textus 0.22.0 → 0.26.0

data/lib/textus/mcp/tools.rb

@@ -0,0 +1,129 @@
+module Textus
+  module MCP
+    # Dispatch table for MCP tool names → implementations. Each implementation
+    # receives (session:, store:, args:) and returns a JSON-encodable value.
+    # Tool errors are wrapped in ToolError; ContractDrift / CursorExpired
+    # propagate verbatim so the server can map them to JSON-RPC codes.
+    module Tools
+      module_function
+
+      def call(name, session:, store:, args:)
+        impl = REGISTRY[name] or raise ToolError.new("unknown tool: #{name}")
+        impl.call(session, store, args || {})
+      rescue ContractDrift, CursorExpired
+        raise
+      rescue Textus::Error => e
+        raise ToolError.new("#{name}: #{e.message}")
+      end
+
+      def ops_for(session, store)
+        store.session(role: session.role)
+      end
+
+      REGISTRY = {
+        "boot" => ->(_s, store, _a) { Textus::Boot.run(Textus::Session.for(store)) },
+
+        "find" => lambda do |s, store, args|
+          ops_for(s, store).list(zone: args["zone"], prefix: args["prefix"])
+        end,
+
+        "read" => lambda do |s, store, args|
+          key = args.fetch("key") { raise ToolError.new("read: missing key") }
+          env = ops_for(s, store).get(key)
+          env.to_h_for_wire
+        end,
+
+        "tick" => lambda do |s, store, args|
+          since = (args["since"] || s.cursor).to_i
+          ops_for(s, store).pulse(since: since)
+        end,
+
+        "write" => lambda do |s, store, args|
+          key = args.fetch("key") { raise ToolError.new("write: missing key") }
+          env = ops_for(s, store).put(
+            key,
+            meta: args["meta"] || {},
+            body: args["body"],
+            content: args["content"],
+            if_etag: args["if_etag"],
+          )
+          { "uid" => env.uid, "etag" => env.etag }
+        end,
+
+        "propose" => lambda do |s, store, args|
+          raise ToolError.new("propose: session has no propose_zone") unless s.propose_zone
+
+          rel = args.fetch("key") { raise ToolError.new("propose: missing key") }
+          target = "#{s.propose_zone}.#{rel}"
+          env = ops_for(s, store).put(
+            target,
+            meta: args["meta"] || {},
+            body: args["body"],
+            content: args["content"],
+          )
+          { "uid" => env.uid, "etag" => env.etag, "key" => target }
+        end,
+
+        "refresh" => lambda do |s, store, args|
+          key = args.fetch("key") { raise ToolError.new("refresh: missing key") }
+          outcome = ops_for(s, store).refresh(key)
+          { "outcome" => outcome.class.name.split("::").last.downcase }
+        end,
+
+        "refresh_stale" => lambda do |s, store, args|
+          ops_for(s, store).refresh_all(zone: args["zone"], prefix: args["prefix"])
+        end,
+
+        "schema" => lambda do |_s, store, args|
+          family = args.fetch("family") { raise ToolError.new("schema: missing family") }
+          store.schemas.fetch(family)
+        end,
+
+        "rules" => lambda do |_s, store, args|
+          key = args.fetch("key") { raise ToolError.new("rules: missing key") }
+          set = store.manifest.rules.for(key)
+          {
+            "refresh" => set.refresh&.to_h,
+            "promote" => set.respond_to?(:promote) ? set.promote&.to_h : nil,
+          }.compact
+        end,
+
+        "key_mv_prefix" => lambda do |s, store, args|
+          ops_for(s, store).key_mv_prefix(
+            from_prefix: args.fetch("from_prefix") { raise ToolError.new("key_mv_prefix: missing from_prefix") },
+            to_prefix: args.fetch("to_prefix") { raise ToolError.new("key_mv_prefix: missing to_prefix") },
+            dry_run: args["dry_run"] || false,
+          ).to_h
+        end,
+
+        "key_delete_prefix" => lambda do |s, store, args|
+          ops_for(s, store).key_delete_prefix(
+            prefix: args.fetch("prefix") { raise ToolError.new("key_delete_prefix: missing prefix") },
+            dry_run: args["dry_run"] || false,
+          ).to_h
+        end,
+
+        "zone_mv" => lambda do |s, store, args|
+          ops_for(s, store).zone_mv(
+            from: args.fetch("from") { raise ToolError.new("zone_mv: missing from") },
+            to: args.fetch("to") { raise ToolError.new("zone_mv: missing to") },
+            dry_run: args["dry_run"] || false,
+          ).to_h
+        end,
+
+        "rule_lint" => lambda do |s, store, args|
+          ops_for(s, store).rule_lint(
+            candidate_yaml: args.fetch("candidate_yaml") { raise ToolError.new("rule_lint: missing candidate_yaml") },
+          ).to_h
+        end,
+
+        "migrate" => lambda do |s, store, args|
+          ops_for(s, store).migrate(
+            plan_yaml: args.fetch("plan_yaml") { raise ToolError.new("migrate: missing plan_yaml") },
+            dry_run: args["dry_run"] || false,
+          ).to_h
+        end,
+      }.freeze
+    end
+  end
+end

data/lib/textus/mcp.rb

@@ -0,0 +1,6 @@
+module Textus
+  # The agent gate. Stdio JSON-RPC 2.0 server speaking MCP draft 2024-11-05.
+  # Wraps Textus::Session as auto-derived tools. See ADR 0015.
+  module MCP
+  end
+end

data/lib/textus/schema/tools.rb

@@ -6,7 +6,7 @@ module Textus
     module Tools
       # textus schema init NAME --from=KEY  → infer YAML schema from an entry's frontmatter
       def self.init(store, name:, from:)
-        env = Textus::Operations.for(store).get(from)
+        env = store.session.get(from)
         meta = env.meta
         schema = {
           "name" => name,
@@ -25,7 +25,7 @@ module Textus
         schema = load_schema(store, name)
         drift = []
         store.manifest.resolver.enumerate.each do |row|
-          env = Textus::Operations.for(store).get(row[:key])
+          env = store.session.get(row[:key])
           begin
             schema.validate!(env.meta)
           rescue SchemaViolation => e
@@ -49,14 +49,8 @@ module Textus
           end
         raise UsageError.new("schema migrate needs --rename=OLD:NEW or schema.evolution.migrate_from") if renames.empty?
 
-        authority = store.manifest.roles_with_kind(:accept_authority).first
-        if authority.nil?
-          raise UsageError.new(
-            "schema migrate requires a role with kind :accept_authority in the manifest; " \
-            "none declared (add e.g. `- { name: owner, kind: accept_authority }` to roles:)",
-          )
-        end
-        ops = Textus::Operations.for(store, role: authority)
+        authority = accept_authority_for(store)
+        ops = store.session(role: authority)
         touched = []
         store.manifest.resolver.enumerate.each do |row|
           env = ops.get(row[:key])
@@ -92,6 +86,16 @@ module Textus
       rescue IoError
         raise UsageError.new("schema not found: #{name}")
       end
+
+      def self.accept_authority_for(store)
+        authority = store.manifest.policy.roles_with_kind(:accept_authority).first
+        return authority if authority
+
+        raise UsageError.new(
+          "schema migrate requires a role with kind :accept_authority in the manifest; " \
+          "none declared (add e.g. `- { name: owner, kind: accept_authority }` to roles:)",
+        )
+      end
     end
   end
 end

data/lib/textus/session.rb

@@ -0,0 +1,84 @@
+module Textus
+  # Per-call session. Holds ctx (role, correlation_id, now, dry_run) and
+  # the three caps records. Generates one method per registered use case.
+  class Session
+    attr_reader :ctx, :read_caps, :write_caps, :hook_caps
+
+    def self.for(store, role: Role::DEFAULT, correlation_id: nil, dry_run: false)
+      read_caps, write_caps, hook_caps = Application.caps_from_store(store)
+      new(
+        ctx: Application::Context.build(role: role, correlation_id: correlation_id, dry_run: dry_run),
+        read_caps: read_caps, write_caps: write_caps, hook_caps: hook_caps
+      )
+    end
+
+    def initialize(ctx:, read_caps:, write_caps:, hook_caps:)
+      @ctx        = ctx
+      @read_caps  = read_caps
+      @write_caps = write_caps
+      @hook_caps  = hook_caps
+    end
+
+    def with_role(role)
+      self.class.new(
+        ctx: @ctx.with_role(role),
+        read_caps: @read_caps, write_caps: @write_caps, hook_caps: @hook_caps
+      )
+    end
+
+    def hook_context
+      @hook_context ||= Hooks::Context.new(session: self)
+    end
+
+    def rpc = @hook_caps.rpc
+    def events = @hook_caps.events
+
+    def envelope_reader
+      @envelope_reader ||= Application::Envelope::Reader.new(
+        file_store: @read_caps.file_store, manifest: @read_caps.manifest,
+      )
+    end
+
+    def envelope_writer
+      @envelope_writer ||= Application::Envelope::Writer.new(
+        file_store: @write_caps.file_store, manifest: @write_caps.manifest,
+        schemas: @write_caps.schemas, audit_log: @write_caps.audit_log,
+        ctx: @ctx, reader: envelope_reader
+      )
+    end
+
+    def boot(...) = Textus::Boot.run(self, ...)
+    def doctor(...) = Textus::Doctor.run(self, ...)
+
+    def refresh_orchestrator
+      @refresh_orchestrator ||= Application::Write::RefreshOrchestrator.new(
+        worker: refresh_worker,
+        store_root: @write_caps.root,
+        events: @write_caps.events,
+        ctx: @ctx,
+        hook_context: hook_context,
+      )
+    end
+
+    def refresh_worker
+      @refresh_worker ||= Application::Write::RefreshWorker::Impl.new(
+        ctx: @ctx, caps: @write_caps,
+        rpc: rpc, writer: envelope_writer, hook_context: hook_context
+      )
+    end
+
+    # Generated dispatch methods. Defined AFTER all use-cases have registered
+    # (Zeitwerk.eager_load runs in lib/textus.rb, then session.rb is explicitly
+    # required so UseCase.entries is fully populated).
+    Application::UseCase.each do |entry|
+      verb     = entry.verb
+      mod      = entry.mod
+      caps_sym = entry.caps_kind
+
+      define_method(verb) do |*args, **kwargs|
+        fixed = { session: self, ctx: @ctx, caps: caps_sym == :read ? @read_caps : @write_caps }
+        mod.call(*args, **fixed, **kwargs)
+      end
+    end
+  end
+end

data/lib/textus/store.rb

@@ -2,7 +2,7 @@ require "fileutils"
 
 module Textus
   class Store
-    attr_reader :root, :manifest, :schemas, :file_store, :audit_log, :bus
+    attr_reader :root, :manifest, :schemas, :file_store, :audit_log, :events, :rpc
 
     def self.discover(start_dir = Dir.pwd, root: nil)
       explicit = root || ENV.fetch("TEXTUS_ROOT", nil)
@@ -35,15 +35,20 @@ module Textus
       @file_store = Infra::Storage::FileStore.new
       @audit_log  = Infra::AuditLog.new(
         @root,
-        max_size: @manifest.audit_config[:max_size],
-        keep: @manifest.audit_config[:keep],
+        max_size: @manifest.data.audit_config[:max_size],
+        keep: @manifest.data.audit_config[:keep],
       )
-      @bus = Hooks::Bus.new
-      Infra::AuditSubscriber.new(@audit_log).attach(@bus)
-      Hooks::Builtin.register_all(@bus)
-      Hooks::Loader.new(bus: @bus).load_dir(File.join(@root, "hooks"))
-      ops = Operations.for(self, role: Role::DEFAULT)
-      @bus.publish(:store_loaded, ctx: ops.hook_context)
+      @events = Hooks::EventBus.new
+      @rpc = Hooks::RpcRegistry.new
+      Infra::AuditSubscriber.new(@audit_log).attach(@events)
+      Hooks::Builtin.register_all(events: @events, rpc: @rpc)
+      Hooks::Loader.new(events: @events, rpc: @rpc).load_dir(File.join(@root, "hooks"))
+      sess = Session.for(self, role: Role::DEFAULT)
+      @events.publish(:store_loaded, ctx: sess.hook_context)
+    end
+
+    def session(role: Role::DEFAULT, correlation_id: nil, dry_run: false)
+      Session.for(self, role: role, correlation_id: correlation_id, dry_run: dry_run)
     end
   end
 end

data/lib/textus/version.rb

@@ -1,4 +1,4 @@
 module Textus
-  VERSION = "0.22.0"
+  VERSION = "0.26.0"
   PROTOCOL = "textus/3"
 end

data/lib/textus.rb

@@ -1,6 +1,8 @@
 require "zeitwerk"
 require_relative "textus/version"
 require_relative "textus/errors"
+require_relative "textus/mcp"
+require_relative "textus/mcp/errors"
 
 loader = Zeitwerk::Loader.for_gem
 loader.inflector.inflect(
@@ -8,11 +10,16 @@ loader.inflector.inflect(
   "json" => "Json",
   "yaml" => "Yaml",
   "hook_dsl_scanner" => "HookDSLScanner",
-  "envelope_io" => "EnvelopeIO",
+  "mcp" => "MCP",
+  "mcp_serve" => "MCPServe",
 )
 loader.ignore(File.expand_path("textus/errors.rb", __dir__))
+loader.ignore(File.expand_path("textus/mcp.rb", __dir__))
+loader.ignore(File.expand_path("textus/mcp/errors.rb", __dir__))
+loader.ignore(File.expand_path("textus/session.rb", __dir__))
 loader.setup
 loader.eager_load
+require_relative "textus/session"
 
 module Textus
   @hook_mutex  = Mutex.new

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: textus
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.26.0
 platform: ruby
 authors:
 - Patrick
@@ -109,40 +109,46 @@ files:
 - docs/conventions.md
 - exe/textus
 - lib/textus.rb
+- lib/textus/application/caps.rb
 - lib/textus/application/context.rb
-- lib/textus/application/policy/predicates/accept_authority_signed.rb
-- lib/textus/application/policy/predicates/schema_valid.rb
-- lib/textus/application/policy/promotion.rb
+- lib/textus/application/envelope/reader.rb
+- lib/textus/application/envelope/writer.rb
+- lib/textus/application/maintenance.rb
+- lib/textus/application/maintenance/key_delete_prefix.rb
+- lib/textus/application/maintenance/key_mv_prefix.rb
+- lib/textus/application/maintenance/migrate.rb
+- lib/textus/application/maintenance/rule_lint.rb
+- lib/textus/application/maintenance/zone_mv.rb
 - lib/textus/application/projection.rb
-- lib/textus/application/reads/audit.rb
-- lib/textus/application/reads/blame.rb
-- lib/textus/application/reads/deps.rb
-- lib/textus/application/reads/freshness.rb
-- lib/textus/application/reads/get.rb
-- lib/textus/application/reads/get_or_refresh.rb
-- lib/textus/application/reads/list.rb
-- lib/textus/application/reads/policy_explain.rb
-- lib/textus/application/reads/published.rb
-- lib/textus/application/reads/pulse.rb
-- lib/textus/application/reads/rdeps.rb
-- lib/textus/application/reads/schema_envelope.rb
-- lib/textus/application/reads/stale.rb
-- lib/textus/application/reads/uid.rb
-- lib/textus/application/reads/validate_all.rb
-- lib/textus/application/reads/validator.rb
-- lib/textus/application/reads/where.rb
-- lib/textus/application/refresh/all.rb
-- lib/textus/application/refresh/orchestrator.rb
-- lib/textus/application/refresh/worker.rb
-- lib/textus/application/writes/accept.rb
-- lib/textus/application/writes/authority_gate.rb
-- lib/textus/application/writes/delete.rb
-- lib/textus/application/writes/envelope_io.rb
-- lib/textus/application/writes/materializer.rb
-- lib/textus/application/writes/mv.rb
-- lib/textus/application/writes/publish.rb
-- lib/textus/application/writes/put.rb
-- lib/textus/application/writes/reject.rb
+- lib/textus/application/read/audit.rb
+- lib/textus/application/read/blame.rb
+- lib/textus/application/read/deps.rb
+- lib/textus/application/read/freshness.rb
+- lib/textus/application/read/get.rb
+- lib/textus/application/read/get_or_refresh.rb
+- lib/textus/application/read/list.rb
+- lib/textus/application/read/policy_explain.rb
+- lib/textus/application/read/published.rb
+- lib/textus/application/read/pulse.rb
+- lib/textus/application/read/rdeps.rb
+- lib/textus/application/read/schema_envelope.rb
+- lib/textus/application/read/stale.rb
+- lib/textus/application/read/uid.rb
+- lib/textus/application/read/validate_all.rb
+- lib/textus/application/read/validator.rb
+- lib/textus/application/read/where.rb
+- lib/textus/application/use_case.rb
+- lib/textus/application/write/accept.rb
+- lib/textus/application/write/authority_gate.rb
+- lib/textus/application/write/delete.rb
+- lib/textus/application/write/materializer.rb
+- lib/textus/application/write/mv.rb
+- lib/textus/application/write/publish.rb
+- lib/textus/application/write/put.rb
+- lib/textus/application/write/refresh_all.rb
+- lib/textus/application/write/refresh_orchestrator.rb
+- lib/textus/application/write/refresh_worker.rb
+- lib/textus/application/write/reject.rb
 - lib/textus/boot.rb
 - lib/textus/builder/pipeline.rb
 - lib/textus/builder/renderer.rb
@@ -154,9 +160,11 @@ files:
 - lib/textus/cli/group.rb
 - lib/textus/cli/group/hook.rb
 - lib/textus/cli/group/key.rb
+- lib/textus/cli/group/mcp.rb
 - lib/textus/cli/group/refresh.rb
 - lib/textus/cli/group/rule.rb
 - lib/textus/cli/group/schema.rb
+- lib/textus/cli/group/zone.rb
 - lib/textus/cli/verb.rb
 - lib/textus/cli/verb/accept.rb
 - lib/textus/cli/verb/audit.rb
@@ -171,7 +179,10 @@ files:
 - lib/textus/cli/verb/hook_run.rb
 - lib/textus/cli/verb/hooks.rb
 - lib/textus/cli/verb/init.rb
+- lib/textus/cli/verb/key_delete.rb
 - lib/textus/cli/verb/list.rb
+- lib/textus/cli/verb/mcp_serve.rb
+- lib/textus/cli/verb/migrate.rb
 - lib/textus/cli/verb/mv.rb
 - lib/textus/cli/verb/published.rb
 - lib/textus/cli/verb/pulse.rb
@@ -181,6 +192,7 @@ files:
 - lib/textus/cli/verb/refresh_stale.rb
 - lib/textus/cli/verb/reject.rb
 - lib/textus/cli/verb/rule_explain.rb
+- lib/textus/cli/verb/rule_lint.rb
 - lib/textus/cli/verb/rule_list.rb
 - lib/textus/cli/verb/schema.rb
 - lib/textus/cli/verb/schema_diff.rb
@@ -188,6 +200,7 @@ files:
 - lib/textus/cli/verb/schema_migrate.rb
 - lib/textus/cli/verb/uid.rb
 - lib/textus/cli/verb/where.rb
+- lib/textus/cli/verb/zone_mv.rb
 - lib/textus/doctor.rb
 - lib/textus/doctor/check.rb
 - lib/textus/doctor/check/audit_log.rb
@@ -215,7 +228,10 @@ files:
 - lib/textus/domain/permission.rb
 - lib/textus/domain/policy/handler_allowlist.rb
 - lib/textus/domain/policy/matcher.rb
+- lib/textus/domain/policy/predicates/accept_authority_signed.rb
+- lib/textus/domain/policy/predicates/schema_valid.rb
 - lib/textus/domain/policy/promote.rb
+- lib/textus/domain/policy/promotion.rb
 - lib/textus/domain/policy/refresh.rb
 - lib/textus/domain/sentinel.rb
 - lib/textus/domain/staleness.rb
@@ -231,15 +247,16 @@ files:
 - lib/textus/errors.rb
 - lib/textus/etag.rb
 - lib/textus/hooks/builtin.rb
-- lib/textus/hooks/bus.rb
 - lib/textus/hooks/context.rb
+- lib/textus/hooks/error_log.rb
+- lib/textus/hooks/event_bus.rb
 - lib/textus/hooks/fire_report.rb
 - lib/textus/hooks/loader.rb
+- lib/textus/hooks/rpc_registry.rb
 - lib/textus/infra/audit_log.rb
 - lib/textus/infra/audit_subscriber.rb
 - lib/textus/infra/build_lock.rb
 - lib/textus/infra/clock.rb
-- lib/textus/infra/event_bus.rb
 - lib/textus/infra/publisher.rb
 - lib/textus/infra/refresh/detached.rb
 - lib/textus/infra/refresh/lock.rb
@@ -249,6 +266,7 @@ files:
 - lib/textus/key/grammar.rb
 - lib/textus/key/path.rb
 - lib/textus/manifest.rb
+- lib/textus/manifest/data.rb
 - lib/textus/manifest/entry.rb
 - lib/textus/manifest/entry/base.rb
 - lib/textus/manifest/entry/derived.rb
@@ -262,16 +280,23 @@ files:
 - lib/textus/manifest/entry/validators/index_filename.rb
 - lib/textus/manifest/entry/validators/inject_boot.rb
 - lib/textus/manifest/entry/validators/publish_each.rb
+- lib/textus/manifest/policy.rb
 - lib/textus/manifest/resolver.rb
 - lib/textus/manifest/role_kinds.rb
 - lib/textus/manifest/rules.rb
 - lib/textus/manifest/schema.rb
+- lib/textus/mcp.rb
+- lib/textus/mcp/errors.rb
+- lib/textus/mcp/server.rb
+- lib/textus/mcp/session.rb
+- lib/textus/mcp/tool_schemas.rb
+- lib/textus/mcp/tools.rb
 - lib/textus/mustache.rb
-- lib/textus/operations.rb
 - lib/textus/role.rb
 - lib/textus/schema.rb
 - lib/textus/schema/tools.rb
 - lib/textus/schemas.rb
+- lib/textus/session.rb
 - lib/textus/store.rb
 - lib/textus/uid.rb
 - lib/textus/version.rb

data/lib/textus/application/reads/audit.rb

@@ -1,94 +0,0 @@
-require "json"
-require "time"
-
-module Textus
-  module Application
-    module Reads
-      # Queries .textus/audit.log. Filters: key, zone, role, verb, since,
-      # correlation_id, limit. Reads the log file as JSON-Lines (legacy TSV
-      # rows produce nil and are skipped).
-      class Audit
-        def initialize(manifest:, root:, audit_log: nil)
-          @manifest  = manifest
-          @root      = root
-          @log_path  = File.join(root, "audit.log")
-          @audit_log = audit_log
-        end
-
-        # rubocop:disable Metrics/ParameterLists, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
-        def call(key: nil, zone: nil, role: nil, verb: nil, since: nil, seq_since: nil, correlation_id: nil, limit: nil)
-          check_cursor_expiry!(seq_since)
-
-          files = all_log_files
-          return [] if files.empty?
-
-          rows = []
-          files.each do |file|
-            File.foreach(file) do |line|
-              parsed = parse_row(line.chomp)
-              next unless parsed
-              next if key && parsed["key"] != key
-              next if role && parsed["role"] != role
-              next if verb && parsed["verb"] != verb
-              next if zone && !key_in_zone?(parsed["key"], zone)
-              next if since && (parsed["ts"].nil? || Time.parse(parsed["ts"]) < since)
-              next if seq_since && (parsed["seq"].nil? || parsed["seq"] <= seq_since)
-              next if correlation_id && parsed.dig("extras", "correlation_id") != correlation_id
-
-              rows << parsed
-              break if limit && rows.length >= limit
-            end
-            break if limit && rows.length >= limit
-          end
-          rows
-        end
-        # rubocop:enable Metrics/ParameterLists, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
-
-        # Accepts ISO8601 ("2026-01-15", "2026-01-15T10:00:00Z") or a relative
-        # offset matching /\A(\d+)([smhd])\z/. Returns nil for unparseable input.
-        def self.parse_since(str, now: Time.now.utc)
-          return nil if str.nil? || str.empty?
-          return Time.parse(str) if str =~ /\A\d{4}-\d{2}-\d{2}/
-
-          m = str.match(/\A(\d+)([smhd])\z/) or return nil
-          mult = { "s" => 1, "m" => 60, "h" => 3600, "d" => 86_400 }[m[2]]
-          now - (m[1].to_i * mult)
-        end
-
-        private
-
-        def check_cursor_expiry!(seq_since)
-          return unless seq_since
-
-          log = @audit_log || Textus::Infra::AuditLog.new(@root)
-          min = log.min_available_seq
-          raise Textus::CursorExpired.new(requested: seq_since, min_available: min) if min && seq_since < min - 1
-        end
-
-        def all_log_files
-          rotated = Dir.glob(File.join(@root, "audit.log.*"))
-                       .reject { |p| p.end_with?(".meta.json") }
-                       .sort_by { |p| -p.scan(/\d+$/).first.to_i } # .5 .4 .3 .2 .1 → oldest first
-          active = File.exist?(@log_path) ? [@log_path] : []
-          rotated + active
-        end
-
-        def parse_row(line)
-          return nil if line.empty?
-          return nil unless line.start_with?("{")
-
-          JSON.parse(line)
-        rescue JSON::ParserError
-          nil
-        end
-
-        def key_in_zone?(key, zone)
-          mentry = @manifest.resolver.resolve(key).entry
-          mentry && mentry.zone == zone
-        rescue Textus::Error
-          false
-        end
-      end
-    end
-  end
-end