第三方 SDK 回调进入业务代码时怎样划定 VMP 边界

from pathlib import Path
import json
import re
import sys

if len(sys.argv) != 3:
    raise SystemExit(2)
dependency_path = Path(sys.argv[1])
callback_path = Path(sys.argv[2])
if not dependency_path.is_file() or not callback_path.is_file():
    raise SystemExit(2)
try:
    dependencies = json.loads(dependency_path.read_text(encoding="utf-8"))
    callbacks = json.loads(callback_path.read_text(encoding="utf-8"))
except (OSError, UnicodeError, json.JSONDecodeError):
    raise SystemExit(2)
if not isinstance(dependencies, list) or not isinstance(callbacks, list):
    raise SystemExit(2)
coordinate_pattern = re.compile(r"^[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+$")
sha_pattern = re.compile(r"^[a-f0-9]{64}$")
function_pattern = re.compile(r"^[A-Za-z_][A-Za-z0-9_.]*$")
glue_pattern = re.compile(r"(?i)(callback|listener|adapter|proxy|dispatch|register)")
resolved = {}
issues = []
for item in dependencies:
    coordinate = item.get("coordinate") if isinstance(item, dict) else None
    version = item.get("selectedVersion") if isinstance(item, dict) else None
    digest = item.get("artifactSha256") if isinstance(item, dict) else None
    if not isinstance(coordinate, str) or not coordinate_pattern.fullmatch(coordinate):
        raise SystemExit(2)
    if coordinate in resolved or not isinstance(version, str) or not version or not isinstance(digest, str) or not sha_pattern.fullmatch(digest):
        raise SystemExit(2)
    resolved[coordinate] = item
inventory = []
for item in callbacks:
    if not isinstance(item, dict):
        raise SystemExit(2)
    coordinate = item.get("sdkCoordinate")
    dependency = resolved.get(coordinate)
    if dependency is None:
        issues.append({"sdkCoordinate": coordinate, "issue": "sdk-not-in-resolved-graph"})
        continue
    thread = item.get("documentedThread")
    validator = item.get("validatorFunction")
    handler = item.get("businessHandler")
    candidate = item.get("vmpCandidate")
    if thread not in {"main", "worker", "binder", "unspecified-dispatch-required"}:
        issues.append({"sdkCoordinate": coordinate, "issue": "unknown-thread-contract"})
    for field, value in (("validator", validator), ("handler", handler)):
        if not isinstance(value, str) or not function_pattern.fullmatch(value):
            issues.append({"sdkCoordinate": coordinate, "issue": "invalid-" + field})
    if candidate is not None and candidate != handler:
        issues.append({"sdkCoordinate": coordinate, "issue": "vmp-candidate-not-business-handler"})
    if isinstance(candidate, str) and glue_pattern.search(candidate):
        issues.append({"sdkCoordinate": coordinate, "issue": "sdk-glue-selected-for-vmp"})
    if item.get("sensitiveDecision") is True and item.get("serverEnforced") is not True:
        issues.append({"sdkCoordinate": coordinate, "issue": "sensitive-decision-not-server-enforced"})
    if item.get("keepRuleOwner") not in {"sdk", "app"}:
        issues.append({"sdkCoordinate": coordinate, "issue": "missing-keep-rule-owner"})
    inventory.append({"sdkCoordinate": coordinate, "selectedVersion": dependency["selectedVersion"], "thread": thread, "validator": validator, "businessHandler": handler, "vmpCandidate": candidate})
print(json.dumps({"inventory": inventory, "issues": issues}, ensure_ascii=False, indent=2))
if issues:
    raise SystemExit(3)