@agent-profile/web 0.1.3 → 0.1.5

package/build/server/chunks/{projectContext-C4-xYqFg.js → projectContext-Cxsfz84C.js}

@@ -1,9 +1,9 @@
-import { createRequire } from 'node:module';
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
+import fsPromises, { readFile } from 'node:fs/promises';
 import require$$0 from 'process';
 import require$$0$1 from 'buffer';
-import { createHash } from 'node:crypto';
+import { TextDecoder } from 'node:util';
+import path from 'node:path';
+import { randomBytes, createHash } from 'node:crypto';
 
 var ajv = {exports: {}};
 
@@ -13536,8 +13536,10 @@ function requireComposer () {
 	            }
 	        }
 	        if (afterDoc) {
-	            Array.prototype.push.apply(doc.errors, this.errors);
-	            Array.prototype.push.apply(doc.warnings, this.warnings);
+	            for (let i = 0; i < this.errors.length; ++i)
+	                doc.errors.push(this.errors[i]);
+	            for (let i = 0; i < this.warnings.length; ++i)
+	                doc.warnings.push(this.warnings[i]);
 	        }
 	        else {
 	            doc.errors = this.errors;
@@ -14510,7 +14512,7 @@ function requireLexer () {
 	            const n = (yield* this.pushCount(1)) + (yield* this.pushSpaces(true));
 	            this.indentNext = this.indentValue + 1;
 	            this.indentValue += n;
-	            return yield* this.parseBlockStart();
+	            return 'block-start';
 	        }
 	        return 'doc';
 	    }
@@ -14831,32 +14833,36 @@ function requireLexer () {
 	        return 0;
 	    }
 	    *pushIndicators() {
-	        switch (this.charAt(0)) {
-	            case '!':
-	                return ((yield* this.pushTag()) +
-	                    (yield* this.pushSpaces(true)) +
-	                    (yield* this.pushIndicators()));
-	            case '&':
-	                return ((yield* this.pushUntil(isNotAnchorChar)) +
-	                    (yield* this.pushSpaces(true)) +
-	                    (yield* this.pushIndicators()));
-	            case '-': // this is an error
-	            case '?': // this is an error outside flow collections
-	            case ':': {
-	                const inFlow = this.flowLevel > 0;
-	                const ch1 = this.charAt(1);
-	                if (isEmpty(ch1) || (inFlow && flowIndicatorChars.has(ch1))) {
-	                    if (!inFlow)
-	                        this.indentNext = this.indentValue + 1;
-	                    else if (this.flowKey)
-	                        this.flowKey = false;
-	                    return ((yield* this.pushCount(1)) +
-	                        (yield* this.pushSpaces(true)) +
-	                        (yield* this.pushIndicators()));
+	        let n = 0;
+	        loop: while (true) {
+	            switch (this.charAt(0)) {
+	                case '!':
+	                    n += yield* this.pushTag();
+	                    n += yield* this.pushSpaces(true);
+	                    continue loop;
+	                case '&':
+	                    n += yield* this.pushUntil(isNotAnchorChar);
+	                    n += yield* this.pushSpaces(true);
+	                    continue loop;
+	                case '-': // this is an error
+	                case '?': // this is an error outside flow collections
+	                case ':': {
+	                    const inFlow = this.flowLevel > 0;
+	                    const ch1 = this.charAt(1);
+	                    if (isEmpty(ch1) || (inFlow && flowIndicatorChars.has(ch1))) {
+	                        if (!inFlow)
+	                            this.indentNext = this.indentValue + 1;
+	                        else if (this.flowKey)
+	                            this.flowKey = false;
+	                        n += yield* this.pushCount(1);
+	                        n += yield* this.pushSpaces(true);
+	                        continue loop;
+	                    }
 	                }
 	            }
+	            break loop;
 	        }
-	        return 0;
+	        return n;
 	    }
 	    *pushTag() {
 	        if (this.charAt(1) === '<') {
@@ -15046,6 +15052,14 @@ function requireParser () {
 	    }
 	    return prev.splice(i, prev.length);
 	}
+	function arrayPushArray(target, source) {
+	    // May exhaust call stack with large `source` array
+	    if (source.length < 1e5)
+	        Array.prototype.push.apply(target, source);
+	    else
+	        for (let i = 0; i < source.length; ++i)
+	            target.push(source[i]);
+	}
 	function fixFlowSeqItems(fc) {
 	    if (fc.start.type === 'flow-seq-start') {
 	        for (const it of fc.items) {
@@ -15058,12 +15072,12 @@ function requireParser () {
 	                delete it.key;
 	                if (isFlowToken(it.value)) {
 	                    if (it.value.end)
-	                        Array.prototype.push.apply(it.value.end, it.sep);
+	                        arrayPushArray(it.value.end, it.sep);
 	                    else
 	                        it.value.end = it.sep;
 	                }
 	                else
-	                    Array.prototype.push.apply(it.start, it.sep);
+	                    arrayPushArray(it.start, it.sep);
 	                delete it.sep;
 	            }
 	        }
@@ -15483,7 +15497,7 @@ function requireParser () {
 	                        const prev = map.items[map.items.length - 2];
 	                        const end = prev?.value?.end;
 	                        if (Array.isArray(end)) {
-	                            Array.prototype.push.apply(end, it.start);
+	                            arrayPushArray(end, it.start);
 	                            end.push(this.sourceToken);
 	                            map.items.pop();
 	                            return;
@@ -15698,7 +15712,7 @@ function requireParser () {
 	                        const prev = seq.items[seq.items.length - 2];
 	                        const end = prev?.value?.end;
 	                        if (Array.isArray(end)) {
-	                            Array.prototype.push.apply(end, it.start);
+	                            arrayPushArray(end, it.start);
 	                            end.push(this.sourceToken);
 	                            seq.items.pop();
 	                            return;
@@ -16124,8 +16138,183 @@ function requireDist () {
 
 var distExports = requireDist();
 
-//#region ../../packages/core/dist/profile.js
-var aiProfileSchema = createRequire(import.meta.url)("@agent-profile/schemas/ai-profile.schema.json");
+var ai_profile_schema_default = {
+	$schema: "http://json-schema.org/draft-07/schema#",
+	$id: "https://agent-profile.local/schemas/ai-profile.schema.json",
+	title: "Agent Profile",
+	description: "Version 1 canonical profile for Agent Profile Compiler.",
+	type: "object",
+	additionalProperties: false,
+	required: [
+		"version",
+		"profile",
+		"stack",
+		"clients",
+		"workflow"
+	],
+	properties: {
+		"version": {
+			"type": "integer",
+			"const": 1
+		},
+		"profile": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["name", "description"],
+			"properties": {
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"pattern": "^[a-z0-9][a-z0-9._-]*$"
+				},
+				"description": {
+					"type": "string",
+					"minLength": 1
+				}
+			}
+		},
+		"stack": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"languages",
+				"frameworks",
+				"packageManagers",
+				"testing"
+			],
+			"properties": {
+				"languages": { "$ref": "#/definitions/nonEmptySlugArray" },
+				"frameworks": { "$ref": "#/definitions/slugArray" },
+				"packageManagers": { "$ref": "#/definitions/slugArray" },
+				"testing": { "$ref": "#/definitions/slugArray" }
+			}
+		},
+		"clients": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"tabnine",
+				"codex",
+				"claude"
+			],
+			"properties": {
+				"tabnine": { "$ref": "#/definitions/client" },
+				"codex": { "$ref": "#/definitions/client" },
+				"claude": { "$ref": "#/definitions/client" }
+			}
+		},
+		"safety": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"mode": { "$ref": "#/definitions/safetyMode" },
+				"requiresSandbox": { "type": "boolean" }
+			}
+		},
+		"workflow": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"sdd",
+				"tdd",
+				"finalReview"
+			],
+			"properties": {
+				"sdd": { "type": "boolean" },
+				"tdd": { "type": "boolean" },
+				"finalReview": { "type": "boolean" }
+			}
+		},
+		"permissions": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"filesystem": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"read": { "$ref": "#/definitions/permissionMode" },
+						"write": { "$ref": "#/definitions/permissionMode" }
+					}
+				},
+				"shell": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": { "run": { "$ref": "#/definitions/permissionMode" } }
+				},
+				"secrets": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": { "access": {
+						"type": "string",
+						"const": "deny"
+					} }
+				},
+				"dependencies": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": { "install": { "$ref": "#/definitions/permissionMode" } }
+				},
+				"network": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": { "external": { "$ref": "#/definitions/permissionMode" } }
+				},
+				"production": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": { "access": {
+						"type": "string",
+						"const": "deny"
+					} }
+				}
+			}
+		}
+	},
+	definitions: {
+		"client": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["enabled"],
+			"properties": { "enabled": { "type": "boolean" } }
+		},
+		"permissionMode": {
+			"type": "string",
+			"enum": [
+				"allow",
+				"ask",
+				"deny"
+			]
+		},
+		"safetyMode": {
+			"type": "string",
+			"enum": [
+				"guarded",
+				"balanced",
+				"autonomous",
+				"plan-only"
+			]
+		},
+		"slug": {
+			"type": "string",
+			"minLength": 1,
+			"pattern": "^[a-z0-9][a-z0-9._-]*$"
+		},
+		"slugArray": {
+			"type": "array",
+			"uniqueItems": true,
+			"items": { "$ref": "#/definitions/slug" }
+		},
+		"nonEmptySlugArray": {
+			"type": "array",
+			"minItems": 1,
+			"uniqueItems": true,
+			"items": { "$ref": "#/definitions/slug" }
+		}
+	}
+};
+//#endregion
+//#region ../../packages/core/src/profile.ts
 var compiledValidator;
 var DEFAULT_SAFETY = {
 	mode: "guarded",
@@ -16227,6 +16416,86 @@ function normalizeSafety(profile) {
 		requiresSandbox: profile.safety?.requiresSandbox ?? DEFAULT_SAFETY.requiresSandbox
 	};
 }
+/**
+* Serialize a validated AiProfile to deterministic YAML.
+*
+* - UTF-8, single trailing newline.
+* - Schema field order: version, profile, stack, clients, safety, workflow, permissions.
+* - Optional safety / permissions omitted when absent on the input object.
+* - Empty arrays render as [].
+* - Deterministic: two calls on the same object produce byte-identical output.
+*/
+function renderProfileYaml(profile) {
+	const doc = {};
+	doc["version"] = profile.version;
+	doc["profile"] = {
+		name: profile.profile.name,
+		description: profile.profile.description
+	};
+	doc["stack"] = {
+		languages: profile.stack.languages,
+		frameworks: profile.stack.frameworks,
+		packageManagers: profile.stack.packageManagers,
+		testing: profile.stack.testing
+	};
+	doc["clients"] = {
+		tabnine: { enabled: profile.clients.tabnine.enabled },
+		codex: { enabled: profile.clients.codex.enabled },
+		claude: { enabled: profile.clients.claude.enabled }
+	};
+	if (profile.safety !== void 0) {
+		const safety = {};
+		if (profile.safety.mode !== void 0) safety["mode"] = profile.safety.mode;
+		if (profile.safety.requiresSandbox !== void 0) safety["requiresSandbox"] = profile.safety.requiresSandbox;
+		doc["safety"] = safety;
+	}
+	doc["workflow"] = {
+		sdd: profile.workflow.sdd,
+		tdd: profile.workflow.tdd,
+		finalReview: profile.workflow.finalReview
+	};
+	if (profile.permissions !== void 0) doc["permissions"] = buildPermissionsDoc(profile.permissions);
+	return distExports.stringify(doc, {
+		lineWidth: 0,
+		indent: 2,
+		sortMapEntries: false
+	}).replace(/\n+$/, "") + "\n";
+}
+function buildPermissionsDoc(p) {
+	const doc = {};
+	if (p.filesystem !== void 0) {
+		const fs = {};
+		if (p.filesystem.read !== void 0) fs["read"] = p.filesystem.read;
+		if (p.filesystem.write !== void 0) fs["write"] = p.filesystem.write;
+		if (Object.keys(fs).length > 0) doc["filesystem"] = fs;
+	}
+	if (p.shell !== void 0) {
+		const sh = {};
+		if (p.shell.run !== void 0) sh["run"] = p.shell.run;
+		if (Object.keys(sh).length > 0) doc["shell"] = sh;
+	}
+	if (p.secrets !== void 0) {
+		const sec = {};
+		if (p.secrets.access !== void 0) sec["access"] = p.secrets.access;
+		if (Object.keys(sec).length > 0) doc["secrets"] = sec;
+	}
+	if (p.dependencies !== void 0) {
+		const dep = {};
+		if (p.dependencies.install !== void 0) dep["install"] = p.dependencies.install;
+		if (Object.keys(dep).length > 0) doc["dependencies"] = dep;
+	}
+	if (p.network !== void 0) {
+		const net = {};
+		if (p.network.external !== void 0) net["external"] = p.network.external;
+		if (Object.keys(net).length > 0) doc["network"] = net;
+	}
+	if (p.production !== void 0) {
+		const prod = {};
+		if (p.production.access !== void 0) prod["access"] = p.production.access;
+		if (Object.keys(prod).length > 0) doc["production"] = prod;
+	}
+	return doc;
+}
 function deriveEffectivePermissions(profile) {
 	const safety = normalizeSafety(profile);
 	const permissions = profile.permissions ?? {};
@@ -16252,7 +16521,7 @@ function getRemoteRefs(schema) {
 	collectRemoteRefs(schema, refs);
 	return refs.sort();
 }
-function compileProfileSchema(schema = aiProfileSchema) {
+function compileProfileSchema(schema = ai_profile_schema_default) {
 	assertNoRemoteRefs(schema);
 	return new ajvExports.Ajv({
 		allErrors: true,
@@ -16368,12 +16637,13 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-//#region ../../packages/core/dist/security.js
+//#region ../../packages/core/src/security.ts
 function containsSecretLikeLiteral(text) {
 	return text.includes("SECRET_TOKEN_VALUE") || /-----BEGIN [A-Z ]*PRIVATE KEY-----/u.test(text) || /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?(?!\$)[A-Za-z0-9_./+=-]{10,}/iu.test(text);
 }
-//#endregion
-//#region ../../packages/compiler/dist/shared.js
+new TextDecoder("utf-8", { fatal: true });
+
+//#region ../../packages/compiler/src/shared.ts
 var AGENT_PROFILE_COMPILER = {
 	name: "agent-profile",
 	version: "0.1.0"
@@ -16423,7 +16693,7 @@ function compareText(left, right) {
 	return 0;
 }
 //#endregion
-//#region ../../packages/compiler/dist/lockfile.js
+//#region ../../packages/compiler/src/lockfile.ts
 function buildLockfile(input) {
 	return {
 		version: 1,
@@ -16658,7 +16928,7 @@ function compareLockOutputs(left, right) {
 	return compareText(left.path, right.path) || compareText(left.target, right.target);
 }
 //#endregion
-//#region ../../packages/compiler/dist/compiler.js
+//#region ../../packages/compiler/src/compiler.ts
 var WORKFLOW_SKILLS = [
 	{
 		id: "sdd-change",
@@ -17227,6 +17497,101 @@ function compareIssues(left, right) {
 	return compareText(left.path, right.path) || compareText(left.code, right.code) || compareText(left.message, right.message);
 }
 //#endregion
+//#region ../../packages/compiler/src/write-plan.ts
+function isContainedBy(rootPath, candidatePath) {
+	const relative = path.relative(rootPath, candidatePath);
+	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function isNodeError(error) {
+	return error instanceof Error && "code" in error;
+}
+var PROFILE_FILENAME$1 = "ai-profile.yaml";
+var ProfileWriteError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "ProfileWriteError";
+	}
+};
+/**
+* Atomically write ai-profile.yaml after verifying:
+*  - the target resolves within rootDir (path containment)
+*  - the target is not a symlink
+*  - the current on-disk ETag matches baseEtag (stale-check)
+*
+* Writes via temp-file + rename for atomicity.
+* Returns the new ETag of the written file.
+*
+* Phase 8 does NOT create a missing profile; callers must ensure the file
+* already exists.
+*/
+async function writeProfileAtomic(rootDir, candidateBytes, baseEtag) {
+	const rootRealPath = await fsPromises.realpath(path.resolve(rootDir));
+	const targetAbsolute = path.join(rootRealPath, PROFILE_FILENAME$1);
+	if (!isContainedBy(rootRealPath, targetAbsolute)) throw new ProfileWriteError("traversal", "Profile path escapes root.");
+	let targetStat;
+	try {
+		targetStat = await fsPromises.lstat(targetAbsolute);
+	} catch (err) {
+		if (isNodeError(err) && err.code === "ENOENT") throw new ProfileWriteError("not_found", "ai-profile.yaml not found; run agent-profile init --write.");
+		throw err;
+	}
+	if (targetStat.isSymbolicLink()) throw new ProfileWriteError("symlink", "ai-profile.yaml is a symlink; refusing to write.");
+	const currentEtag = computeFileEtag(await fsPromises.readFile(targetAbsolute));
+	if (currentEtag !== baseEtag) throw new ProfileWriteError("stale", "Profile has changed since last read; reload and retry.");
+	const candidateEtag = computeFileEtag(candidateBytes);
+	if (candidateEtag === currentEtag) return {
+		action: "unchanged",
+		bytes: candidateBytes.length,
+		etag: candidateEtag
+	};
+	const tempName = `ai-profile.yaml.tmp-${randomBytes(8).toString("hex")}`;
+	const tempAbsolute = path.join(rootRealPath, tempName);
+	try {
+		const fd = await fsPromises.open(tempAbsolute, "wx", 420);
+		try {
+			await fd.write(candidateBytes);
+			await fd.sync();
+		} finally {
+			await fd.close();
+		}
+		await fsPromises.rename(tempAbsolute, targetAbsolute);
+		await fsyncParentDirectory(rootRealPath);
+	} catch (err) {
+		try {
+			await fsPromises.rm(tempAbsolute, { force: true });
+		} catch {}
+		throw err;
+	}
+	const writtenEtag = computeFileEtag(await fsPromises.readFile(targetAbsolute));
+	if (writtenEtag !== candidateEtag) throw new ProfileWriteError("verify_failed", "Written bytes do not match expected hash.");
+	return {
+		action: "change",
+		bytes: candidateBytes.length,
+		etag: writtenEtag
+	};
+}
+async function fsyncParentDirectory(directoryPath) {
+	if (process.platform === "win32") return;
+	let fd;
+	try {
+		fd = await fsPromises.open(directoryPath, "r");
+		await fd.sync();
+	} catch (err) {
+		if (!isNodeError(err) || err.code !== "EINVAL" && err.code !== "EPERM") throw err;
+	} finally {
+		await fd?.close();
+	}
+}
+/**
+* Compute an ETag for a file's bytes.  Format: "sha256:<hex>".
+* Exposed so callers can compute the ETag for GET /api/profile responses.
+*/
+function computeFileEtag(bytes) {
+	return "sha256:" + createHash("sha256").update(bytes).digest("hex");
+}
+//#endregion
 //#region src/lib/server/projectContext.ts
 var PROFILE_FILENAME = "ai-profile.yaml";
 /**
@@ -17307,5 +17672,5 @@ function truncatePreview(text, capBytes = 256 * 1024) {
 	};
 }
 
-export { resolveProjectRoot as a, safeOutputPath as b, compileProfile as c, containsSecretLikeLiteral as d, createLockfileFile as e, deriveEffectivePermissions as f, loadProjectContext as l, normalizeSafety as n, parseProfileYaml as p, redactIfSecretLike as r, sha256Hex as s, truncatePreview as t, validateLockfileText as v };
-//# sourceMappingURL=projectContext-C4-xYqFg.js.map
+export { ProfileWriteError as P, containsSecretLikeLiteral as a, createLockfileFile as b, compileProfile as c, sha256Hex as d, deriveEffectivePermissions as e, computeFileEtag as f, validateProfileValue as g, renderProfileYaml as h, redactIfSecretLike as i, loadProjectContext as l, normalizeSafety as n, parseProfileYaml as p, resolveProjectRoot as r, safeOutputPath as s, truncatePreview as t, validateLockfileText as v, writeProfileAtomic as w };
+//# sourceMappingURL=projectContext-Cxsfz84C.js.map