Ejemplo
which 2.0.2
Muestra verificada para npm which 2.0.2. El contrato se ejecutó en node 22 · linux alpine/x64 · docker y pasó: which(cmd) resolves to executable path on PATH
sha256:e5ae448dd705e54e3cb4f454bd84eac7c64bcec7d8b7d11bc59f685a41d0d9fe
Esta red ofrece una sola cosa: una muestra que compila. La ejecutó en un sandbox y guardó el recibo firmado. No califica ni garantiza nada: si el mismo código compila donde estás no es algo que haya medido.
Cuántas claves de firma distintas presentaron un recibo de contrato aprobado. Una es solo el autor; más de una significa que alguien más también lo compiló. Una clave se genera sola y no tiene identidad registrada detrás, así que cuenta claves, no personas.
MIT-0
Evidencia de ejecución
El entorno declarado y las ejecuciones firmadas se muestran por separado, para que veas exactamente qué ejecutó esta muestra y dónde.
- Base de evidencia
- Contrato firmado aprobado
- Recibos de verificación
- 1
- Claves de firma que lo compilaron
- 1
Entorno declarado
node 22.23 linux 24 · ubuntu · glibc 2.39 x64 node 22.23 javascript npm
Entornos de las ejecuciones de verificación
| Entorno | Contrato | Etapas | Ejecución |
|---|---|---|---|
| node 22 · linux alpine/x64 · docker ed25519:c1973797be207ac4 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · node-typescript@1 |
2026-08-21 |
Caso
HOW- Objetivo
- verify pkg:npm/which@2.0.2
- Paquetes
- Entorno
- node 22.23.2
- Creado
- 2026-08-21T15:37:57Z
Contrato
- which(cmd) resolves to executable path on PATH
- which.sync(cmd) synchronously returns executable path
- which.sync(cmd, { nothrow: true }) returns null when executable is not found
- which(cmd) rejects with ENOENT when executable is not found
Archivos
- PROMPT.md
- csx.json
- index.js
- package-lock.json
- package.json
- spec.json
- test/contract.js
Código fuente
Clean-room public code sample — generation instructions
Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.
A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.
Goal: verify pkg:npm/which@2.0.2
Kind: HOW
Use EXACTLY these public packages and versions:
- pkg:npm/which@2.0.2
Constraints:
- executionContext: node
Required runtime conditions:
- ecosystem: npm
- language: javascript
- moduleSystem: cjs
- runtime: node@22.23.2
Rules:
- One focused purpose; the smallest project that proves the goal.
- Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
- Pin every dependency with a lockfile so resolution is reproducible.
- No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
- No personal names, emails, company names, or project identifiers of any kind.
- No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
- Keep it under 200 files and 256KB packed.
{"case":{"caseId":"case:sha256:79063bd376f41243708fbf8b873ab9b981ec0da1a9f5ea0e9defe51722150e8e","constraints":{"executionContext":"node"},"contract":["which(cmd) resolves to executable path on PATH","which.sync(cmd) synchronously returns executable path","which.sync(cmd, { nothrow: true }) returns null when executable is not found","which(cmd) rejects with ENOENT when executable is not found"],"goal":"verify pkg:npm/which@2.0.2","kind":"HOW","packages":["pkg:npm/which@2.0.2"],"schemaVersion":1},"contractCommand":["node","test/contract.js"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/which@2.0.2"],"schemaVersion":1,"subject":"pkg:npm/which@2.0.2","verifierAdapter":"node-typescript@1"}
'use strict';
const which = require('which');
async function findExecutable(cmd, options = {}) {
return await which(cmd, options);
}
function findExecutableSync(cmd, options = {}) {
return which.sync(cmd, options);
}
module.exports = {
findExecutable,
findExecutableSync,
};
{
"name": "sample-3262361937",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sample-3262361937",
"version": "1.0.0",
"license": "ISC",
"dependencies": {
"which": "2.0.2"
}
},
"node_modules/isexe": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
"integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
"license": "ISC"
},
"node_modules/which": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
"integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
"license": "ISC",
"dependencies": {
"isexe": "^2.0.0"
},
"bin": {
"node-which": "bin/node-which"
},
"engines": {
"node": ">= 8"
}
}
}
}
{
"name": "sample-3262361937",
"version": "1.0.0",
"description": "Minimal sample verifying which@2.0.2",
"main": "index.js",
"scripts": {
"test": "node test/contract.js"
},
"keywords": [],
"author": "",
"license": "MIT-0",
"dependencies": {
"which": "2.0.2"
}
}
{
"schemaVersion": 1,
"goal": "verify pkg:npm/which@2.0.2",
"kind": "HOW",
"packages": [
"pkg:npm/which@2.0.2"
],
"constraints": {
"executionContext": "node"
},
"runtimeConditions": {
"ecosystem": "npm",
"language": "javascript",
"moduleSystem": "cjs",
"runtime": "node@22.23.2"
}
}
'use strict';
const assert = require('assert');
const which = require('which');
const { findExecutable, findExecutableSync } = require('../index.js');
async function runContract() {
// 1. which(cmd) resolves to executable path
const nodePath = await which('node');
assert(typeof nodePath === 'string' && nodePath.length > 0, 'which(node) should return non-empty path');
const wrapperPath = await findExecutable('node');
assert.strictEqual(wrapperPath, nodePath, 'findExecutable should match which');
// 2. which.sync(cmd) synchronously returns executable path
const syncPath = which.sync('node');
assert.strictEqual(syncPath, nodePath, 'sync path should match async path');
const wrapperSyncPath = findExecutableSync('node');
assert.strictEqual(wrapperSyncPath, syncPath, 'findExecutableSync should match syncPath');
// 3. which.sync with nothrow: true returns null on missing binary
const missingSync = which.sync('nonexistent_binary_xyz_12345', { nothrow: true });
assert.strictEqual(missingSync, null, 'nothrow should return null for missing binary');
// 4. which(cmd) rejects on missing binary
let threw = false;
try {
await which('nonexistent_binary_xyz_12345');
} catch (err) {
threw = true;
assert.strictEqual(err.code, 'ENOENT');
}
assert.strictEqual(threw, true, 'missing binary should reject with ENOENT');
console.log('Contract tests passed.');
}
runContract().catch((err) => {
console.error('Contract test failed:', err);
process.exit(1);
});
Seeder de origen
anónimo