@amalgm/shell 0.1.85 → 0.1.87

package/dist/user-ground-host.js

@@ -5,7 +5,7 @@ import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep }
 import { buildUserHomeManifest, buildUserManifest, liveMachineStateDir, scopedAmalgmDir, shippedUserHomeDeclaration, } from "@amalgm/core/identity";
 import { CHUNK_BYTES, CONTENT_CONTRACT, INLINE_CARGO_MAX_BYTES, ENTITY_CLOUD_CONTRACT, ENTITY_CLOUD_SCHEMA_VERSION, artifactForRecord, canonicalVersion, checkContentManifest, classifyDirectory, classifyFile, classifyRegisteredRoot, createLocalEntityRecord, createEntityRecordAuthorityPort, convergeUserGround, createUserGroundEnrollmentPolicy, isRepositoryMetadataEntry, indexRepositoryTerritory, download as downloadArtifact, encodeEntityRecord, EntityApplyRail, EntityRecordRail, membershipHash, parseSnapshot, pathIsSuspect, privateEntityResourceId, rootReplacementFromRecords, sameRecords, snapshotFromRecords, stableJson, travelingRecords, upload as uploadArtifact, userGroundRecords, } from "@amalgm/live";
 import Database from "better-sqlite3";
-import { atomicCopy, atomicWrite, ensurePrivateDir } from "./filesystem.js";
+import { atomicCopy, atomicWrite, ensurePrivateDir, ensureUserDir } from "./filesystem.js";
 import { emitFilesStage, } from "./files-observability.js";
 import { EntityApplyHost, } from "./entity-apply-host.js";
 import { EntityRecordSqliteStore } from "./entity-record-store.js";
@@ -647,8 +647,11 @@ export class UserGroundHost {
         if (this.recordRail || this.recordStore)
             throw new Error("entity Record rail already started");
         await this.wire.open();
-        if (this.wire.protocolVersion < 4) {
-            throw new Error("gateway does not support the event-driven entity Record wire");
+        // One floor, no per-feature gates: this shell and its gateway release
+        // together, and the gateway ships first. 7 = one content contract and
+        // deterministic manifest keys.
+        if (this.wire.protocolVersion < 7) {
+            throw new Error("gateway speaks an older wire protocol than this shell");
         }
         const store = new EntityRecordSqliteStore(initializeDatabase(this.databasePath(identity)));
         const wireAuthority = createEntityRecordAuthorityPort({
@@ -970,16 +973,12 @@ export class UserGroundHost {
     }
     /** Send's small-cargo fast path: the record's sealed artifact rides the
      * submit frame itself, so one round trip carries record, manifest, and
-     * bytes. Only when the wire speaks protocol 5 and the local cache still
-     * proves the whole artifact within the inline bound; anything else
-     * returns null and the block upload path runs unchanged. */
+     * bytes. Only when the local cache still proves the whole artifact within
+     * the inline bound; anything else returns null and the block upload path
+     * runs unchanged. */
     readInlineCargo(identity, record) {
-        // Structure reuses the already-sealed artifact. This is a transfer law,
-        // independent of which wire version the authority speaks.
         if (record.change.cargo.length === 0)
             return [];
-        if (this.wire.protocolVersion < 5)
-            return null;
         const cache = this.cacheDir(identity);
         const inline = [];
         for (const artifact of record.change.cargo) {
@@ -1064,7 +1063,6 @@ export class UserGroundHost {
                     type: "private.entity-content.put",
                     resource_id: resourceId,
                     content_hash: artifact.contentHash,
-                    content_contract: manifest.contract,
                     kind: "chunk",
                     part_index: index,
                     part_count: manifest.chunks.length,
@@ -1094,7 +1092,6 @@ export class UserGroundHost {
                             type: "private.entity-content.inventory",
                             resource_id: resourceId,
                             content_hash: artifact.contentHash,
-                            content_contract: manifest.contract,
                             chunks: manifest.chunks,
                         }, ["private.entity-content.inventory-result"]));
                         manifestPresent = frame.complete === true;
@@ -1105,23 +1102,11 @@ export class UserGroundHost {
                     },
                     putChunk: async (_candidate, manifest, index, bytes) => putChunk(manifest, index, bytes),
                     putChunkBatch: async (_candidate, manifest, indexes, bytes) => {
-                        if (this.wire.protocolVersion < 3) {
-                            let offset = 0;
-                            for (const index of indexes) {
-                                const chunk = manifest.chunks[index];
-                                if (!chunk)
-                                    throw new Error(`content manifest has no chunk ${index}`);
-                                await putChunk(manifest, index, bytes.subarray(offset, offset + chunk.bytes));
-                                offset += chunk.bytes;
-                            }
-                            return;
-                        }
                         const encoded = await encodeContentWireBytes(bytes);
                         await retryContent(() => this.wire.requestBinary({
                             type: "private.entity-content.put-batch",
                             resource_id: resourceId,
                             content_hash: artifact.contentHash,
-                            content_contract: manifest.contract,
                             part_count: manifest.chunks.length,
                             chunks: indexes.map((index) => ({
                                 part_index: index,
@@ -1142,7 +1127,6 @@ export class UserGroundHost {
                             type: "private.entity-content.put",
                             resource_id: resourceId,
                             content_hash: artifact.contentHash,
-                            content_contract: manifest.contract,
                             kind: "manifest",
                             part_index: manifest.chunks.length,
                             part_count: manifest.chunks.length,
@@ -1213,7 +1197,29 @@ export class UserGroundHost {
             measurements: { journey: trace?.journey ?? "bootstrap", kind: artifact.kind },
         });
         const cache = { target: null };
+        // A cold artifact — no local manifest — is fetched whole in one round
+        // trip: get-artifact answers with the manifest and, for artifacts within
+        // the batch caps, every block packed in part order. Chunk reads then
+        // slice this buffer instead of paying a second round trip.
+        const prefetched = { bytes: null };
+        const sliceChunks = (packed, manifest, indexes) => {
+            const offsets = [];
+            let offset = 0;
+            for (const chunk of manifest.chunks) {
+                offsets.push(offset);
+                offset += chunk.bytes;
+            }
+            return Buffer.concat(indexes.map((index) => {
+                const chunk = manifest.chunks[index];
+                const start = offsets[index];
+                if (!chunk || start === undefined)
+                    throw new Error(`content manifest has no chunk ${index}`);
+                return packed.subarray(start, start + chunk.bytes);
+            }));
+        };
         const getChunk = async (manifest, index) => {
+            if (prefetched.bytes)
+                return sliceChunks(prefetched.bytes, manifest, [index]);
             const chunk = manifest.chunks[index];
             if (!chunk)
                 throw new Error(`content manifest has no chunk ${index}`);
@@ -1222,7 +1228,6 @@ export class UserGroundHost {
                 type: "private.entity-content.get",
                 resource_id: resourceId,
                 content_hash: artifact.contentHash,
-                content_contract: manifest.contract,
                 kind: "chunk",
                 part_index: index,
                 sha256: chunk.sha256,
@@ -1245,18 +1250,23 @@ export class UserGroundHost {
                     }
                     requests += 1;
                     const frame = await retryContent(() => this.wire.request({
-                        type: "private.entity-content.get",
+                        type: "private.entity-content.get-artifact",
                         resource_id: resourceId,
                         content_hash: artifact.contentHash,
-                        kind: "manifest",
-                        part_index: 0,
-                    }, ["private.entity-content.data"]), false, retryAttempts);
-                    const manifestBytes = verifiedFrameBytes(frame);
-                    downloadedBytes += manifestBytes.byteLength;
-                    const candidate = JSON.parse(manifestBytes.toString("utf8"));
-                    const checked = checkContentManifest(candidate, artifact.contentHash);
+                    }, ["private.entity-content.artifact"]), true, retryAttempts);
+                    const manifestJson = String(frame.manifest_json ?? "");
+                    downloadedBytes += Buffer.byteLength(manifestJson);
+                    const checked = checkContentManifest(JSON.parse(manifestJson), artifact.contentHash);
                     if (!checked.ok)
                         throw new Error(checked.error);
+                    if (frame.complete === true) {
+                        const decoded = await decodeContentWireBytes(binaryWireFrameBytes(frame), frame.content_encoding, Number(frame.bytes));
+                        if (decoded.byteLength !== checked.value.bytes) {
+                            throw new Error("artifact payload does not match its manifest");
+                        }
+                        prefetched.bytes = decoded;
+                        downloadedBytes += Number(frame.wire_bytes ?? frame.bytes);
+                    }
                     cache.target = new ContentCacheDownload(cacheDir, artifact, checked.value);
                     return checked.value;
                 },
@@ -1267,17 +1277,12 @@ export class UserGroundHost {
                 },
                 getChunk: async (_candidate, manifest, index) => getChunk(manifest, index),
                 getChunkBatch: async (_candidate, manifest, indexes) => {
-                    if (this.wire.protocolVersion < 3) {
-                        const chunks = [];
-                        for (const index of indexes)
-                            chunks.push(await getChunk(manifest, index));
-                        return Buffer.concat(chunks);
-                    }
+                    if (prefetched.bytes)
+                        return sliceChunks(prefetched.bytes, manifest, indexes);
                     const frame = await retryContent(() => this.wire.request({
                         type: "private.entity-content.get-batch",
                         resource_id: resourceId,
                         content_hash: artifact.contentHash,
-                        content_contract: manifest.contract,
                         chunks: indexes.map((index) => ({
                             part_index: index,
                             sha256: manifest.chunks[index]?.sha256,
@@ -1899,12 +1904,18 @@ function assertHealthyWatch(evidence, rootId) {
         throw new Error(`Watch coverage is not healthy for workspace ${rootId}: ${evidence.health.reason ?? "incomplete handle evidence"}`);
     }
 }
+/** Schema migration runs once per file per process. A converge opens this
+ * file over a dozen times; the file itself is never deleted by the host, so
+ * every later open needs only the connection and its pragmas. */
+const migratedDatabases = new Set();
 function initializeDatabase(file) {
     ensurePrivateDir(dirname(file));
     const database = new Database(file);
     database.pragma("busy_timeout = 5000");
     database.pragma("journal_mode = WAL");
     database.pragma("synchronous = FULL");
+    if (migratedDatabases.has(file))
+        return database;
     database.exec(`
     CREATE TABLE IF NOT EXISTS ground_identity (
       singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
@@ -2025,6 +2036,7 @@ function initializeDatabase(file) {
     }
     database.exec("DROP INDEX IF EXISTS record_inbox_delivery");
     database.exec("DROP TABLE IF EXISTS mutation_journal");
+    migratedDatabases.add(file);
     return database;
 }
 const GROUND_ROW_PROJECTION = `
@@ -2533,17 +2545,29 @@ function portableRecord(row) {
         transportVersion: derived ? null : row.transportVersion,
     };
 }
-function readPortableRecords(file, table) {
+/** The authenticated user's core ground: the unique active root workspace
+ * named by the canonical email, plus everything reachable from it by
+ * parent_uuid — the exact walk Live's convergence performs. Sibling
+ * workspace trees never leave SQLite; a bound root nested inside the core
+ * tree is still included because the walk follows parents, not root_uuid. */
+function coreGroundRecords(file, userEmail) {
     if (!existsSync(file))
         return [];
     const database = initializeDatabase(file);
     try {
         return database.prepare(`
+      WITH RECURSIVE core(uuid) AS (
+        SELECT uuid FROM entities
+         WHERE parent_uuid IS NULL AND type = 'workspace' AND status = 'active'
+           AND lower(name) = lower(?)
+        UNION
+        SELECT entities.uuid FROM entities JOIN core ON entities.parent_uuid = core.uuid
+      )
       SELECT uuid, type, parent_uuid AS parentUUID, name, status, version,
              payload_version AS payloadVersion,
              transport_version AS transportVersion
-        FROM ${table} ORDER BY uuid
-    `).all().map((record) => (record.type === "workspace" || record.type === "folder"
+        FROM entities WHERE uuid IN (SELECT uuid FROM core) ORDER BY uuid
+    `).all(userEmail).map((record) => (record.type === "workspace" || record.type === "folder"
             ? { ...record, payloadVersion: null, transportVersion: null }
             : record));
     }
@@ -2551,9 +2575,6 @@ function readPortableRecords(file, table) {
         database.close();
     }
 }
-function portableRecords(file) {
-    return readPortableRecords(file, "entities");
-}
 function capturedGroundRow(resourceId, rootUUID, row) {
     return {
         resourceId,
@@ -2758,7 +2779,7 @@ function localValue(identity, userRoot, database) {
         ...identity,
         localRoot: userRoot,
         sqlitePath: database,
-        records: portableRecords(database),
+        records: coreGroundRecords(database, identity.userEmail),
     };
 }
 function createDeclaredHome(input) {
@@ -4051,14 +4072,14 @@ async function materializeRecords(input) {
             if (record.type === "repo.git")
                 await materializeRepository(record, destination);
             else
-                ensurePrivateDir(destination);
+                ensureUserDir(destination);
         }
         else if (record.type === "folder") {
             if (pathExists(destination)) {
                 assertRepositoryBoundaryPath(record, relativePath, destination);
             }
             else {
-                ensurePrivateDir(destination);
+                ensureUserDir(destination);
             }
         }
         else if (record.type === "repo.git") {
@@ -4073,7 +4094,7 @@ async function materializeRecords(input) {
             }
             if (pathExists(destination))
                 throw new Error(`cloud materialization conflicts with ${relativePath}`);
-            ensurePrivateDir(dirname(destination));
+            ensureUserDir(dirname(destination));
             const binding = join(bindingDir, record.payloadVersion.toLowerCase());
             symlinkSync(relative(dirname(destination), binding), destination);
         }
@@ -4088,7 +4109,7 @@ async function materializeRecords(input) {
             const local = fileContent.get(artifact.contentHash);
             if (!local)
                 throw new Error(`cloud leaf ${record.uuid} content was not downloaded`);
-            ensurePrivateDir(dirname(destination));
+            ensureUserDir(dirname(destination));
             if (record.type === "link")
                 symlinkSync(readFileSync(local.file, "utf8"), destination);
             // Mode is not portable state: a fresh user file gets 0644, the same
@@ -4436,15 +4457,6 @@ function binaryWireFrameBytes(frame) {
     }
     return bytes;
 }
-/** Small control artifacts do not pass through Live's block verifier, so
- * their wire checksum is proven here once. */
-function verifiedFrameBytes(frame) {
-    const bytes = binaryFrameBytes(frame);
-    if (sha256Hex(bytes) !== String(frame.sha256 || "")) {
-        throw new Error("wire content bytes do not match their checksum");
-    }
-    return bytes;
-}
 /** Immutable content reads and writes are idempotent. Retry transient wire or
  * authority failures; reads additionally tolerate the brief not-found window
  * between an immutable object acknowledgement and globally visible R2 state. */