up

src/Sdk/StellaOps.Sdk.Generator/ts/README.md

@@ -4,6 +4,7 @@ This directory contains deterministic generator settings for the TypeScript SDK.
 
 ## Prereqs
 - OpenAPI spec file path exported as `STELLA_OAS_FILE` (temporary until APIG0101 publishes the canonical spec).
+- Optional but recommended: set `STELLA_OAS_EXPECTED_SHA256` to the pinned spec hash; the script will verify and emit `.oas.sha256` in the output.
 - OpenAPI Generator CLI 7.4.0 jar at `tools/openapi-generator-cli-7.4.0.jar` or override `STELLA_OPENAPI_GENERATOR_JAR`.
 - JDK 21 available on PATH (vendored at `../tools/jdk-21.0.1+12`; set `JAVA_HOME` accordingly).
 
@@ -14,6 +15,7 @@ cd src/Sdk/StellaOps.Sdk.Generator
 STELLA_OAS_FILE=/path/to/api.yaml \
 STELLA_SDK_OUT=$(mktemp -d) \
 STELLA_OPENAPI_GENERATOR_JAR=tools/openapi-generator-cli-7.4.0.jar \
+STELLA_OAS_EXPECTED_SHA256=$(sha256sum /path/to/api.yaml | awk '{print $1}') \
 ts/generate-ts.sh
 ```
 
@@ -21,6 +23,7 @@ Outputs land in `out/typescript/` and are post-processed to:
 - Normalize whitespace/line endings.
 - Inject traceability banner.
 - Copy shared helpers (`sdk-hooks.ts`) and wire them through the package barrel.
+- Record the spec hash to `.oas.sha256` for downstream provenance checks.
 
 To validate the pipeline locally with a tiny fixture spec (`ts/fixtures/ping.yaml`), run:
 

src/Sdk/StellaOps.Sdk.Generator/ts/generate-ts.sh

@@ -10,8 +10,27 @@ if [ -z "$spec" ]; then
   exit 1
 fi
 
+compute_sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$1" | awk '{print $1}'
+  else
+    echo "No sha256 tool available (install sha256sum or shasum)" >&2
+    exit 1
+  fi
+}
+
+spec_hash=$(compute_sha256 "$spec")
+expected_hash="${STELLA_OAS_EXPECTED_SHA256:-}"
+if [ -n "$expected_hash" ] && [ "$expected_hash" != "$spec_hash" ]; then
+  echo "Spec hash mismatch: expected $expected_hash but got $spec_hash" >&2
+  exit 1
+fi
+
 output_dir="${STELLA_SDK_OUT:-$root_dir/out/typescript}"
 mkdir -p "$output_dir"
+printf "%s  %s\n" "$spec_hash" "$(basename "$spec")" > "$output_dir/.oas.sha256"
 
 # Ensure postprocess copies shared helpers into the generated tree
 export STELLA_POSTPROCESS_ROOT="$output_dir"
@@ -24,6 +43,20 @@ if [ ! -f "$JAR" ]; then
   exit 1
 fi
 
+# Prefer vendored JDK when java is absent
+if ! command -v java >/dev/null 2>&1; then
+  vendor_jdk="$root_dir/tools/jdk-21.0.1+12"
+  if [ -d "$vendor_jdk/bin" ]; then
+    export JAVA_HOME="$vendor_jdk"
+    export PATH="$JAVA_HOME/bin:$PATH"
+  fi
+fi
+
+if ! command -v java >/dev/null 2>&1; then
+  echo "java not found; install JDK 21 or provide vendored tools/jdk-21.0.1+12" >&2
+  exit 1
+fi
+
 JAVA_OPTS="${JAVA_OPTS:-} -Dorg.openapitools.codegen.utils.postProcessFile=$root_dir/postprocess/postprocess.sh"
 export JAVA_OPTS
 

src/Sdk/StellaOps.Sdk.Generator/ts/test_generate_ts.sh

@@ -12,6 +12,15 @@ if [ ! -f "$jar" ]; then
   exit 0
 fi
 
+compute_sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  else
+    shasum -a 256 "$1" | awk '{print $1}'
+  fi
+}
+expected_hash=$(compute_sha256 "$spec")
+
 # If java is missing, try vendored JDK in tools/
 if ! command -v java >/dev/null 2>&1; then
   vendor_jdk="$root_dir/tools/jdk-21.0.1+12"
@@ -32,11 +41,13 @@ trap 'rm -rf "$out_dir"' EXIT
 STELLA_OAS_FILE="$spec" \
 STELLA_SDK_OUT="$out_dir" \
 STELLA_OPENAPI_GENERATOR_JAR="$jar" \
+STELLA_OAS_EXPECTED_SHA256="$expected_hash" \
 JAVA_OPTS="${JAVA_OPTS:-} -Dorg.openapitools.codegen.utils.postProcessFile=$root_dir/postprocess/postprocess.sh" \
 "$script"
 
 test -f "$out_dir/src/apis/DefaultApi.ts" || { echo "missing generated API" >&2; exit 1; }
 test -f "$out_dir/sdk-hooks.ts" || { echo "missing helper copy" >&2; exit 1; }
+test -f "$out_dir/.oas.sha256" || { echo "missing spec hash output" >&2; exit 1; }
 
 # Basic eslint-free sanity: ensure banner on generated helper
 first_line=$(head -n 1 "$out_dir/sdk-hooks.ts")