@am_shork/attest 0.4.3 → 0.6.0

package/dist/core/locate.js

@@ -20,7 +20,25 @@ const SKIP_DIRS = new Set([
     'archive',
 ]);
 export const isReqsFile = (name) => name.endsWith('.reqs.ts');
-export const isSpecFile = (name) => name.endsWith('.spec.ts');
+/**
+ * A spec belonging to a change that has not been agreed yet (design §7).
+ *
+ * The marker is in the **name** rather than the directory because the file
+ * already sits where it will live once the change is merged: a proposal's spec
+ * is written next to the code it attests, so its relative imports resolve
+ * identically before and after the merge, and merging renames it in place
+ * instead of moving it up a tree and rewriting every specifier.
+ */
+export const isProposedSpecFile = (name) => name.endsWith('.proposed.spec.ts');
+/**
+ * A spec belonging to the merged suite.
+ *
+ * Proposed specs are excluded here rather than at each call site, so the base
+ * scan, the base run and every reporting command are wrong together or not at
+ * all: a red scenario for behaviour nobody has implemented must not reach any
+ * of them until its gate passes.
+ */
+export const isSpecFile = (name) => name.endsWith('.spec.ts') && !isProposedSpecFile(name);
 /**
  * Recursively find files under root whose basename matches `match`.
  *
@@ -53,19 +71,29 @@ export async function findFiles(root, match) {
  * Find the registry and spec files under root in a **single** traversal.
  *
  * Calling findFiles once per pattern meant `check` walked the tree twice and
- * `archive` four times, over a tree that cannot change in between.
+ * `archive` four times, over a tree that cannot change in between. Proposed
+ * specs are collected in the same pass for that reason and kept in their own
+ * list: they are found everywhere the merged ones are, and no caller may reach
+ * them by accident.
  */
 export async function scanProject(root) {
-    const files = await findFiles(root, (n) => isReqsFile(n) || isSpecFile(n));
+    const files = await findFiles(root, (n) => isReqsFile(n) || isSpecFile(n) || isProposedSpecFile(n));
     const reqsFiles = [];
     const specFiles = [];
+    const proposedSpecFiles = [];
     for (const f of files) {
-        if (isReqsFile(basename(f)))
+        const name = basename(f);
+        // Sorted by `isSpecFile` rather than by `isProposedSpecFile`, so what makes
+        // a spec part of the merged suite is decided in exactly one place: the two
+        // predicates would otherwise both have to be right about the same file.
+        if (isReqsFile(name))
             reqsFiles.push(f);
-        else
+        else if (isSpecFile(name))
             specFiles.push(f);
+        else
+            proposedSpecFiles.push(f);
     }
-    return { reqsFiles, specFiles };
+    return { reqsFiles, specFiles, proposedSpecFiles };
 }
 /**
  * Read registries by **executing** the module through the Vite loader.
@@ -168,6 +196,12 @@ export function staticReader() {
  * prefix a duplicate-prefix ERROR.
  *
  * Pass `files` to reuse a {@link scanProject} result instead of re-walking.
+ *
+ * `prefixOwners` comes back with the registry because the rule deciding it —
+ * first claim wins, in sorted file order — must have exactly one spelling. It is
+ * what `duplicate-prefix` is computed from here, and what tells `--apply` which
+ * file an ADDED id belongs in (design §7); a second walk arriving at its own
+ * answer would be a second rule the moment either was edited.
  */
 export async function loadRegistry(root, reader, files) {
     const paths = files ?? (await scanProject(root)).reqsFiles;
@@ -182,6 +216,9 @@ export async function loadRegistry(root, reader, files) {
     // themselves can stay distinct forever while the space they share has two
     // owners. First seen in sorted file order, so which file is called the owner
     // does not depend on I/O timing.
+    // Absolute paths, so a caller that has to *write* to the owning file does not
+    // have to turn a display path back into one; the messages below relativise at
+    // the point they are built, which is where the reader's path belongs anyway.
     const prefixOwner = new Map();
     for (const entry of loaded) {
         const display = relativePath(root, entry.file);
@@ -195,13 +232,12 @@ export async function loadRegistry(root, reader, files) {
         // prefix would otherwise report the same sentence forty times.
         const reported = new Set();
         for (const [id, req] of Object.entries(outcome.registry)) {
-            const dash = id.indexOf('-');
-            const prefix = dash === -1 ? id : id.slice(0, dash);
+            const prefix = idPrefix(id);
             const owner = prefixOwner.get(prefix);
             if (owner === undefined) {
-                prefixOwner.set(prefix, display);
+                prefixOwner.set(prefix, entry.file);
             }
-            else if (owner !== display && !reported.has(prefix)) {
+            else if (owner !== entry.file && !reported.has(prefix)) {
                 reported.add(prefix);
                 // No `reqId`: this is about two files, not about any one of the
                 // requirements that happen to reveal it.
@@ -209,7 +245,7 @@ export async function loadRegistry(root, reader, files) {
                     level: 'ERROR',
                     code: 'duplicate-prefix',
                     file: display,
-                    message: `Id prefix "${prefix}-" is already declared by "${owner}". Give each registry file a prefix of its own.`,
+                    message: `Id prefix "${prefix}-" is already declared by "${relativePath(root, owner)}". Give each registry file a prefix of its own.`,
                 });
             }
             if (Object.hasOwn(registry, id)) {
@@ -226,7 +262,20 @@ export async function loadRegistry(root, reader, files) {
             }
         }
     }
-    return { registry, issues };
+    return { registry, issues, prefixOwners: Object.fromEntries(prefixOwner) };
+}
+/**
+ * The part of an id that names the space it lives in — `AUTH` of `AUTH-3`.
+ *
+ * The prefix is the only unit above the requirement (design §11) and two things
+ * now depend on agreeing about it: `duplicate-prefix`, and which file `--apply`
+ * writes an ADDED requirement into. An id with no dash is its own prefix, which
+ * cannot arise from `RequirementIdSchema` and is handled anyway because this
+ * also runs over ids a delta proposed.
+ */
+export function idPrefix(id) {
+    const dash = id.indexOf('-');
+    return dash === -1 ? id : id.slice(0, dash);
 }
 /**
  * Parse the given spec files into one merged plan (paths shown relative to
@@ -251,10 +300,36 @@ export async function parseSpecs(files, displayRoot) {
 export async function parseAllSpecFiles(root) {
     return parseSpecs(await findFiles(root, isSpecFile), root);
 }
-/** Parse the spec files belonging to a single proposed change (design §8). */
-export async function parseChangeSpecs(root, changeName) {
-    const dir = join(root, 'changes', changeName);
-    return parseSpecs(await findFiles(dir, isSpecFile), root);
+/**
+ * Spec-shaped files sitting under `root/changes` — the location a change's
+ * specs used to live at, and which nothing walks any more (design §7).
+ *
+ * Two correct decisions compose into a blind spot. `changes` is in `SKIP_DIRS`,
+ * so `scanProject` cannot reach these; and the explicit include `attest archive`
+ * once applied to `changes/<name>/specs/` went away with `changeExcludeGlobs`
+ * when specs moved to their merged location. A spec left here therefore executes
+ * in no suite and no gate, and the only command that says anything is the gate,
+ * blaming coverage for a file it cannot see.
+ *
+ * Walks through `findFiles` rather than a second walker: `SKIP_DIRS` is consulted
+ * for *sub*directories only, so starting the walk at `changes` itself both
+ * reaches these files and keeps skipping `node_modules` beneath them.
+ *
+ * Both spellings are wrong here and both are returned. A `*.spec.ts` is the
+ * pre-move layout; a `*.proposed.spec.ts` is the right marker at the wrong path,
+ * which is the half-done migration and no more visible than the other.
+ */
+export async function findChangeDirSpecs(root) {
+    try {
+        return await findFiles(join(root, 'changes'), (n) => isSpecFile(n) || isProposedSpecFile(n));
+    }
+    catch {
+        // No `changes/` at all — the ordinary case for a project with nothing in
+        // flight, and not a finding. Swallowed the same way `listChangeNames`
+        // swallows it, so the two cannot disagree about what a missing directory
+        // means.
+        return [];
+    }
 }
 /** List the names of proposed changes under `root/changes`. */
 export async function listChangeNames(root) {

package/dist/core/merge.d.ts

@@ -0,0 +1,54 @@
+import type { RegistryDelta } from './registry.js';
+import type { Issue, Registry } from './types.js';
+/** `x.proposed.spec.ts` -> `x.spec.ts`, in place. */
+export declare function mergedSpecPath(proposed: string): string;
+export interface MergeInputs {
+    root: string;
+    changeName: string;
+    delta: RegistryDelta;
+    /** The registry on disk, as the gate read it. */
+    base: Registry;
+    /**
+     * The registry the gate reached by applying the delta — the source of what
+     * gets written.
+     *
+     * Not `delta.added`, and the difference is the point: the delta holds the
+     * *authoring* shape, where `params` and `outOfScope` may be absent, while this
+     * is the schema-parsed result the gate actually gave its verdict on. Splicing
+     * from here means the bytes written to the registry are exactly the
+     * requirement that was proved green, rather than a second normalisation of it.
+     */
+    applied: Registry;
+    /** Prefix -> the absolute registry file that owns it (see `loadRegistry`). */
+    prefixOwners: Record<string, string>;
+    /**
+     * The proposed specs this change claims, absolute, each with the requirement
+     * ids it declares a scenario for.
+     *
+     * The ids are here because the rename is not the whole of merging a spec: one
+     * import has to be repointed from the change's delta at the registry, and
+     * *which* registry is decided by the prefix of the ids that spec attests.
+     */
+    claimedSpecs: {
+        file: string;
+        reqIds: string[];
+    }[];
+    /** Every merged spec on disk, absolute — what a rename could collide with. */
+    mergedSpecs: string[];
+}
+export interface MergeResult {
+    /** Refusals. Non-empty means **nothing was written**. */
+    issues: Issue[];
+    /** Paths touched, relative to root, in the order they were touched. */
+    written: string[];
+}
+/**
+ * Perform the merge, or refuse it whole.
+ *
+ * The caller must have run the gate in the same invocation and found it green;
+ * a merge that files a change as done without re-checking is the one thing this
+ * tool must not ship, because "done" having a hard definition is the whole
+ * claim.
+ */
+export declare function applyMerge(input: MergeInputs): Promise<MergeResult>;
+//# sourceMappingURL=merge.d.ts.map

package/dist/core/merge.js

@@ -0,0 +1,244 @@
+// Finishing the merge the gate approved (design §7, §8).
+//
+// `attest archive <change>` proves a delta is green, covered and drift-free, and
+// until now a human then transcribed it by hand with nothing checking the
+// transcription. This is that step, and the whole of why it is allowed to exist
+// where the `AGENTS.md` merge tool was not: the registry is a literal Attest
+// defines, so the result of an edit is checkable by re-reading it, and the edit
+// itself is a pure insertion (`splice.ts`).
+//
+// **It is re-runnable, not atomic.** No primitive spans one edit, N renames and
+// a directory move, and a scratch copy of the project root would have to be
+// swapped back through the same non-atomic set again. So instead every step is
+// derived from the tree as it currently is rather than reconciled against a
+// fixed list: a requirement already in the registry is not spliced, a spec
+// already renamed is not in `claimedSpecs`, and a change folder already moved is
+// not there to move. Running the command again after a failure finishes it.
+//
+// **The step order is a correctness constraint, pinned at both ends.**
+//
+// - *The splice goes first.* A renamed spec joins the base plan **unfiltered**,
+//   so its scenarios are read against the merged registry. Rename before splice
+//   and every one of them is an `orphan-test` naming an id the registry does not
+//   have yet — a tree `check` calls broken for a reason that is not the real one.
+// - *The folder move goes last.* `changes/<name>/` is the **input**. Move it
+//   first and a crash leaves a half-merged registry with no delta left to
+//   re-derive from, which is the one genuinely unrecoverable state in the design.
+//
+// The two steps between them are free. Nothing enforces this ordering but the
+// code below and ATX-53, which is why it is stated here as well: it is invisible
+// at runtime on the happy path, and a later reordering would look harmless.
+import { mkdir, readFile, rename, stat } from 'node:fs/promises';
+import { join, dirname, basename } from 'node:path';
+import { repointImport, spliceRequirements } from './splice.js';
+import { writeAtomic } from './write.js';
+import { idPrefix } from './locate.js';
+import { addedIds } from './apply.js';
+import { byCodeUnit } from './order.js';
+import { relativePath } from './paths.js';
+/** `x.proposed.spec.ts` -> `x.spec.ts`, in place. */
+export function mergedSpecPath(proposed) {
+    return join(dirname(proposed), basename(proposed).replace(/\.proposed\.spec\.ts$/, '.spec.ts'));
+}
+/**
+ * Why this merge cannot be performed mechanically, if it cannot.
+ *
+ * Every one of these is a refusal of the whole operation rather than a partial
+ * apply: the point of the command is that the gate's verdict now covers the step
+ * acting on it, and a merge that did the half it understood would put the file
+ * into a state no verdict describes.
+ */
+async function refusals(input) {
+    const issues = [];
+    const { delta, root, changeName } = input;
+    // 0) The destination already exists. Checked here, before anything is
+    // written, rather than at the move it is about: every refusal in this function
+    // leaves the tree untouched, and one that fired after two steps had landed
+    // would make "refused whole" a claim with an exception in it — which is the
+    // kind of claim nobody can rely on.
+    if (await exists(archivePath(input))) {
+        issues.push({
+            level: 'ERROR',
+            code: 'apply-unsupported-delta',
+            file: relativePath(root, archivePath(input)),
+            message: `${relativePath(root, archivePath(input))} already exists, so this change cannot be archived there. ` +
+                `Move or remove that directory, then run this command again.`,
+        });
+    }
+    // 1) Operations this does not perform. The gate applies all four in memory to
+    // reach its verdict; only writing them back is limited to ADDED, because
+    // REMOVED cannot say which comments belonged to the entry it deletes and
+    // MODIFIED is a formatting-preserving edit inside an existing literal. Both
+    // are the "destructive on a file the user cannot regenerate" shape.
+    const unsupported = [
+        delta.renamed?.length ? 'renamed' : '',
+        delta.removed?.length ? 'removed' : '',
+        Object.keys(delta.modified ?? {}).length ? 'modified' : '',
+    ].filter(Boolean);
+    if (unsupported.length > 0) {
+        issues.push({
+            level: 'ERROR',
+            code: 'apply-unsupported-delta',
+            file: relativePath(root, join(root, 'changes', changeName)),
+            message: `--apply writes back ADDED requirements only, and this change's delta also carries ${unsupported.join(', ')}. ` +
+                `The gate above still checked all of it — merge the remaining operations into the registry by hand, then run this command again to confirm.`,
+        });
+    }
+    // 2) An added id whose prefix no registry file claims. Which file it belongs
+    // in — or whether a file should be created for it — is not something the gate
+    // verified, and guessing would file a requirement somewhere nobody chose.
+    for (const id of unmergedAdded(input)) {
+        if (input.prefixOwners[idPrefix(id)] === undefined) {
+            issues.push({
+                level: 'ERROR',
+                code: 'apply-no-prefix-owner',
+                reqId: id,
+                message: `No registry file declares the "${idPrefix(id)}-" prefix, so --apply cannot tell where "${id}" belongs. ` +
+                    `Create the registry file for that prefix, or give the requirement a prefix an existing file already owns, then run this command again.`,
+            });
+        }
+    }
+    // 3) A rename that would land on a file that already exists. This is the one
+    // failure mode of this command that would destroy work rather than stop, so
+    // it is checked here as well as reported statically by `check`.
+    const taken = new Set(input.mergedSpecs);
+    for (const { file: spec } of input.claimedSpecs) {
+        const dest = mergedSpecPath(spec);
+        if (taken.has(dest)) {
+            issues.push({
+                level: 'ERROR',
+                code: 'proposed-spec-name-taken',
+                file: relativePath(root, spec),
+                message: `Merging ${relativePath(root, spec)} would rename it onto ${relativePath(root, dest)}, which already exists. ` +
+                    `Rename the proposed spec so its merged name is free — two spec files may sit beside the same module, but only one may hold each name.`,
+            });
+        }
+    }
+    // 4) A spec whose ids land in more than one registry file. Its delta import
+    // has to be repointed at *a* registry, and there is no single right answer —
+    // one import cannot serve two files, so this is a change that has to be split
+    // or merged by hand rather than one this can guess at.
+    for (const { file: spec, reqIds } of input.claimedSpecs) {
+        if (registryTargets(input, reqIds).length > 1) {
+            issues.push({
+                level: 'ERROR',
+                code: 'apply-unsupported-delta',
+                file: relativePath(root, spec),
+                message: `${relativePath(root, spec)} attests requirements that this change files into more than one registry file, ` +
+                    `so its import of the delta cannot be repointed at a single one. Split the spec by registry file, or merge this change by hand.`,
+            });
+        }
+    }
+    // By code, then by file. Concatenating the two into one key would let a long
+    // code and a short one collide across the boundary, so the order of a report
+    // could depend on where that seam happened to fall.
+    return issues.sort((a, b) => byCodeUnit(a.code, b.code) || byCodeUnit(a.file ?? '', b.file ?? ''));
+}
+/** The distinct registry files the given ids belong in, by prefix ownership. */
+function registryTargets(input, reqIds) {
+    const owners = reqIds
+        .map((id) => input.prefixOwners[idPrefix(id)])
+        .filter((f) => f !== undefined);
+    return [...new Set(owners)].sort(byCodeUnit);
+}
+/** The ids this change adds that the registry on disk does not have yet. */
+function unmergedAdded(input) {
+    return addedIds(input.delta).filter((id) => !Object.hasOwn(input.base, id));
+}
+/**
+ * Perform the merge, or refuse it whole.
+ *
+ * The caller must have run the gate in the same invocation and found it green;
+ * a merge that files a change as done without re-checking is the one thing this
+ * tool must not ship, because "done" having a hard definition is the whole
+ * claim.
+ */
+export async function applyMerge(input) {
+    const refused = await refusals(input);
+    if (refused.length > 0)
+        return { issues: refused, written: [] };
+    const { root } = input;
+    const written = [];
+    // --- 1) Splice, first. See the note at the top of this file.
+    const byFile = new Map();
+    for (const id of unmergedAdded(input)) {
+        const file = input.prefixOwners[idPrefix(id)];
+        const group = byFile.get(file) ?? {};
+        group[id] = input.applied[id];
+        byFile.set(file, group);
+    }
+    for (const file of [...byFile.keys()].sort(byCodeUnit)) {
+        const source = await readFile(file, 'utf8');
+        const spliced = spliceRequirements(file, source, byFile.get(file));
+        if (spliced === undefined) {
+            // Unreachable through the command — the gate read this file as a literal
+            // moments ago — so it is reported as the internal inconsistency it is
+            // rather than as a diagnosis about the user's registry.
+            return {
+                issues: [
+                    {
+                        level: 'ERROR',
+                        code: 'internal-error',
+                        file: relativePath(root, file),
+                        message: `${relativePath(root, file)} read as a registry for the gate but not for the merge.`,
+                    },
+                ],
+                written,
+            };
+        }
+        if (spliced !== source) {
+            await writeAtomic(file, spliced);
+            written.push(relativePath(root, file));
+        }
+    }
+    // --- 2) Repoint each claimed spec's delta import, then rename it in place.
+    //
+    // Repoint *before* rename, and that order is resumable rather than tidy. A
+    // crash between them leaves a proposed spec — still claimed, so still in this
+    // list next run — that already reads the registry, which step 1 has just
+    // written the id into; so the re-run's gate is green and the remaining rename
+    // happens. The other order leaves a merged spec that no longer appears in
+    // `claimedSpecs` at all, with a broken import nothing would come back for.
+    const deltaPath = join(root, 'changes', input.changeName, 'requirements.delta.ts');
+    const claimed = [...input.claimedSpecs].sort((a, b) => byCodeUnit(a.file, b.file));
+    for (const { file: spec, reqIds } of claimed) {
+        const target = registryTargets(input, reqIds)[0];
+        if (target) {
+            const source = await readFile(spec, 'utf8');
+            const repointed = repointImport(spec, source, deltaPath, target);
+            if (repointed !== source)
+                await writeAtomic(spec, repointed);
+        }
+        const dest = mergedSpecPath(spec);
+        await rename(spec, dest);
+        written.push(relativePath(root, dest));
+    }
+    // --- 3) Move the change folder, last.
+    const from = join(root, 'changes', input.changeName);
+    const to = archivePath(input);
+    if (await exists(from)) {
+        await mkdir(dirname(to), { recursive: true });
+        await rename(from, to);
+        written.push(relativePath(root, to));
+    }
+    return { issues: [], written };
+}
+/**
+ * Where a change is archived to. One function because two places ask — the
+ * refusal that checks it is free, and the move that performs it — and a date
+ * computed twice could straddle midnight and disagree with itself.
+ */
+function archivePath(input) {
+    const stamp = new Date().toISOString().slice(0, 10);
+    return join(input.root, 'archive', `${stamp}-${input.changeName}`);
+}
+async function exists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=merge.js.map

package/dist/core/pipeline.d.ts

@@ -120,15 +120,6 @@ export declare function runInit(root: string, names: readonly string[]): Promise
     files: string[];
     issues: Issue[];
 }>;
-/**
- * The globs that keep *other* proposals out of a change's gate run.
- *
- * Sibling names come from `readdir`, not from the guard above, so they are
- * escaped: a directory called `feat(auth)` pasted in raw is a *pattern*, it
- * matches nothing, and that sibling's specs silently join the run — quietly
- * widening the scope of the one check that decides "done".
- */
-export declare function changeExcludeGlobs(others: string[]): string[];
 export interface StatusResult {
     change: string;
     /** One row per added id, in id order. */
@@ -150,4 +141,17 @@ export interface StatusResult {
 export declare function runStatus(root: string, changeName: string, options?: ReadOptions): Promise<StatusResult>;
 /** Archive gate for a change (design §8, §9: `attest archive <change>`). */
 export declare function runArchive(root: string, changeName: string, options?: RunOptions): Promise<Issue[]>;
+/**
+ * The gate, and — only if it passes — the merge it approved
+ * (`attest archive <change> --apply`).
+ *
+ * The gate runs first and unconditionally, in this same call. A merge acting on
+ * an earlier run's verdict would let an unfinished change be filed as done, and
+ * "done" having a hard definition is the whole claim of the tool; so a red gate
+ * writes nothing, and there is no flag that skips it.
+ */
+export declare function runArchiveApply(root: string, changeName: string, options?: RunOptions): Promise<{
+    issues: Issue[];
+    written: string[];
+}>;
 //# sourceMappingURL=pipeline.d.ts.map