@aiwg/cli 0.0.0-bootstrap.0 → 2026.7.17

package/dist/src/artifacts/operational-state.js

@@ -0,0 +1,239 @@
+/**
+ * Live-state provenance for operational memory records.
+ *
+ * The contract is intentionally allowlisted. Tracker credentials, request
+ * headers, arbitrary provider payloads, and URL query parameters never enter
+ * the Fortemi export. Records with incomplete source identity remain
+ * representable as `needs-source` so operators can retire or repair them.
+ *
+ * @issue #1827
+ */
+const CLASSIFICATIONS = new Set([
+    "fresh",
+    "historical",
+    "superseded",
+    "contradicted",
+    "needs-source",
+]);
+const CONFIDENCE = new Set([
+    "source",
+    "candidate",
+    "reviewed",
+    "rejected",
+]);
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function stringValue(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function isoValue(value) {
+    if (value instanceof Date) {
+        return Number.isNaN(value.getTime()) ? undefined : value.toISOString();
+    }
+    const candidate = stringValue(value);
+    if (!candidate)
+        return undefined;
+    const parsed = new Date(candidate);
+    return Number.isNaN(parsed.getTime()) ? undefined : parsed.toISOString();
+}
+function stringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const items = [...new Set(value.map(stringValue).filter((item) => Boolean(item)))].sort((left, right) => left.localeCompare(right));
+    return items.length > 0 ? items : undefined;
+}
+function evidencePathValue(value) {
+    const candidate = stringValue(value);
+    if (!candidate ||
+        candidate.includes("\0") ||
+        candidate.includes("\n") ||
+        candidate.includes("\r") ||
+        candidate.includes("?") ||
+        candidate.includes("#") ||
+        candidate.startsWith("/") ||
+        candidate.startsWith("\\") ||
+        candidate.split(/[\\/]/).includes("..")) {
+        return undefined;
+    }
+    return candidate;
+}
+/**
+ * Preserve an evidence locator without preserving URL credentials, query
+ * strings, or fragments. Non-HTTP(S) locators are not accepted here; local
+ * evidence belongs in `evidence_path`.
+ */
+export function sanitizeOperationalEvidenceUrl(value) {
+    const candidate = stringValue(value);
+    if (!candidate)
+        return undefined;
+    try {
+        const url = new URL(candidate);
+        if (url.protocol !== "https:" && url.protocol !== "http:")
+            return undefined;
+        url.username = "";
+        url.password = "";
+        url.search = "";
+        url.hash = "";
+        return url.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Parse the `operational_state` frontmatter block into the portable v2
+ * contract. Unknown keys are dropped by design.
+ */
+export function normalizeOperationalState(value) {
+    if (!isRecord(value))
+        return undefined;
+    const source_repo = stringValue(value.source_repo);
+    const source_kind = stringValue(value.source_kind);
+    const source_id = stringValue(value.source_id);
+    const observed_state = stringValue(value.observed_state);
+    const observed_at = isoValue(value.observed_at);
+    const source_updated_at = isoValue(value.source_updated_at);
+    const observer = stringValue(value.observer);
+    const evidence_url = sanitizeOperationalEvidenceUrl(value.evidence_url);
+    const evidence_path = evidencePathValue(value.evidence_path);
+    const supersedes = stringArray(value.supersedes);
+    const contradicts = stringArray(value.contradicts);
+    const stale_after = isoValue(value.stale_after);
+    const requestedClassification = stringValue(value.classification);
+    const completeSource = Boolean(source_repo && source_kind && source_id && observed_state && observed_at && observer);
+    const classification = !completeSource
+        ? "needs-source"
+        : requestedClassification && CLASSIFICATIONS.has(requestedClassification)
+            ? requestedClassification
+            : "historical";
+    const requestedConfidence = stringValue(value.confidence);
+    const confidence = requestedConfidence && CONFIDENCE.has(requestedConfidence)
+        ? requestedConfidence
+        : undefined;
+    return {
+        ...(source_repo ? { source_repo } : {}),
+        ...(source_kind ? { source_kind } : {}),
+        ...(source_id ? { source_id } : {}),
+        ...(observed_state ? { observed_state } : {}),
+        ...(observed_at ? { observed_at } : {}),
+        ...(source_updated_at ? { source_updated_at } : {}),
+        ...(evidence_url ? { evidence_url } : {}),
+        ...(evidence_path ? { evidence_path } : {}),
+        ...(observer ? { observer } : {}),
+        ...(supersedes ? { supersedes } : {}),
+        ...(contradicts ? { contradicts } : {}),
+        ...(stale_after ? { stale_after } : {}),
+        classification,
+        ...(confidence ? { confidence } : {}),
+        ...(typeof value.current_action_selector === "boolean"
+            ? { current_action_selector: value.current_action_selector }
+            : {}),
+    };
+}
+function sameSource(record, evidence) {
+    return (record.source_repo === evidence.source_repo &&
+        record.source_kind === evidence.source_kind &&
+        record.source_id === evidence.source_id);
+}
+function timeValue(value) {
+    if (!value)
+        return Number.NaN;
+    return new Date(value).getTime();
+}
+export function classifyOperationalState(record, evidence, now = new Date()) {
+    if (!record.source_repo ||
+        !record.source_kind ||
+        !record.source_id ||
+        !record.observed_state ||
+        !record.observed_at ||
+        !record.observer) {
+        return {
+            classification: "needs-source",
+            reason: "record lacks complete live-source identity or observation metadata",
+        };
+    }
+    if (evidence && sameSource(record, evidence)) {
+        if (record.contradicts?.includes(evidence.source_id) ||
+            record.observed_state !== evidence.observed_state) {
+            return {
+                classification: "contradicted",
+                reason: `remembered state '${record.observed_state}' conflicts with live state '${evidence.observed_state}'`,
+            };
+        }
+        const recordTime = timeValue(record.source_updated_at ?? record.observed_at);
+        const evidenceTime = timeValue(evidence.source_updated_at ?? evidence.observed_at);
+        if (Number.isFinite(recordTime) && Number.isFinite(evidenceTime) && evidenceTime > recordTime) {
+            return {
+                classification: "superseded",
+                reason: "newer authoritative evidence supersedes the remembered observation",
+            };
+        }
+        return {
+            classification: "fresh",
+            reason: "remembered state matches the supplied authoritative evidence",
+        };
+    }
+    if (record.stale_after && timeValue(record.stale_after) <= now.getTime()) {
+        return {
+            classification: "historical",
+            reason: "record passed its stale-after boundary and requires a live re-check",
+        };
+    }
+    if (record.current_action_selector === false || record.classification === "historical") {
+        return {
+            classification: "historical",
+            reason: "record is retained as history and is not a current action selector",
+        };
+    }
+    return {
+        classification: record.classification,
+        reason: "no fresh authoritative evidence was supplied; preserve the recorded classification",
+    };
+}
+export function compareOperationalStateRecords(records, evidence, now = new Date()) {
+    const evidenceBySource = new Map(evidence.map((item) => [`${item.source_repo}\u0000${item.source_kind}\u0000${item.source_id}`, item]));
+    return records
+        .map(({ id, operational_state }) => {
+        if (!operational_state) {
+            return {
+                record_id: id,
+                classification: "needs-source",
+                reason: "record has no operational_state provenance block",
+                requires_live_check: true,
+            };
+        }
+        const key = `${operational_state.source_repo ?? ""}\u0000${operational_state.source_kind ?? ""}\u0000${operational_state.source_id ?? ""}`;
+        const live = evidenceBySource.get(key);
+        const classified = classifyOperationalState(operational_state, live, now);
+        return {
+            record_id: id,
+            ...(operational_state.source_id ? { source_id: operational_state.source_id } : {}),
+            classification: classified.classification,
+            ...(operational_state.observed_state
+                ? { remembered_state: operational_state.observed_state }
+                : {}),
+            ...(live ? { live_state: live.observed_state } : {}),
+            reason: classified.reason,
+            requires_live_check: !live,
+        };
+    })
+        .sort((left, right) => (left.source_id ?? left.record_id).localeCompare(right.source_id ?? right.record_id) ||
+        left.record_id.localeCompare(right.record_id));
+}
+export function operationalStateQueryProjection(record, now = new Date()) {
+    const classified = classifyOperationalState(record, undefined, now);
+    const current = classified.classification === "fresh" && record.current_action_selector === true;
+    return {
+        classification: classified.classification,
+        current,
+        requires_live_check: true,
+        ...(record.source_id ? { source_id: record.source_id } : {}),
+        ...(record.observed_state ? { observed_state: record.observed_state } : {}),
+        ...(record.observed_at ? { observed_at: record.observed_at } : {}),
+    };
+}
+//# sourceMappingURL=operational-state.js.map

package/dist/src/artifacts/prebuilt-build-lock.js

@@ -0,0 +1,49 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+/**
+ * Acquire a cross-process directory lock and return an ownership-safe release.
+ *
+ * The lock deliberately fails after a bounded wait instead of deleting a lock
+ * that may belong to a slow but healthy package build.
+ */
+export async function acquireDirectoryLock(lockPath, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 180_000;
+    const pollMs = options.pollMs ?? 100;
+    const deadline = Date.now() + timeoutMs;
+    const token = `${process.pid}:${randomUUID()}`;
+    const ownerPath = path.join(lockPath, 'owner');
+    await mkdir(path.dirname(lockPath), { recursive: true });
+    while (true) {
+        try {
+            await mkdir(lockPath);
+            try {
+                await writeFile(ownerPath, `${token}\n`, { mode: 0o600 });
+            }
+            catch (error) {
+                await rm(lockPath, { recursive: true, force: true });
+                throw error;
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            if (Date.now() >= deadline) {
+                throw new Error(`timed out waiting for build lock: ${lockPath}`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollMs));
+        }
+    }
+    return async () => {
+        try {
+            if ((await readFile(ownerPath, 'utf8')).trim() !== token)
+                return;
+        }
+        catch {
+            return;
+        }
+        await rm(lockPath, { recursive: true, force: true });
+    };
+}
+//# sourceMappingURL=prebuilt-build-lock.js.map