This is the existing public read projection, not a translated or rewritten snapshot. Dynamic observations, where present, remain labelled separately from evidence.

{
  "availability": "unknown",
  "callability": "documentation_only",
  "category": "images",
  "data_handling": {
    "location": "local",
    "notes": "Describes the local library interface. Full dependency/network/privacy/retention behavior was not audited; do not use as proof of private-data safety."
  },
  "description": "Local package sharp is distinct from sharp-mcp and unrelated dealsharp services. Geometry: contain/cover/fill/inside/outside are declared; fill corresponds to stretch. Default contain padding is black/opaque. White must be explicit. No all-input exact-size guarantee under withoutEnlargement. JPEG alpha preservation is not supported in reviewed output branches. Apache-2.0 and Node \u003E=20.9.0 are package declarations; full license/dependency audit and runtime behavior remain unverified.",
  "inputs": [
    "Authorized local inputBuffer and finite targetWidth/targetHeight; decoder and byte/pixel bounds unknown."
  ],
  "invocation": {
    "authentication": {
      "kind": "unknown",
      "notes": "Usable authorized local environment must already exist; no authentication or installation was attempted."
    },
    "command": "sharp",
    "entry_url": null,
    "kind": "local_library",
    "method": null,
    "requirements": [
      "Existing user-authorized sharp0.35.5 installation with usable native dependencies; this review did not install it.",
      "Node\u003E=20.9.0 is a package declaration, not a tested environment.",
      "Caller supplies authorized inputBuffer and finite targetWidth/targetHeight.",
      "For hard privacy, alpha/color/metadata fidelity, or exact no-enlargement requirements, current unknown conditions must be resolved before treating the recipe as suitable."
    ]
  },
  "limitations": [
    "Static source declarations only; no installation, package execution, image decoding or private file upload.",
    "JPEG alpha output false; PNG alpha fidelity, ICC/EXIF/rotation and exact canvas unknown.",
    "Local SDK does not establish zero outbound transfer, retained-data behavior or availability."
  ],
  "outputs": [
    "Proposed PNG buffer/info; JPEG encoder API also declared. No actual output produced."
  ],
  "pricing": {
    "model": "unknown",
    "notes": "Apache-2.0 is a package declaration. Installation, compute, storage, maintenance and total task cost are unknown. No hosted price/quota claim.",
    "source_url": null
  },
  "provider_claimed": false,
  "record_kind": "public_source",
  "sources": [
    {
      "basis": "official_repository",
      "checked_at": "2026-11-02T06:19:43.0611260\u002B00:00",
      "title": "sharp 0.35.5 / package",
      "url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/package.json"
    },
    {
      "basis": "official_repository",
      "checked_at": "2026-11-02T06:31:20.6129155\u002B00:00",
      "title": "sharp 0.35.5 / resize",
      "url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/resize.mjs"
    },
    {
      "basis": "official_repository",
      "checked_at": "2026-11-02T06:31:20.8353768\u002B00:00",
      "title": "sharp 0.35.5 / output",
      "url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/output.mjs"
    },
    {
      "basis": "official_repository",
      "checked_at": "2026-11-02T06:31:21.0649411\u002B00:00",
      "title": "sharp 0.35.5 / pipeline",
      "url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/src/pipeline.cc"
    },
    {
      "basis": "official_api_response",
      "checked_at": "2026-11-01T08:13:45.1989035\u002B00:00",
      "title": "npm sharp 0.35.5",
      "url": "https://registry.npmjs.org/sharp/0.35.5"
    }
  ],
  "summary": "Fixed-source resize and PNG/JPEG export declarations for a local Node.js SDK. Proposed white-contain recipe; installation and image output remain untested.",
  "tags": [
    "sharp",
    "image_delivery",
    "sdk",
    "static_code",
    "not_tested"
  ],
  "title": "sharp 0.35.5 \u2014 local image SDK",
  "unknowns": [
    "No package installation, loading, image processing or output decoding performed.",
    "Node engine and optional platform metadata do not prove this task works on Windows.",
    "Native load/codec availability not tested; the declared package gitHead chain is not a tarball/build reproducibility audit.",
    "Declared option and embed path are known; no runtime small-input/boundary test or ResolveShrink source was read.",
    "PNG alpha fidelity and general color/metadata/rotation guarantees are not established by this selected review or any executed task; JPEG alpha loss is separately scoped.",
    "A local library interface is not a full dependency/network/privacy audit.",
    "This remains a local package candidate; no remote service established."
  ],
  "verification": {
    "checked_at": "2026-11-02T06:31:21.0649411\u002B00:00",
    "checks_performed": [
      "Verified exact package/version/gitHead and selected fixed source SHA/Git blob chain.",
      "Mapped source declarations to the original scoped deep-card dictionary; geometry details remain in versioned recipe/evidence."
    ],
    "evidence_urls": [
      "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/package.json",
      "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/resize.mjs",
      "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/output.mjs",
      "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/src/pipeline.cc"
    ],
    "level": "documentation_only",
    "not_verified": [
      "No package installation, loading, image processing or output decoding performed.",
      "Node engine and optional platform metadata do not prove this task works on Windows.",
      "Native load/codec availability not tested; the declared package gitHead chain is not a tarball/build reproducibility audit.",
      "Declared option and embed path are known; no runtime small-input/boundary test or ResolveShrink source was read.",
      "PNG alpha fidelity and general color/metadata/rotation guarantees are not established by this selected review or any executed task; JPEG alpha loss is separately scoped.",
      "A local library interface is not a full dependency/network/privacy audit.",
      "This remains a local package candidate; no remote service established."
    ],
    "outcome": "not_tested",
    "reported_by": "contributor",
    "software_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
    "test_summary": "Cached fixed npm gitHead, package.json and complete Git tree/source Git blob and SHA chain checked. No candidate program or image task was executed."
  },
  "author_name": null,
  "representative_queries": [],
  "terms_url": null,
  "schema_version": "navonavo.capability.v1",
  "service_id": "cap-3e147bbc918c224354d77f0c",
  "version": 2,
  "source_url": "https://registry.npmjs.org/sharp/0.35.5",
  "ownership_state": "unclaimed",
  "submitted_by": {
    "kind": "importer",
    "name": "NAVONAVO fixed-source review"
  },
  "submitter_identity_verified": false,
  "source_check": {
    "url": "https://registry.npmjs.org/sharp/0.35.5",
    "final_url": "https://registry.npmjs.org/sharp/0.35.5",
    "status_code": 200,
    "title": "sharp 0.35.5",
    "description": "High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images",
    "checked_at": "2026-11-01T08:13:45.1989035\u002B00:00",
    "warnings": [
      "Reused completed bounded source receipt; no new fetch. Package gitHead/source chain is not a tarball or native build audit."
    ]
  },
  "created_at": "2026-11-02T08:58:44.2472019\u002B00:00",
  "updated_at": "2026-11-02T08:58:45.5127329\u002B00:00",
  "read_url": "https://navonavo.com/api/v1/capabilities/cap-3e147bbc918c224354d77f0c?version=2",
  "page_url": "https://navonavo.com/capabilities/cap-3e147bbc918c224354d77f0c?version=2",
  "verification_scope": "verification\u4E3A\u6295\u7A3F\u8005\u4E0A\u62A5\uFF1Bsource_check\u4EC5\u4E3A\u672C\u7AD9\u6765\u6E90\u8BFB\u53D6\uFF0C\u4E0D\u5347\u7EA7\u4E3A\u529F\u80FD\u9A8C\u8BC1\u6216\u5B98\u65B9\u8BA4\u8BC1\u3002",
  "deep_card": {
    "schema_version": "navonavo.deep-card.v1",
    "dictionary_version": "navonavo.conditions.v1",
    "card_version": 2,
    "updated_at": "2026-11-02T07:16:42.284059\u002B00:00",
    "review_state": "current",
    "profiles": [
      {
        "profile_id": "sharp-0355-local-sdk",
        "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
        "summary": "sharp 0.35.5 local Node SDK; fixed-source resize and PNG/JPEG export declarations. Proposed white-contain recipe, never executed.",
        "claims": [
          {
            "key": "operation",
            "value": "image_delivery",
            "conclusion": "supported",
            "evidence_refs": [
              "sharp-0355-resize",
              "sharp-0355-output",
              "sharp-0355-pipeline"
            ],
            "unknown_reason": null
          },
          {
            "key": "invocation_mode",
            "value": "sdk",
            "conclusion": "supported",
            "evidence_refs": [
              "sharp-0355-package"
            ],
            "unknown_reason": null
          },
          {
            "key": "execution_location",
            "value": "local",
            "conclusion": "supported",
            "evidence_refs": [
              "sharp-0355-package"
            ],
            "unknown_reason": null
          },
          {
            "key": "output_format",
            "value": "png",
            "conclusion": "supported",
            "evidence_refs": [
              "sharp-0355-output",
              "sharp-0355-pipeline"
            ],
            "unknown_reason": null
          },
          {
            "key": "output_format",
            "value": "jpeg",
            "conclusion": "supported",
            "evidence_refs": [
              "sharp-0355-output",
              "sharp-0355-pipeline"
            ],
            "unknown_reason": null
          },
          {
            "key": "input_format",
            "value": "image",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "The selected code review does not establish accepted input decoders or usable native dependencies."
          },
          {
            "key": "runtime_os",
            "value": "windows",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "No Windows installation, native load or image task was executed."
          },
          {
            "key": "runtime_os",
            "value": "linux",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "No target-environment image task was executed."
          },
          {
            "key": "runtime_os",
            "value": "macos",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "No target-environment image task was executed."
          },
          {
            "key": "cpu_only",
            "value": "true",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "CPU/GPU dependency and actual environment requirements were not checked."
          },
          {
            "key": "gpu_required",
            "value": "false",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "No complete dependency or environment audit."
          },
          {
            "key": "runtime_network_required",
            "value": "false",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "Local SDK architecture is not a zero-egress privacy audit."
          },
          {
            "key": "setup_network_required",
            "value": "false",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "Setup and dependency acquisition were not tested."
          },
          {
            "key": "setup_required",
            "value": "false",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "Caller must first establish an authorized usable installation; its current presence is unknown."
          },
          {
            "key": "auth_required",
            "value": "false",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "No complete application/dependency authorization audit."
          },
          {
            "key": "account_required",
            "value": "false",
            "conclusion": "unknown",
            "evidence_refs": [],
            "unknown_reason": "No complete application/account requirements audit."
          }
        ],
        "connection": {
          "entry": "sharp",
          "protocol": "Node.js SDK",
          "authentication": "unknown; existing authorized caller environment required",
          "environment": [
            "Node \u003E=20.9.0 declared",
            "Authorized sharp 0.35.5 installation and usable native dependencies required; not tested"
          ],
          "pricing_status": "unknown",
          "quota_status": "unknown"
        },
        "recipe": {
          "recipe_id": "sharp-0355-contain-white-png",
          "revision": 1,
          "required_capabilities": [
            "sdk_runtime",
            "image_delivery"
          ],
          "preconditions": [
            "Existing user-authorized sharp0.35.5 installation with usable native dependencies; this review did not install it.",
            "Node\u003E=20.9.0 is a package declaration, not a tested environment.",
            "Caller supplies authorized inputBuffer and finite targetWidth/targetHeight.",
            "For hard privacy, alpha/color/metadata fidelity, or exact no-enlargement requirements, current unknown conditions must be resolved before treating the recipe as suitable.",
            "PROPOSED; not_run. This card describes source declarations, not provider availability or task success."
          ],
          "steps": [
            "Use only an already authorized sharp 0.35.5 installation with working native dependencies; do not install or execute from this recipe automatically.",
            "const { data, info } = await sharp(inputBuffer).resize({ width: targetWidth, height: targetHeight, fit: \u0027contain\u0027, position: \u0027centre\u0027, background: { r: 255, g: 255, b: 255, alpha: 1 }, withoutEnlargement: true }).png().toBuffer({ resolveWithObject: true });",
            "Caller must explicitly persist the returned data buffer to a caller-owned output artifact before file retrieval; this proposed caller step was not executed and no output file exists from this review.",
            "Independently check the actual output and return unknown/failure if any hard requirement remains unproven."
          ],
          "input_contract": "Caller-authorized inputBuffer and positive finite targetWidth/targetHeight. Decoder, input byte/pixel limit and metadata policy require caller-specific validation; no private input was used here.",
          "output_contract": "Proposed PNG buffer plus info. contain with explicit opaque white RGBA and withoutEnlargement:true. No guaranteed dimensions, byte bound, PNG alpha/color/ICC/EXIF/rotation fidelity or privacy guarantee. JPEG alpha preservation is unsupported in the reviewed JPEG branches. Structured file retrieval requires the caller to persist the returned buffer to its own artifact; it is not an automatic toFile result.",
          "validation": "Independently decode data and check actual PNG type, width/height and task-selected fit against the input. Inspect actual padding, content scaling/cropping, alpha/color/rotation requirements for the same input and environment. Bind output bytes/SHA to that actual task. A200 response or code snippet is not task success.",
          "failure_fallback": "Return unmet conditions as unknown; use existing same-hard-condition alternatives rather than installing, uploading or executing automatically."
        }
      }
    ],
    "evidence": [
      {
        "evidence_id": "sharp-0355-package",
        "evidence_type": "documentation",
        "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/package.json",
        "locator": "JSON $.name, $.version, $.engines, $.exports; npm gitHead chain",
        "excerpt": "Fixed package declares sharp 0.35.5, Node \u003E=20.9.0 and local module entry dist/index.cjs/dist/index.mjs. This is a local SDK declaration, not proof that installation, native loading or any image task works.",
        "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
        "content_sha256": "ad4a2535d72eb638053a38867b1abf43c328cd1c1dbae5cf4172d498365a8b97",
        "collected_at": "2026-11-02T06:19:43.061126\u002B00:00",
        "profile_ids": [
          "sharp-0355-local-sdk"
        ],
        "covers": [
          {
            "key": "invocation_mode",
            "value": "sdk"
          },
          {
            "key": "execution_location",
            "value": "local"
          }
        ],
        "execution": null
      },
      {
        "evidence_id": "sharp-0355-resize",
        "evidence_type": "static_code",
        "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/resize.mjs",
        "locator": "lib/resize.mjs L85-103, L121-128, L248-338",
        "excerpt": "Fixed source maps contain/cover/fill/inside/outside, validates width/height, exposes background/position and withoutEnlargement. Default contain background is black/opaque; proposed white padding explicitly sets RGBA. Only the last resize in a pipeline applies. Exact output dimensions and runtime geometry have not been tested.",
        "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
        "content_sha256": "e3d26f31cf391e28f3f96e708ccb96745cf016e18f8ef4486c837e5efcb3c922",
        "collected_at": "2026-11-02T06:31:20.6129155\u002B00:00",
        "profile_ids": [
          "sharp-0355-local-sdk"
        ],
        "covers": [
          {
            "key": "operation",
            "value": "image_delivery"
          }
        ],
        "execution": null
      },
      {
        "evidence_id": "sharp-0355-output",
        "evidence_type": "static_code",
        "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/output.mjs",
        "locator": "lib/output.mjs L73-94, L149-171, L612-672, L718-770",
        "excerpt": "Fixed source exposes toFile/toBuffer with resolveWithObject, and png/jpeg encoder selection. Declared APIs do not establish decoder availability, usable native codecs, output pixels or alpha/color fidelity.",
        "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
        "content_sha256": "d1be82aace2d7f96bfc29e6e76538521fc8dfe6d4e90f7eda71a8f4c2a1597ba",
        "collected_at": "2026-11-02T06:31:20.8353768\u002B00:00",
        "profile_ids": [
          "sharp-0355-local-sdk"
        ],
        "covers": [
          {
            "key": "operation",
            "value": "image_delivery"
          },
          {
            "key": "output_format",
            "value": "png"
          },
          {
            "key": "output_format",
            "value": "jpeg"
          }
        ],
        "execution": null
      },
      {
        "evidence_id": "sharp-0355-pipeline",
        "evidence_type": "static_code",
        "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/src/pipeline.cc",
        "locator": "src/pipeline.cc L202-204, L353-355, L510-550, L976-1048, L1238-1245",
        "excerpt": "Native resize/embed and PNG/JPEG save paths are present. JPEG output marks alpha false. ResolveShrink implementation was not examined. Without-enlargement does not promise exact requested canvas for every fit/input. No native execution or resulting file has been checked.",
        "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
        "content_sha256": "445ed9aa726806dc01188cf13a2866ee47ccd38504cddd049e4e639703edc0e9",
        "collected_at": "2026-11-02T06:31:21.0649411\u002B00:00",
        "profile_ids": [
          "sharp-0355-local-sdk"
        ],
        "covers": [
          {
            "key": "operation",
            "value": "image_delivery"
          },
          {
            "key": "output_format",
            "value": "png"
          },
          {
            "key": "output_format",
            "value": "jpeg"
          }
        ],
        "execution": null
      }
    ]
  },
  "recipe_contracts": {
    "schema_version": "navonavo.recipe-contracts.v1",
    "card_version": 2,
    "recipes": [
      {
        "anchor": {
          "card_id": "cap-3e147bbc918c224354d77f0c",
          "card_version": 2,
          "profile_id": "sharp-0355-local-sdk",
          "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
          "recipe_id": "sharp-0355-contain-white-png",
          "recipe_revision": 1
        },
        "steps": [
          {
            "step_id": "resize-and-export",
            "reference": {
              "card_id": "cap-3e147bbc918c224354d77f0c",
              "card_version": 2,
              "profile_id": "sharp-0355-local-sdk",
              "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
              "recipe_id": "sharp-0355-contain-white-png",
              "recipe_revision": 1
            },
            "invocation": {
              "mode": "sdk",
              "entry": "sharp",
              "method": null,
              "caller_tools": [
                "sdk_runtime"
              ],
              "installation_required": null,
              "authentication": null,
              "regions": null,
              "execution_location": "local",
              "recipient": null,
              "upload_required": null,
              "retains_data": null,
              "accepts_private_data": null,
              "cost": {
                "maximum_minor": null,
                "currency": null,
                "basis": null
              }
            },
            "input": {
              "format": null,
              "schema_id": null,
              "semantics": "caller-authorized encoded image buffer; decoder and resource limits unknown",
              "version": null,
              "encoding": "binary",
              "maximum_bytes": null,
              "fields_complete": false,
              "allow_additional_fields": null,
              "fields": []
            },
            "output": {
              "format": "png",
              "schema_id": null,
              "semantics": "proposed contain with explicit white background; actual pixels and exact canvas untested",
              "version": null,
              "encoding": "binary",
              "maximum_bytes": null,
              "fields_complete": false,
              "allow_additional_fields": null,
              "fields": [],
              "image": {
                "width": null,
                "height": null,
                "fit": "contain",
                "crop_anchor": null,
                "padding_color": "#FFFFFFFF",
                "allow_upscale": null,
                "transparency": null,
                "color_space": null,
                "orientation": null
              }
            },
            "retrieval": {
              "mode": "file",
              "locator": "client_owned_output"
            },
            "success_checks": [
              {
                "kind": "output_schema",
                "expected": "Independently decode actual PNG bytes; check actual media type, width/height and task-selected geometry, padding and scaling against the authorized input."
              },
              {
                "kind": "output_contains",
                "expected": "Bind actual output bytes/SHA to the task; validate alpha, color, metadata and rotation if required. No image was produced or checked during source review."
              },
              {
                "kind": "human_confirmation",
                "expected": "Confirm authorized existing installation and input, finite byte/pixel budgets, privacy/retention/cost constraints. Unknown hard conditions prevent task acceptance."
              }
            ],
            "alternatives": [
              {
                "mode": "return_unknown",
                "reason_code": "unverified_runtime_or_hard_conditions",
                "reference": null
              }
            ],
            "evidence_refs": [
              "sharp-0355-package",
              "sharp-0355-resize",
              "sharp-0355-output",
              "sharp-0355-pipeline"
            ]
          }
        ],
        "links": [],
        "policy": {
          "data_class": "public",
          "local_only": true,
          "allow_upload": false,
          "allow_retention": false,
          "allowed_recipients": [
            "self"
          ],
          "region": null,
          "available_tools": [
            "sdk_runtime"
          ],
          "authorization_kinds": [],
          "allow_installation": false,
          "maximum_cost_minor": null,
          "currency": null
        }
      }
    ]
  },
  "version_read_basis": "archived_revision",
  "deep_read": {
    "schema_version": "navonavo.capability-read.v1",
    "card_id": "cap-3e147bbc918c224354d77f0c",
    "card_version": 2,
    "selected_profile_id": null,
    "state": "documented",
    "review_state": "current",
    "read_url": "https://navonavo.com/api/v1/capabilities/cap-3e147bbc918c224354d77f0c?version=2",
    "page_url": "https://navonavo.com/capabilities/cap-3e147bbc918c224354d77f0c?version=2",
    "profiles": [
      {
        "profile_id": "sharp-0355-local-sdk",
        "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
        "summary": "sharp 0.35.5 local Node SDK; fixed-source resize and PNG/JPEG export declarations. Proposed white-contain recipe, never executed.",
        "conditions": [
          {
            "key": "operation",
            "value": "image_delivery",
            "state": "T",
            "reason": "Supported within this profile and component version.",
            "evidence_refs": [
              "sharp-0355-resize",
              "sharp-0355-output",
              "sharp-0355-pipeline"
            ]
          },
          {
            "key": "invocation_mode",
            "value": "sdk",
            "state": "T",
            "reason": "Supported within this profile and component version.",
            "evidence_refs": [
              "sharp-0355-package"
            ]
          },
          {
            "key": "execution_location",
            "value": "local",
            "state": "T",
            "reason": "Supported within this profile and component version.",
            "evidence_refs": [
              "sharp-0355-package"
            ]
          },
          {
            "key": "output_format",
            "value": "png",
            "state": "T",
            "reason": "Supported within this profile and component version.",
            "evidence_refs": [
              "sharp-0355-output",
              "sharp-0355-pipeline"
            ]
          },
          {
            "key": "output_format",
            "value": "jpeg",
            "state": "T",
            "reason": "Supported within this profile and component version.",
            "evidence_refs": [
              "sharp-0355-output",
              "sharp-0355-pipeline"
            ]
          },
          {
            "key": "input_format",
            "value": "image",
            "state": "U",
            "reason": "The selected code review does not establish accepted input decoders or usable native dependencies.",
            "evidence_refs": []
          },
          {
            "key": "runtime_os",
            "value": "windows",
            "state": "U",
            "reason": "No Windows installation, native load or image task was executed.",
            "evidence_refs": []
          },
          {
            "key": "runtime_os",
            "value": "linux",
            "state": "U",
            "reason": "No target-environment image task was executed.",
            "evidence_refs": []
          },
          {
            "key": "runtime_os",
            "value": "macos",
            "state": "U",
            "reason": "No target-environment image task was executed.",
            "evidence_refs": []
          },
          {
            "key": "cpu_only",
            "value": "true",
            "state": "U",
            "reason": "CPU/GPU dependency and actual environment requirements were not checked.",
            "evidence_refs": []
          },
          {
            "key": "gpu_required",
            "value": "false",
            "state": "U",
            "reason": "No complete dependency or environment audit.",
            "evidence_refs": []
          },
          {
            "key": "runtime_network_required",
            "value": "false",
            "state": "U",
            "reason": "Local SDK architecture is not a zero-egress privacy audit.",
            "evidence_refs": []
          },
          {
            "key": "setup_network_required",
            "value": "false",
            "state": "U",
            "reason": "Setup and dependency acquisition were not tested.",
            "evidence_refs": []
          },
          {
            "key": "setup_required",
            "value": "false",
            "state": "U",
            "reason": "Caller must first establish an authorized usable installation; its current presence is unknown.",
            "evidence_refs": []
          },
          {
            "key": "auth_required",
            "value": "false",
            "state": "U",
            "reason": "No complete application/dependency authorization audit.",
            "evidence_refs": []
          },
          {
            "key": "account_required",
            "value": "false",
            "state": "U",
            "reason": "No complete application/account requirements audit.",
            "evidence_refs": []
          }
        ],
        "connection": {
          "entry": "sharp",
          "protocol": "Node.js SDK",
          "authentication": "unknown; existing authorized caller environment required",
          "environment": [
            "Node \u003E=20.9.0 declared",
            "Authorized sharp 0.35.5 installation and usable native dependencies required; not tested"
          ],
          "pricing_status": "unknown",
          "quota_status": "unknown"
        },
        "recipe": {
          "recipe_id": "sharp-0355-contain-white-png",
          "revision": 1,
          "required_capabilities": [
            "sdk_runtime",
            "image_delivery"
          ],
          "preconditions": [
            "Existing user-authorized sharp0.35.5 installation with usable native dependencies; this review did not install it.",
            "Node\u003E=20.9.0 is a package declaration, not a tested environment.",
            "Caller supplies authorized inputBuffer and finite targetWidth/targetHeight.",
            "For hard privacy, alpha/color/metadata fidelity, or exact no-enlargement requirements, current unknown conditions must be resolved before treating the recipe as suitable.",
            "PROPOSED; not_run. This card describes source declarations, not provider availability or task success."
          ],
          "steps": [
            "Use only an already authorized sharp 0.35.5 installation with working native dependencies; do not install or execute from this recipe automatically.",
            "const { data, info } = await sharp(inputBuffer).resize({ width: targetWidth, height: targetHeight, fit: \u0027contain\u0027, position: \u0027centre\u0027, background: { r: 255, g: 255, b: 255, alpha: 1 }, withoutEnlargement: true }).png().toBuffer({ resolveWithObject: true });",
            "Caller must explicitly persist the returned data buffer to a caller-owned output artifact before file retrieval; this proposed caller step was not executed and no output file exists from this review.",
            "Independently check the actual output and return unknown/failure if any hard requirement remains unproven."
          ],
          "input_contract": "Caller-authorized inputBuffer and positive finite targetWidth/targetHeight. Decoder, input byte/pixel limit and metadata policy require caller-specific validation; no private input was used here.",
          "output_contract": "Proposed PNG buffer plus info. contain with explicit opaque white RGBA and withoutEnlargement:true. No guaranteed dimensions, byte bound, PNG alpha/color/ICC/EXIF/rotation fidelity or privacy guarantee. JPEG alpha preservation is unsupported in the reviewed JPEG branches. Structured file retrieval requires the caller to persist the returned buffer to its own artifact; it is not an automatic toFile result.",
          "validation": "Independently decode data and check actual PNG type, width/height and task-selected fit against the input. Inspect actual padding, content scaling/cropping, alpha/color/rotation requirements for the same input and environment. Bind output bytes/SHA to that actual task. A200 response or code snippet is not task success.",
          "failure_fallback": "Return unmet conditions as unknown; use existing same-hard-condition alternatives rather than installing, uploading or executing automatically."
        },
        "evidence": [
          {
            "evidence_id": "sharp-0355-package",
            "evidence_type": "documentation",
            "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/package.json",
            "locator": "JSON $.name, $.version, $.engines, $.exports; npm gitHead chain",
            "excerpt": "Fixed package declares sharp 0.35.5, Node \u003E=20.9.0 and local module entry dist/index.cjs/dist/index.mjs. This is a local SDK declaration, not proof that installation, native loading or any image task works.",
            "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
            "content_sha256": "ad4a2535d72eb638053a38867b1abf43c328cd1c1dbae5cf4172d498365a8b97",
            "collected_at": "2026-11-02T06:19:43.061126\u002B00:00",
            "profile_ids": [
              "sharp-0355-local-sdk"
            ],
            "covers": [
              {
                "key": "invocation_mode",
                "value": "sdk"
              },
              {
                "key": "execution_location",
                "value": "local"
              }
            ],
            "execution": null
          },
          {
            "evidence_id": "sharp-0355-resize",
            "evidence_type": "static_code",
            "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/resize.mjs",
            "locator": "lib/resize.mjs L85-103, L121-128, L248-338",
            "excerpt": "Fixed source maps contain/cover/fill/inside/outside, validates width/height, exposes background/position and withoutEnlargement. Default contain background is black/opaque; proposed white padding explicitly sets RGBA. Only the last resize in a pipeline applies. Exact output dimensions and runtime geometry have not been tested.",
            "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
            "content_sha256": "e3d26f31cf391e28f3f96e708ccb96745cf016e18f8ef4486c837e5efcb3c922",
            "collected_at": "2026-11-02T06:31:20.6129155\u002B00:00",
            "profile_ids": [
              "sharp-0355-local-sdk"
            ],
            "covers": [
              {
                "key": "operation",
                "value": "image_delivery"
              }
            ],
            "execution": null
          },
          {
            "evidence_id": "sharp-0355-output",
            "evidence_type": "static_code",
            "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/lib/output.mjs",
            "locator": "lib/output.mjs L73-94, L149-171, L612-672, L718-770",
            "excerpt": "Fixed source exposes toFile/toBuffer with resolveWithObject, and png/jpeg encoder selection. Declared APIs do not establish decoder availability, usable native codecs, output pixels or alpha/color fidelity.",
            "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
            "content_sha256": "d1be82aace2d7f96bfc29e6e76538521fc8dfe6d4e90f7eda71a8f4c2a1597ba",
            "collected_at": "2026-11-02T06:31:20.8353768\u002B00:00",
            "profile_ids": [
              "sharp-0355-local-sdk"
            ],
            "covers": [
              {
                "key": "operation",
                "value": "image_delivery"
              },
              {
                "key": "output_format",
                "value": "png"
              },
              {
                "key": "output_format",
                "value": "jpeg"
              }
            ],
            "execution": null
          },
          {
            "evidence_id": "sharp-0355-pipeline",
            "evidence_type": "static_code",
            "source_url": "https://raw.githubusercontent.com/lovell/sharp/51a990faa26ade5586a4934ac9673c98d8893326/src/pipeline.cc",
            "locator": "src/pipeline.cc L202-204, L353-355, L510-550, L976-1048, L1238-1245",
            "excerpt": "Native resize/embed and PNG/JPEG save paths are present. JPEG output marks alpha false. ResolveShrink implementation was not examined. Without-enlargement does not promise exact requested canvas for every fit/input. No native execution or resulting file has been checked.",
            "source_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
            "content_sha256": "445ed9aa726806dc01188cf13a2866ee47ccd38504cddd049e4e639703edc0e9",
            "collected_at": "2026-11-02T06:31:21.0649411\u002B00:00",
            "profile_ids": [
              "sharp-0355-local-sdk"
            ],
            "covers": [
              {
                "key": "operation",
                "value": "image_delivery"
              },
              {
                "key": "output_format",
                "value": "png"
              },
              {
                "key": "output_format",
                "value": "jpeg"
              }
            ],
            "execution": null
          }
        ],
        "structured_recipe": {
          "contract": {
            "anchor": {
              "card_id": "cap-3e147bbc918c224354d77f0c",
              "card_version": 2,
              "profile_id": "sharp-0355-local-sdk",
              "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
              "recipe_id": "sharp-0355-contain-white-png",
              "recipe_revision": 1
            },
            "steps": [
              {
                "step_id": "resize-and-export",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "invocation": {
                  "mode": "sdk",
                  "entry": "sharp",
                  "method": null,
                  "caller_tools": [
                    "sdk_runtime"
                  ],
                  "installation_required": null,
                  "authentication": null,
                  "regions": null,
                  "execution_location": "local",
                  "recipient": null,
                  "upload_required": null,
                  "retains_data": null,
                  "accepts_private_data": null,
                  "cost": {
                    "maximum_minor": null,
                    "currency": null,
                    "basis": null
                  }
                },
                "input": {
                  "format": null,
                  "schema_id": null,
                  "semantics": "caller-authorized encoded image buffer; decoder and resource limits unknown",
                  "version": null,
                  "encoding": "binary",
                  "maximum_bytes": null,
                  "fields_complete": false,
                  "allow_additional_fields": null,
                  "fields": []
                },
                "output": {
                  "format": "png",
                  "schema_id": null,
                  "semantics": "proposed contain with explicit white background; actual pixels and exact canvas untested",
                  "version": null,
                  "encoding": "binary",
                  "maximum_bytes": null,
                  "fields_complete": false,
                  "allow_additional_fields": null,
                  "fields": [],
                  "image": {
                    "width": null,
                    "height": null,
                    "fit": "contain",
                    "crop_anchor": null,
                    "padding_color": "#FFFFFFFF",
                    "allow_upscale": null,
                    "transparency": null,
                    "color_space": null,
                    "orientation": null
                  }
                },
                "retrieval": {
                  "mode": "file",
                  "locator": "client_owned_output"
                },
                "success_checks": [
                  {
                    "kind": "output_schema",
                    "expected": "Independently decode actual PNG bytes; check actual media type, width/height and task-selected geometry, padding and scaling against the authorized input."
                  },
                  {
                    "kind": "output_contains",
                    "expected": "Bind actual output bytes/SHA to the task; validate alpha, color, metadata and rotation if required. No image was produced or checked during source review."
                  },
                  {
                    "kind": "human_confirmation",
                    "expected": "Confirm authorized existing installation and input, finite byte/pixel budgets, privacy/retention/cost constraints. Unknown hard conditions prevent task acceptance."
                  }
                ],
                "alternatives": [
                  {
                    "mode": "return_unknown",
                    "reason_code": "unverified_runtime_or_hard_conditions",
                    "reference": null
                  }
                ],
                "evidence_refs": [
                  "sharp-0355-package",
                  "sharp-0355-resize",
                  "sharp-0355-output",
                  "sharp-0355-pipeline"
                ]
              }
            ],
            "links": [],
            "policy": {
              "data_class": "public",
              "local_only": true,
              "allow_upload": false,
              "allow_retention": false,
              "allowed_recipients": [
                "self"
              ],
              "region": null,
              "available_tools": [
                "sdk_runtime"
              ],
              "authorization_kinds": [],
              "allow_installation": false,
              "maximum_cost_minor": null,
              "currency": null
            }
          },
          "assessment": {
            "state": "unknown",
            "execution_state": "not_executed_by_validator",
            "declared_maximum_cost_minor": null,
            "currency": null,
            "links": [],
            "gaps": [
              {
                "gap_id": "recipe-gap-f413aa630d6ba242b90f9443",
                "code": "installation_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.invocation.installation"
              },
              {
                "gap_id": "recipe-gap-00d5c4e76e6f4d06864d91a7",
                "code": "io_contract_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.input"
              },
              {
                "gap_id": "recipe-gap-59585a0ecf5f1bc0667f3954",
                "code": "io_contract_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.output"
              },
              {
                "gap_id": "recipe-gap-6616f82f33f90de9be905dbc",
                "code": "authorization_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.invocation.authentication"
              },
              {
                "gap_id": "recipe-gap-40b8df4e49c580581852f09e",
                "code": "region_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.invocation.regions"
              },
              {
                "gap_id": "recipe-gap-8d3dda7c864b9a8be749e0ec",
                "code": "recipient_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.invocation.recipient"
              },
              {
                "gap_id": "recipe-gap-10025b3d5fa85e5c991cb1f3",
                "code": "upload_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.invocation.upload_required"
              },
              {
                "gap_id": "recipe-gap-c24c4224d95403e0989e3cf6",
                "code": "retention_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.invocation.retains_data"
              },
              {
                "gap_id": "recipe-gap-2ede05812cb59925dab046df",
                "code": "cost_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.invocation.cost"
              },
              {
                "gap_id": "recipe-gap-9d93a05538eae5c5159d4a99",
                "code": "cost_limit_unknown",
                "state": "unknown",
                "reference": {
                  "card_id": "cap-3e147bbc918c224354d77f0c",
                  "card_version": 2,
                  "profile_id": "sharp-0355-local-sdk",
                  "component_version": "0.35.5@51a990faa26ade5586a4934ac9673c98d8893326",
                  "recipe_id": "sharp-0355-contain-white-png",
                  "recipe_revision": 1
                },
                "path": "steps.resize-and-export.policy.maximum_cost_minor"
              }
            ]
          }
        }
      }
    ],
    "warnings": [
      "\u8D44\u6599\u4E0E\u6765\u6E90\u58F0\u660E\u4E0D\u7B49\u4E8E\u672C\u7AD9\u5B9E\u6D4B\uFF1B\u672A\u5217\u51FA\u7684\u6761\u4EF6\u4ECD\u672A\u77E5\u3002",
      "\u7ED3\u6784\u5316\u914D\u65B9\u53EA\u6309\u516C\u5F00\u58F0\u660E\u68C0\u67E5\u7EA6\u675F\u4E0E\u63A5\u53E3\uFF0C\u4E0D\u6267\u884C\u4EFB\u52A1\u6216\u6388\u4E88\u6743\u9650\uFF1B\u7F3A\u5931\u8BB0\u5F55\u4FDD\u6301\u672A\u77E5\uFF0C\u63A5\u53E3\u517C\u5BB9\u4E0D\u8BC1\u660E\u5B9E\u9645\u6210\u529F\u3002"
    ]
  }
}