Exemplo
which 5.0.0
Amostra verificada para npm which 5.0.0. O contrato rodou em node 22 · linux alpine/x64 · docker e passou: which(cmd) resolves to executable path on PATH
sha256:acb536ea5763427676f53abd1cfcc6c46c562b389bbf9891f429ca3f1b063762
Esta rede oferece uma coisa: uma amostra que compila. Ela a executou em um sandbox e guardou o recibo assinado. Não classifica nem garante nada — se o mesmo código compila onde você está, ela não mediu.
Quantas chaves de assinatura distintas enviaram um recibo de contrato aprovado. Uma é só o autor; mais de uma significa que outra pessoa também o compilou. Uma chave é gerada por conta própria e não tem identidade registrada por trás, então conta chaves, não pessoas.
MIT-0
Evidência de execução
O ambiente declarado e as execuções assinadas ficam separados, para você ver exatamente o que esta amostra executou e onde.
- Base da evidência
- Contrato assinado aprovado
- Recibos de verificação
- 1
- Chaves de assinatura que o compilaram
- 1
Ambiente declarado
node 22.23 linux 24 · ubuntu · glibc 2.39 x64 node 22.23 javascript npm
Ambientes das execuções de verificação
| Ambiente | Contrato | Etapas | Execução |
|---|---|---|---|
| node 22 · linux alpine/x64 · docker ed25519:c1973797be207ac4 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · node-typescript@1 |
2026-08-21 |
Caso
HOW- Objetivo
- verify pkg:npm/which@5.0.0
- Pacotes
- Ambiente
- node 22.23.2
- Criado
- 2026-08-21T15:41:17Z
Contrato
- which(cmd) resolves to executable path on PATH
- which.sync(cmd) synchronously returns executable path
- which.sync(cmd, { nothrow: true }) returns null when executable is not found
- which(cmd) rejects with ENOENT when executable is not found
- which.sync(cmd, { all: true }) returns an array of executable paths
Arquivos
- PROMPT.md
- csx.json
- index.js
- package-lock.json
- package.json
- spec.json
- test/contract.js
Código-fonte
Clean-room public code sample — generation instructions
Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.
A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.
Goal: verify pkg:npm/which@5.0.0
Kind: HOW
Use EXACTLY these public packages and versions:
- pkg:npm/which@5.0.0
Constraints:
- executionContext: node
Required runtime conditions:
- ecosystem: npm
- language: javascript
- moduleSystem: cjs
- runtime: node@22.23.2
Rules:
- One focused purpose; the smallest project that proves the goal.
- Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
- Pin every dependency with a lockfile so resolution is reproducible.
- No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
- No personal names, emails, company names, or project identifiers of any kind.
- No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
- Keep it under 200 files and 256KB packed.
{"case":{"caseId":"case:sha256:825e4d3327cce6ec5e83f51c584881b2a52eb5bd7d897ba5ecee902d2f6e50a2","constraints":{"executionContext":"node"},"contract":["which(cmd) resolves to executable path on PATH","which.sync(cmd) synchronously returns executable path","which.sync(cmd, { nothrow: true }) returns null when executable is not found","which(cmd) rejects with ENOENT when executable is not found","which.sync(cmd, { all: true }) returns an array of executable paths"],"goal":"verify pkg:npm/which@5.0.0","kind":"HOW","packages":["pkg:npm/which@5.0.0"],"schemaVersion":1},"contractCommand":["node","test/contract.js"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/which@5.0.0"],"schemaVersion":1,"subject":"pkg:npm/which@5.0.0","verifierAdapter":"node-typescript@1"}
'use strict';
const which = require('which');
async function findExecutable(cmd, options = {}) {
return await which(cmd, options);
}
function findExecutableSync(cmd, options = {}) {
return which.sync(cmd, options);
}
module.exports = {
findExecutable,
findExecutableSync,
};
{
"name": "sample-2364529473",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sample-2364529473",
"version": "1.0.0",
"license": "MIT-0",
"dependencies": {
"which": "5.0.0"
}
},
"node_modules/isexe": {
"version": "3.1.5",
"resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
"integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
"license": "BlueOak-1.0.0",
"engines": {
"node": ">=18"
}
},
"node_modules/which": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
"integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
"license": "ISC",
"dependencies": {
"isexe": "^3.1.1"
},
"bin": {
"node-which": "bin/which.js"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
}
}
}
{
"name": "sample-2364529473",
"version": "1.0.0",
"description": "Minimal sample verifying which@5.0.0",
"main": "index.js",
"scripts": {
"test": "node test/contract.js"
},
"keywords": [],
"author": "",
"license": "MIT-0",
"dependencies": {
"which": "5.0.0"
}
}
{
"schemaVersion": 1,
"goal": "verify pkg:npm/which@5.0.0",
"kind": "HOW",
"packages": [
"pkg:npm/which@5.0.0"
],
"constraints": {
"executionContext": "node"
},
"runtimeConditions": {
"ecosystem": "npm",
"language": "javascript",
"moduleSystem": "cjs",
"runtime": "node@22.23.2"
}
}
'use strict';
const assert = require('assert');
const which = require('which');
const { findExecutable, findExecutableSync } = require('../index.js');
async function runContract() {
// 1. which(cmd) resolves to executable path on PATH
const nodePath = await which('node');
assert(typeof nodePath === 'string' && nodePath.length > 0, 'which(node) should return non-empty path');
const wrapperPath = await findExecutable('node');
assert.strictEqual(wrapperPath, nodePath, 'findExecutable should match which');
// 2. which.sync(cmd) synchronously returns executable path
const syncPath = which.sync('node');
assert.strictEqual(syncPath, nodePath, 'sync path should match async path');
const wrapperSyncPath = findExecutableSync('node');
assert.strictEqual(wrapperSyncPath, syncPath, 'findExecutableSync should match syncPath');
// 3. which.sync(cmd, { nothrow: true }) returns null when executable is not found
const missingSync = which.sync('nonexistent_binary_xyz_12345', { nothrow: true });
assert.strictEqual(missingSync, null, 'nothrow should return null for missing binary');
const missingWrapperSync = findExecutableSync('nonexistent_binary_xyz_12345', { nothrow: true });
assert.strictEqual(missingWrapperSync, null, 'findExecutableSync should return null with nothrow');
// 4. which(cmd) rejects with ENOENT when executable is not found
let threwAsync = false;
try {
await which('nonexistent_binary_xyz_12345');
} catch (err) {
threwAsync = true;
assert.strictEqual(err.code, 'ENOENT');
}
assert.strictEqual(threwAsync, true, 'which should reject with ENOENT for missing binary');
let threwWrapperAsync = false;
try {
await findExecutable('nonexistent_binary_xyz_12345');
} catch (err) {
threwWrapperAsync = true;
assert.strictEqual(err.code, 'ENOENT');
}
assert.strictEqual(threwWrapperAsync, true, 'findExecutable should reject with ENOENT for missing binary');
// 5. which.sync(cmd, { all: true }) returns an array of executable paths
const allSync = which.sync('node', { all: true });
assert(Array.isArray(allSync) && allSync.length > 0, 'all: true should return a non-empty array');
assert.strictEqual(allSync[0], nodePath, 'first entry should match default single resolve');
console.log('Contract tests passed.');
}
runContract().catch((err) => {
console.error('Contract test failed:', err);
process.exit(1);
});
Seeder de origem
anônimo