@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/sync/source-merge.ts

@@ -0,0 +1,100 @@
+// Three-way merge of a canvas body — audit 2026-09-13 P0 #1 (plan T2).
+//
+// A local save authored on an older base used to be imported by diffing the
+// file against the CURRENT doc, which turned every stale byte into an edit: a
+// peer's newer title was "reverted" by a save that only changed a colour. The
+// base is the body disk and doc last agreed on; the merge applies each side's
+// edits relative to it and refuses the moment two edits touch.
+//
+// Character-level on purpose: canvases put many attributes on one line, and a
+// line merge would call the audit's title/colour race a conflict. The price is
+// that "independent" means "non-touching spans", not "semantically unrelated"
+// — which is why the caller validates the merged source before importing it,
+// and why anything ambiguous is preserved for a person rather than guessed at.
+
+import { diffChars } from 'diff';
+
+export type MergeResult =
+  | { ok: true; merged: string }
+  /** `overlap` — the edits touch; `budget` — too large to diff safely. */
+  | { ok: false; reason: 'overlap' | 'budget' };
+
+/** One replacement of `base[start, end)` by `text`. `start === end` inserts. */
+interface Edit {
+  start: number;
+  end: number;
+  text: string;
+}
+
+/** Same bounds the text lane uses for its import diff (codec applyTextLane). */
+const DIFF_BUDGET = { maxEditLength: 4096, timeout: 50 };
+
+function editsOf(base: string, next: string): Edit[] | null {
+  let prefix = 0;
+  const maxPrefix = Math.min(base.length, next.length);
+  while (prefix < maxPrefix && base.charCodeAt(prefix) === next.charCodeAt(prefix)) prefix++;
+  let suffix = 0;
+  const maxSuffix = Math.min(base.length - prefix, next.length - prefix);
+  while (
+    suffix < maxSuffix &&
+    base.charCodeAt(base.length - 1 - suffix) === next.charCodeAt(next.length - 1 - suffix)
+  ) {
+    suffix++;
+  }
+  // Never split a surrogate pair across an edit boundary.
+  if (prefix > 0 && /[\uD800-\uDBFF]/.test(base[prefix - 1] ?? '')) prefix--;
+  if (suffix > 0 && /[\uDC00-\uDFFF]/.test(base[base.length - suffix] ?? '')) suffix--;
+  const from = base.slice(prefix, base.length - suffix);
+  const to = next.slice(prefix, next.length - suffix);
+  if (!from && !to) return [];
+  if (!from || !to) return [{ start: prefix, end: prefix + from.length, text: to }];
+  const changes = diffChars(from, to, DIFF_BUDGET);
+  if (changes === undefined) return null;
+  const edits: Edit[] = [];
+  let offset = prefix;
+  let open: Edit | null = null;
+  for (const change of changes) {
+    if (change.removed || change.added) {
+      open ??= { start: offset, end: offset, text: '' };
+      if (change.removed) {
+        open.end += change.value.length;
+        offset += change.value.length;
+      } else open.text += change.value;
+    } else {
+      if (open) edits.push(open);
+      open = null;
+      offset += change.value.length;
+    }
+  }
+  if (open) edits.push(open);
+  return edits;
+}
+
+const same = (a: Edit, b: Edit) => a.start === b.start && a.end === b.end && a.text === b.text;
+
+/**
+ * Merge `ours` and `theirs`, both derived from `base`. Edits that touch —
+ * overlapping, adjacent, or two insertions at one point — are an `overlap`
+ * unless they are the identical edit, which is applied once.
+ */
+export function mergeSource(base: string, ours: string, theirs: string): MergeResult {
+  if (ours === theirs || theirs === base) return { ok: true, merged: ours };
+  if (ours === base) return { ok: true, merged: theirs };
+  const a = editsOf(base, ours);
+  const b = editsOf(base, theirs);
+  if (!a || !b) return { ok: false, reason: 'budget' };
+  const all: Edit[] = [];
+  for (const edit of [...a, ...b].sort((x, y) => x.start - y.start || x.end - y.end)) {
+    const prev = all[all.length - 1];
+    if (prev && same(prev, edit)) continue;
+    if (prev && edit.start <= prev.end) return { ok: false, reason: 'overlap' };
+    all.push(edit);
+  }
+  let merged = '';
+  let cursor = 0;
+  for (const edit of all) {
+    merged += base.slice(cursor, edit.start) + edit.text;
+    cursor = edit.end;
+  }
+  return { ok: true, merged: merged + base.slice(cursor) };
+}

package/apps/studio/sync/source-ops.ts

@@ -0,0 +1,289 @@
+// UI source operations that survive a race — plan T23/T24 (DDR-241).
+//
+// A change the person makes in the inspector or on the canvas (a text, a
+// style property, an attribute) is saved as a whole-canvas proposal with the
+// base it was made from; the hub merges it three-way. Two people changing the
+// SAME property touch the same characters, and a character merge can only
+// call that a conflict — a dialog for "we both picked a colour", which is not
+// what a design tool does. Figma-class tools resolve it by acceptance order:
+// the later assignment wins, and nothing else of either person's is lost.
+//
+// So such an edit also records WHAT it was — the operation, the element's
+// position-independent print, and the value — and when its proposal loses a
+// race the studio re-applies exactly that operation onto the version that won
+// and proposes again. What the other person changed elsewhere survives (it is
+// in the version the edit is re-applied to); the same property takes the
+// later value; the history keeps both actions in the order they were accepted.
+//
+// It re-applies only when it can find THE element (canvas-edit
+// `relocateElement`); a deleted or ambiguous target is a genuine conflict and
+// goes to the person, never to a guess.
+
+import {
+  applyDeleteElement,
+  applyDuplicateElement,
+  applyEdit,
+  applyMove,
+  applyRemove,
+  applyRemoveClip,
+  applyResizeArtboard,
+  applyRetimeSequenceByClip,
+  applySetArtboardGuides,
+  applySetArtboardHug,
+  applySetArtboardKind,
+  applySetArtboardLabel,
+  applySetArtboardStyle,
+  applyTextEdit,
+  type ElementPrint,
+  elementPrint,
+  relocateElement,
+} from '../canvas-edit.ts';
+
+/** An artboard is addressed by its authored id — stable by construction. */
+export type ArtboardFn = 'resize' | 'hug' | 'style' | 'kind' | 'label' | 'guides';
+
+export type SourceOp =
+  | {
+      kind: 'text';
+      id: string;
+      text: string;
+      occurrence?: number;
+      before?: string;
+      print: ElementPrint;
+    }
+  | {
+      kind: 'set';
+      id: string;
+      attr: string;
+      value: string;
+      occurrence?: number;
+      print: ElementPrint;
+    }
+  | { kind: 'remove'; id: string; attr: string; occurrence?: number; print: ElementPrint }
+  // T25 — structural element operations, re-found by print.
+  | { kind: 'delete'; id: string; occurrence?: number; print: ElementPrint }
+  | { kind: 'duplicate'; id: string; occurrence?: number; print: ElementPrint }
+  | {
+      kind: 'move';
+      id: string;
+      refId: string;
+      position: string;
+      idIndex?: number;
+      refIndex?: number;
+      print: ElementPrint;
+      refPrint: ElementPrint;
+    }
+  // Artboards and clips carry stable ids already (authored id; stableId +
+  // content hash) — no print needed; a changed clip fails its own hash check.
+  | { kind: 'artboard'; fn: ArtboardFn; artboardId: string; args: unknown[]; print?: undefined }
+  | {
+      kind: 'clip-retime' | 'clip-remove';
+      artboardId?: string;
+      stableId: string;
+      expectedHash?: string;
+      patch?: unknown;
+      print?: undefined;
+    };
+
+type Describable =
+  | { kind: 'text'; id: string; text: string; occurrence?: number; before?: string }
+  | { kind: 'set'; id: string; attr: string; value: string; occurrence?: number }
+  | { kind: 'remove'; id: string; attr: string; occurrence?: number }
+  | { kind: 'delete'; id: string; occurrence?: number }
+  | { kind: 'duplicate'; id: string; occurrence?: number }
+  | {
+      kind: 'move';
+      id: string;
+      refId: string;
+      position: string;
+      idIndex?: number;
+      refIndex?: number;
+    }
+  | { kind: 'artboard'; fn: ArtboardFn; artboardId: string; args: unknown[] }
+  | {
+      kind: 'clip-retime' | 'clip-remove';
+      artboardId?: string;
+      stableId: string;
+      expectedHash?: string;
+      patch?: unknown;
+    };
+
+type StableOp = Extract<SourceOp, { kind: 'artboard' | 'clip-retime' | 'clip-remove' }>;
+type ElementOp = Exclude<SourceOp, StableOp>;
+const STABLE = new Set(['artboard', 'clip-retime', 'clip-remove']);
+function isStable<T extends { kind: string }>(op: T): boolean {
+  return STABLE.has(op.kind);
+}
+
+/** The attribute a print must ignore for this op (it is the one changing). */
+function editedAttr(op: { kind: string; attr?: string }): string | null {
+  if (op.kind !== 'set' && op.kind !== 'remove') return null;
+  const a = op.attr ?? '';
+  return a.startsWith('style.') ? 'style' : a;
+}
+
+/** Describe an operation against the source it is about to be applied to. */
+export function describeSourceOp(
+  canvasAbsPath: string,
+  source: string,
+  op: Describable
+): SourceOp | null {
+  try {
+    if (isStable(op)) return op as SourceOp;
+    const el = op as Exclude<Describable, { kind: 'artboard' | 'clip-retime' | 'clip-remove' }>;
+    // A text edit's own text is what changes, so it is not part of the print.
+    const print = elementPrint(canvasAbsPath, source, el.id, editedAttr(el), el.kind !== 'text');
+    if (!print) return null;
+    if (el.kind === 'move') {
+      const refPrint = elementPrint(canvasAbsPath, source, el.refId, null);
+      return refPrint ? { ...el, print, refPrint } : null;
+    }
+    return { ...el, print } as SourceOp;
+  } catch {
+    return null;
+  }
+}
+
+export type ReplayResult =
+  | { ok: true; source: string }
+  | { ok: false; reason: 'target-missing' | 'failed' };
+
+/** Re-apply `op` onto `head` — the version that won. Pure. */
+export function replaySourceOp(canvasAbsPath: string, anyOp: SourceOp, head: string): ReplayResult {
+  if (isStable(anyOp)) return replayStable(canvasAbsPath, anyOp as StableOp, head);
+  return replayElement(canvasAbsPath, anyOp as ElementOp, head);
+}
+
+function replayStable(canvasAbsPath: string, op: StableOp, head: string): ReplayResult {
+  try {
+    if (op.kind === 'artboard')
+      return { ok: true, source: replayArtboard(canvasAbsPath, op, head) };
+    if (op.kind === 'clip-retime') {
+      return {
+        ok: true,
+        source: applyRetimeSequenceByClip(
+          canvasAbsPath,
+          head,
+          op.artboardId,
+          op.stableId,
+          op.expectedHash,
+          op.patch as Parameters<typeof applyRetimeSequenceByClip>[5]
+        ).source,
+      };
+    }
+    if (op.kind === 'clip-remove') {
+      return {
+        ok: true,
+        source: applyRemoveClip(canvasAbsPath, head, op.artboardId, op.stableId, op.expectedHash)
+          .source,
+      };
+    }
+  } catch {
+    return { ok: false, reason: 'failed' };
+  }
+  return { ok: false, reason: 'failed' };
+}
+
+function replayElement(canvasAbsPath: string, op: ElementOp, head: string): ReplayResult {
+  let id: string | null;
+  try {
+    id = relocateElement(canvasAbsPath, head, op.id, op.print, editedAttr(op));
+  } catch {
+    return { ok: false, reason: 'failed' };
+  }
+  if (!id) return { ok: false, reason: 'target-missing' };
+  try {
+    switch (op.kind) {
+      case 'text':
+        return {
+          ok: true,
+          source: applyTextEdit(canvasAbsPath, head, id, op.text, {
+            ...(op.occurrence !== undefined ? { occurrence: op.occurrence } : {}),
+          }).source,
+        };
+      case 'set':
+        return {
+          ok: true,
+          source: applyEdit(canvasAbsPath, head, id, op.attr, op.value, op.occurrence).source,
+        };
+      case 'remove':
+        return {
+          ok: true,
+          source: applyRemove(canvasAbsPath, head, id, op.attr, op.occurrence).source,
+        };
+      case 'delete':
+        return {
+          ok: true,
+          source: applyDeleteElement(canvasAbsPath, head, id, op.occurrence).source,
+        };
+      case 'duplicate':
+        return {
+          ok: true,
+          source: applyDuplicateElement(canvasAbsPath, head, id, op.occurrence).source,
+        };
+      case 'move': {
+        const refId = relocateElement(canvasAbsPath, head, op.refId, op.refPrint, null);
+        if (!refId) return { ok: false, reason: 'target-missing' };
+        return {
+          ok: true,
+          source: applyMove(
+            canvasAbsPath,
+            head,
+            id,
+            refId,
+            op.position as Parameters<typeof applyMove>[4],
+            op.idIndex,
+            op.refIndex
+          ).source,
+        };
+      }
+    }
+  } catch {
+    return { ok: false, reason: 'failed' };
+  }
+  return { ok: false, reason: 'failed' };
+}
+
+function replayArtboard(
+  abs: string,
+  op: Extract<SourceOp, { kind: 'artboard' }>,
+  head: string
+): string {
+  const a = op.args;
+  switch (op.fn) {
+    case 'resize':
+      return applyResizeArtboard(
+        abs,
+        head,
+        op.artboardId,
+        a[0] as number | undefined,
+        a[1] as number | undefined
+      ).source;
+    case 'hug':
+      return applySetArtboardHug(
+        abs,
+        head,
+        op.artboardId,
+        a[0] === true,
+        a[1] as number | undefined
+      ).source;
+    case 'style':
+      return applySetArtboardStyle(
+        abs,
+        head,
+        op.artboardId,
+        a[0] as Parameters<typeof applySetArtboardStyle>[3]
+      ).source;
+    case 'kind':
+      return applySetArtboardKind(abs, head, op.artboardId, (a[0] as string | null) ?? null).source;
+    case 'label':
+      return applySetArtboardLabel(abs, head, op.artboardId, String(a[0] ?? '')).source;
+    case 'guides':
+      return applySetArtboardGuides(
+        abs,
+        head,
+        op.artboardId,
+        (a[0] as Record<string, unknown> | null) ?? null
+      ).source;
+  }
+}

package/apps/studio/sync/source-recovery.ts

@@ -0,0 +1,70 @@
+// Bounded recovery slots, outside the rolling snapshot queue: a corrupt peer
+// cannot evict the last valid source by flooding rejected updates (#121).
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { atomicWrite } from './atomic-write.ts';
+import { MAX_HTML_BYTES } from './limits.ts';
+import { sourceError } from './source-validation.ts';
+
+/**
+ * `base` is the body disk and doc last agreed on — the merge base a restart
+ * needs, since the journal keeps only its hash (audit 2026-09-13 P0 #1).
+ */
+export type RecoverySlot = 'last-valid' | 'local' | 'incoming' | 'base';
+
+export function saveRecoveryBody(
+  historyDir: string,
+  file: string,
+  slot: RecoverySlot,
+  body: string
+): string {
+  if (Buffer.byteLength(body, 'utf8') > MAX_HTML_BYTES)
+    throw new Error('Recovery source exceeds size limit');
+  const target = path.join(historyDir, 'sync-recovery', `${slot}${path.extname(file)}`);
+  if (!existsSync(target) || readFileSync(target, 'utf8') !== body) atomicWrite(target, body);
+  return target;
+}
+
+/** One recovery slot's body, or null when absent/unreadable/oversized. */
+export function readRecoveryBody(
+  historyDir: string,
+  file: string,
+  slot: RecoverySlot
+): string | null {
+  const target = path.join(historyDir, 'sync-recovery', `${slot}${path.extname(file)}`);
+  try {
+    if (statSync(target).size > MAX_HTML_BYTES) return null;
+    return readFileSync(target, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export function lastValidSource(historyDir: string, file: string): string | null {
+  const ext = path.extname(file);
+  const retained = path.join(historyDir, 'sync-recovery', `last-valid${ext}`);
+  let candidates = [retained];
+  try {
+    candidates = candidates.concat(
+      readdirSync(historyDir, { withFileTypes: true })
+        .filter((e) => e.isFile() && e.name.endsWith(ext))
+        .map((e) => e.name)
+        .sort()
+        .reverse()
+        .slice(0, 300)
+        .map((name) => path.join(historyDir, name))
+    );
+  } catch {
+    /* no older history */
+  }
+  for (const candidate of candidates) {
+    try {
+      if (statSync(candidate).size > MAX_HTML_BYTES) continue;
+      const body = readFileSync(candidate, 'utf8');
+      if (body.trim() && sourceError(file, body) === null) return body;
+    } catch {
+      /* try the next snapshot */
+    }
+  }
+  return null;
+}

package/apps/studio/sync/source-validation.ts

@@ -0,0 +1,56 @@
+// #121: parser success alone does not rule out duplicate source declarations.
+import { parseSync } from 'oxc-parser';
+import { MAX_HTML_BYTES } from './limits.ts';
+
+/** Null means safe source syntax; never resolves imports or executes code. */
+export function sourceError(file: string, body: string): string | null {
+  if (!/\.[jt]sx?$/i.test(file)) return null;
+  if (Buffer.byteLength(body, 'utf8') > MAX_HTML_BYTES) return 'Source exceeds the size limit';
+  try {
+    const parsed = parseSync(file, body, { sourceType: 'module', showSemanticErrors: true });
+    if (parsed.errors.length) return 'Source has syntax errors or duplicate bindings';
+    const functions = new Set<string>();
+    for (const statement of parsed.program.body) {
+      const node =
+        statement.type === 'ExportNamedDeclaration' || statement.type === 'ExportDefaultDeclaration'
+          ? statement.declaration
+          : statement;
+      // TS overload signatures and interface merging are valid. Only multiple
+      // implementations collide; OXC currently accepts those even in modules.
+      if (node?.type === 'FunctionDeclaration' && node.body && node.id) {
+        if (functions.has(node.id.name)) return 'Source has duplicate function implementations';
+        functions.add(node.id.name);
+      }
+    }
+    // Overload/type-only declarations may share an exported name. Exclude
+    // their own entries, not every later export with that name (#121).
+    const typeOnlyExports = new Set(
+      parsed.program.body
+        .filter(
+          (statement) =>
+            statement.type === 'ExportNamedDeclaration' &&
+            statement.declaration &&
+            ['TSDeclareFunction', 'TSInterfaceDeclaration', 'TSTypeAliasDeclaration'].includes(
+              statement.declaration.type
+            )
+        )
+        .map((statement) => statement.start)
+    );
+    const exports = new Set<string>();
+    for (const statement of parsed.module.staticExports) {
+      if (typeOnlyExports.has(statement.start)) continue;
+      for (const entry of statement.entries) {
+        if (entry.isType) continue;
+        const name = entry.exportName.kind === 'Default' ? 'default' : entry.exportName.name;
+        if (name === null) continue;
+        if (exports.has(name)) {
+          return 'Source has duplicate exports';
+        }
+        exports.add(name);
+      }
+    }
+    return null;
+  } catch {
+    return 'Source could not be validated';
+  }
+}