@aiwg/cli 2026.10.3 → 2026.10.5

package/dist/src/artifacts/prebuilt-build-lock.js

@@ -1,17 +1,20 @@
 import { randomUUID } from 'node:crypto';
 import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { hostname } from 'node:os';
+export class DirectoryLockContentionError extends Error {
+}
 /**
  * Acquire a cross-process directory lock and return an ownership-safe release.
  *
- * The lock deliberately fails after a bounded wait instead of deleting a lock
- * that may belong to a slow but healthy package build.
+ * Package builds fail after a bounded wait. Maintenance can opt into recovery
+ * of owners proven dead on the same host; healthy or unknown owners are retained.
  */
 export async function acquireDirectoryLock(lockPath, options = {}) {
     const timeoutMs = options.timeoutMs ?? 180_000;
     const pollMs = options.pollMs ?? 100;
     const deadline = Date.now() + timeoutMs;
-    const token = `${process.pid}:${randomUUID()}`;
+    const token = `${process.pid}:${randomUUID()}:${hostname()}`;
     const ownerPath = path.join(lockPath, 'owner');
     await mkdir(path.dirname(lockPath), { recursive: true });
     while (true) {
@@ -29,8 +32,10 @@ export async function acquireDirectoryLock(lockPath, options = {}) {
         catch (error) {
             if (error.code !== 'EEXIST')
                 throw error;
+            if (options.reclaimDeadOwner && await reclaimDeadLock(lockPath))
+                continue;
             if (Date.now() >= deadline) {
-                throw new Error(`timed out waiting for build lock: ${lockPath}`);
+                throw new DirectoryLockContentionError(`timed out waiting for build lock: ${lockPath}`);
             }
             await new Promise((resolve) => setTimeout(resolve, pollMs));
         }
@@ -46,4 +51,42 @@ export async function acquireDirectoryLock(lockPath, options = {}) {
         await rm(lockPath, { recursive: true, force: true });
     };
 }
+/** Serialize stale-owner recovery so two waiters cannot remove a new lease. */
+async function reclaimDeadLock(lockPath) {
+    let release;
+    try {
+        release = await acquireDirectoryLock(`${lockPath}.recovery`, { timeoutMs: 0, reclaimDeadOwner: true });
+    }
+    catch (error) {
+        if (error instanceof DirectoryLockContentionError)
+            return false;
+        throw error;
+    }
+    try {
+        let owner;
+        try {
+            owner = (await readFile(path.join(lockPath, 'owner'), 'utf8')).trim();
+        }
+        catch {
+            return false;
+        }
+        const [pidText, , host] = owner.split(':');
+        const pid = Number(pidText);
+        if (host !== hostname() || !Number.isSafeInteger(pid) || pid <= 0)
+            return false;
+        try {
+            process.kill(pid, 0);
+            return false;
+        }
+        catch (error) {
+            if (error.code !== 'ESRCH')
+                return false;
+        }
+        await rm(lockPath, { recursive: true, force: true });
+        return true;
+    }
+    finally {
+        await release();
+    }
+}
 //# sourceMappingURL=prebuilt-build-lock.js.map

package/dist/src/artifacts/prebuilt-deployment.js

@@ -0,0 +1,46 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { resolveFrameworkCorpusRoot, resolveFrameworkIndexRoot } from './framework-index-paths.js';
+import { frameworkSourceDigest } from './framework-source-digest.js';
+import { selectPrebuiltRelations } from './relations.js';
+import { getFortemiCorePrebuiltStatus } from './fortemi-core-sync.js';
+import { loadFortemiCoreMetadataEntries } from './fortemi-core-query-adapter.js';
+/** The shipped search export is usable only while both it and its source-bound
+ * relationship projection validate. No local index or receipt is required. */
+export function loadPrebuiltDeploymentIndex(root, options = {}) {
+    if (options.strictRoot && !resolveFrameworkCorpusRoot(root))
+        return null;
+    root = resolveFrameworkIndexRoot(root);
+    if (!selectPrebuiltRelations(root).reader)
+        return null;
+    const status = getFortemiCorePrebuiltStatus('framework', root);
+    if (!status.built || status.stale || !status.generatedAt)
+        return null;
+    let stats;
+    try {
+        const manifest = JSON.parse(fs.readFileSync(status.manifestPath, 'utf8'));
+        const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+        if (manifest.package_version !== pkg.version || manifest.source_digest !== frameworkSourceDigest(root))
+            return null;
+        const text = fs.readFileSync(path.join(path.dirname(status.manifestPath), 'source-stats.json'), 'utf8');
+        if (createHash('sha256').update(text).digest('hex') !== manifest.source_stats_checksum)
+            return null;
+        stats = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const { entries } = loadFortemiCoreMetadataEntries(root, 'framework');
+    const byPath = Object.fromEntries(entries.map(entry => [entry.path, entry]));
+    if (!entries.length || entries.length !== status.itemCount || Object.keys(byPath).length !== entries.length)
+        return null;
+    const byType = {};
+    for (const entry of entries)
+        byType[entry.type] = (byType[entry.type] ?? 0) + 1;
+    if (stats.totalArtifacts !== entries.length || !stats.byType ||
+        Object.keys({ ...stats.byType, ...byType }).some(type => (stats.byType[type] ?? 0) !== (byType[type] ?? 0)))
+        return null;
+    return { index: { version: 'prebuilt', builtAt: status.generatedAt, buildTimeMs: 0, entries: byPath }, stats };
+}
+//# sourceMappingURL=prebuilt-deployment.js.map

package/dist/src/artifacts/prebuilt-relations.js

@@ -0,0 +1,80 @@
+/** Reproducible build-time binding/configuration projection. No deploy side effects. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { buildRelations } from './relations-builder.js';
+import { frameworkSourceDigest } from './framework-source-digest.js';
+import { PREBUILT_RELATIONS_DIR } from './relations.js';
+import { PROVIDER_IDS } from '../providers/provider-definitions.js';
+import { parseRuleFrontmatter, inferRuleActivation } from '../rules/activation.mjs';
+/** Sets describe the corpus projection before mode selection, tier filters or operator pins. */
+export function buildResolvedBindings(root, relations) {
+    const table = { schema_version: 'aiwg.bindings.resolved.v1', rules: {}, targets: relations.targets, providers: {} };
+    for (const provider of PROVIDER_IDS)
+        table.providers[provider] = { kernel: [], summary: [], native_paths: [], discoverable_paths: [], bound: [], on_demand: [] };
+    for (const [id, rule] of Object.entries(relations.rules)) {
+        const parsed = parseRuleFrontmatter(fs.readFileSync(path.join(root, rule.path), 'utf8'));
+        const tagged = Boolean(parsed.rule?.tagged);
+        const activation = tagged ? parsed.rule.activation : rule.type === 'behavior' ? 'kernel' : inferRuleActivation(rule.enforcement);
+        const targets = { skill: [], agent: [], flow: [], command: [] };
+        for (const target of rule.targets)
+            targets[target.type].push(target.id);
+        table.rules[id] = { activation, tagged, summary: parsed.rule?.summary ?? rule.summary, targets };
+        for (const [provider, projection] of Object.entries(table.providers)) {
+            if (activation === 'kernel') {
+                const hermesDeferred = provider === 'hermes' && tagged && String(parsed.rule?.enforcement ?? '').toLowerCase() !== 'critical';
+                projection[hermesDeferred ? 'summary' : 'kernel'].push(id);
+            }
+            else if (activation === 'paths')
+                projection[['claude', 'cursor'].includes(provider) ? 'native_paths' : 'discoverable_paths'].push(id);
+            else if (activation === 'bound')
+                projection.bound.push(id);
+            else if (activation === 'summary')
+                projection.summary.push(id);
+            else
+                projection.on_demand.push(id);
+        }
+    }
+    return table;
+}
+export function buildPrebuiltRelations(root, entries) {
+    const relations = buildRelations(entries);
+    const relationText = JSON.stringify(relations, null, 2);
+    const bindingText = JSON.stringify(buildResolvedBindings(root, relations), null, 2) + '\n';
+    const hash = (text) => createHash('sha256').update(text).digest('hex');
+    const stamp = {
+        schema_version: 'aiwg.relationships.prebuilt.v1',
+        package_version: JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version,
+        source_digest: frameworkSourceDigest(root, false), generated_at: relations.generatedAt,
+        checksums: { 'relations.json': hash(relationText), 'bindings.json': hash(bindingText) },
+    };
+    return { 'relations.json': relationText, 'bindings.json': bindingText, 'manifest.json': JSON.stringify(stamp, null, 2) + '\n' };
+}
+export function checkPrebuiltRelations(root) {
+    const dir = path.join(root, PREBUILT_RELATIONS_DIR);
+    const errors = [];
+    try {
+        const stamp = JSON.parse(fs.readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
+        if (stamp.schema_version !== 'aiwg.relationships.prebuilt.v1')
+            errors.push('unsupported relationship manifest schema');
+        if (stamp.package_version !== JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version)
+            errors.push('relationship package version differs');
+        if (stamp.source_digest !== frameworkSourceDigest(root, false))
+            errors.push('relationship source digest differs; run npm run release:fortemi-index');
+        for (const file of ['relations.json', 'bindings.json']) {
+            const text = fs.readFileSync(path.join(dir, file), 'utf8');
+            if (createHash('sha256').update(text).digest('hex') !== stamp.checksums[file])
+                errors.push(`${file} checksum differs`);
+            const table = JSON.parse(text);
+            if (file === 'bindings.json' && table.schema_version !== 'aiwg.bindings.resolved.v1')
+                errors.push('unsupported resolved binding table schema');
+            if (file === 'relations.json' && (table.version !== 1 || !table.artifacts || !table.rules || !table.targets))
+                errors.push('unsupported relationship table schema');
+        }
+    }
+    catch (error) {
+        errors.push(`relationship tables unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return errors;
+}
+//# sourceMappingURL=prebuilt-relations.js.map