].options, ['optA', 'optB'])
assert.equal(integrity.toString(), sriText)

// 2. Single-hash mode ({ single: true }) returns a single Hash instance directly
const singleInput = integrity.sha256[0].toString()
const hashObj = ssri.parse(singleInput, { single: true })
assert.equal(hashObj.isHash, true)
assert.equal(hashObj.algorithm, 'sha256')
assert.equal(hashObj.digest, generated.sha256[0].digest)
assert.deepEqual(hashObj.options, ['optA', 'optB'])
assert.match(hashObj.hexDigest(), /^[0-9a-f]{64}$/)

// 3. Strict mode ({ strict: true }) rejects non-spec algorithms or malformed entries and accepts valid spec SRI
const nonStrict = ssri.parse('md5-deadbeef== ' + singleInput)
assert.equal(nonStrict.md5[0].algorithm, 'md5')
assert.equal(nonStrict.sha256[0].digest, generated.sha256[0].digest)

const strictParsed = ssri.parse('md5-deadbeef== ' + singleInput, { strict: true })
assert.equal(strictParsed.md5, undefined)
assert.equal(strictParsed.sha256.length, 1)
assert.equal(strictParsed.sha256[0].digest, generated.sha256[0].digest)

// 4. Passing an existing Integrity or Hash object to ssri.parse clones/converts appropriately
const reparsedIntegrity = ssri.parse(integrity)
assert.equal(reparsedIntegrity.isIntegrity, true)
assert.equal(reparsedIntegrity.toString(), sriText)

const reparsedSingle = ssri.parse(hashObj, { single: true })
assert.equal(reparsedSingle.isHash, true)
assert.equal(reparsedSingle.toString(), singleInput)