@aopslabs/aops 0.2.0

package/dist/lib/setup-agent-assets-bridge.js

@@ -0,0 +1,176 @@
+export const SETUP_AGENT_ASSETS_CONTRACT = Object.freeze({
+    task: 'TASK-136',
+    surface: 'agent-assets-client-v1',
+    statusCommand: 'aops assets status --verify quick --json',
+    installCommand: 'aops assets install --target all --apply --json',
+    repairCommand: 'aops assets repair --repair-bindings --apply --json',
+    transitionRemovalCondition: 'Satisfied by the native TASK-136 provider composed after TASK-137; never route through setup agent-assets.',
+});
+export const SETUP_AGENT_ASSETS_GATEWAYS = Object.freeze({
+    codex: '<codex-home>/skills/aops/SKILL.md',
+    claude: '<claude-home>/skills/aops/SKILL.md',
+});
+export async function verifySetupAgentAssetsReleaseInput(verifyRelease, releaseRoot) {
+    return verifyRelease({ releaseRoot, verificationMode: 'offline' });
+}
+export function createSetupAgentAssetsProvider(dependencies = {}) {
+    const resolveRoots = dependencies.roots ?? resolveAgentAssetsRoots;
+    const readStatus = dependencies.readStatus ?? readAgentAssetsStoreStatus;
+    const inspectBindings = dependencies.inspectBindings ?? inspectRuntimeGatewayBindings;
+    const verifyRelease = dependencies.verifyRelease ?? verifyAndLoadCommunityCoreReleaseInput;
+    const applyCore = dependencies.applyCore ?? applyVerifiedCommunityCore;
+    const repairBindings = dependencies.repairBindings ?? repairAgentAssetRuntimeBindings;
+    const inspectLegacyPointers = dependencies.inspectLegacyPointers ?? inspectLegacyAopsPointers;
+    const migrateLegacyPointers = dependencies.migrateLegacyPointers ?? migrateLegacyAopsPointers;
+    const resolveRelease = dependencies.resolveRelease ?? resolveSetupAgentAssetsReleaseV1;
+    const inspect = async () => {
+        const roots = resolveRoots({});
+        const store = readStatus({ assetRoot: roots.assetRoot, verify: 'quick' });
+        const bindings = inspectBindings({
+            assetRoot: roots.assetRoot,
+            runtimeHomes: {
+                codex: roots.runtimeHomes.codex.absolutePath,
+                claude: roots.runtimeHomes.claude.absolutePath,
+            },
+        });
+        const states = AGENT_ASSET_RUNTIME_IDS.map((runtime) => bindings[runtime].state);
+        const recoveryReasons = store.recoveryReasons ?? [];
+        const storeDrift = recoveryReasons.length > 0;
+        const ready = store.state === 'ready' && !storeDrift && states.every((state) => state === 'ready');
+        const conflict = states.some((state) => state === 'ownership-conflict' || state === 'unsafe-path');
+        return Object.freeze({
+            availability: 'available',
+            state: ready ? 'ready' : conflict ? 'conflict' : 'action-required',
+            summary: ready
+                ? 'The verified AOPS core and all registered runtime gateways are ready.'
+                : conflict
+                    ? 'A global runtime gateway has an ownership or unsafe-path conflict.'
+                    : store.state === 'ready' && storeDrift
+                        ? 'The verified AOPS core remains usable, but authenticated staging or receipt drift requires inspection.'
+                        : store.state === 'ready'
+                            ? 'The verified AOPS core is ready, but one or more runtime bindings require repair.'
+                            : 'The verified global AOPS client core is not installed.',
+            nextActions: Object.freeze(ready
+                ? []
+                : conflict
+                    ? ['Inspect `aops assets status --verify full --json`; unknown user files are never overwritten.']
+                    : store.state === 'ready' && storeDrift
+                        ? ['Inspect `aops assets status --verify full --json` and reconcile only the reported managed recovery state.']
+                        : store.state === 'ready'
+                            ? ['Run `aops assets repair --repair-bindings --apply --json`.']
+                            : ['Run `aops assets install --target all --apply --json`.']),
+            data: Object.freeze({
+                store,
+                runtimeBindings: bindings,
+                recommendedAction: store.state === 'ready'
+                    ? storeDrift ? 'inspect-recovery' : 'repair'
+                    : 'install',
+            }),
+        });
+    };
+    return Object.freeze({
+        status: inspect,
+        async resolveRelease(options) {
+            return resolveRelease(options);
+        },
+        async apply(options) {
+            const roots = resolveRoots({});
+            const target = resolveAgentAssetTargetSelection(options.target);
+            const runtimeHomes = selectAgentAssetRuntimeHomes(target, {
+                codex: roots.runtimeHomes.codex.absolutePath,
+                claude: roots.runtimeHomes.claude.absolutePath,
+            });
+            if (options.action === 'install' || options.action === 'update') {
+                if (!options.fromRelease)
+                    throw new Error('setup_init_agent_assets_release_required_for_install');
+                const release = await verifySetupAgentAssetsReleaseInput(verifyRelease, options.fromRelease);
+                const classifications = inspectLegacyPointers({ assetRoot: roots.assetRoot, runtimeHomes });
+                const conflicts = classifications.filter((item) => (item.state !== 'absent'
+                    && item.state !== 'managed-ready'
+                    && item.state !== 'recognized-legacy') || (item.state === 'recognized-legacy' && !item.eligible));
+                if (conflicts.length > 0) {
+                    throw new Error(`setup_init_agent_assets_runtime_conflict:${conflicts.map((item) => `${item.runtime}:${item.state}`).join(',')}`);
+                }
+                const legacyRuntimes = new Set(classifications
+                    .filter((item) => item.state === 'recognized-legacy')
+                    .map((item) => item.runtime));
+                const directRuntimeHomes = Object.freeze(Object.fromEntries(target.runtimes
+                    .filter((runtime) => !legacyRuntimes.has(runtime))
+                    .map((runtime) => [runtime, runtimeHomes[runtime]])));
+                await applyCore({
+                    assetRoot: roots.assetRoot,
+                    release,
+                    requestedOperation: options.action,
+                    runtimeHomes: directRuntimeHomes,
+                });
+                if (legacyRuntimes.size > 0) {
+                    await migrateLegacyPointers({
+                        assetRoot: roots.assetRoot,
+                        runtimeHomes: Object.freeze(Object.fromEntries(target.runtimes
+                            .filter((runtime) => legacyRuntimes.has(runtime))
+                            .map((runtime) => [runtime, runtimeHomes[runtime]]))),
+                    });
+                }
+            }
+            else {
+                await repairBindings({
+                    assetRoot: roots.assetRoot,
+                    runtimeHomes,
+                });
+            }
+            return inspect();
+        },
+    });
+}
+function normalizeProviderStatus(status) {
+    if (status.availability !== 'available') {
+        throw new Error('setup_agent_assets_provider_contract_invalid');
+    }
+    return Object.freeze({
+        ...status,
+        nextActions: Object.freeze([...status.nextActions]),
+        data: Object.freeze({
+            ...status.data,
+            surface: SETUP_AGENT_ASSETS_CONTRACT.surface,
+            gatewayDestinations: SETUP_AGENT_ASSETS_GATEWAYS,
+            legacyRepoMirrorInstallerUsed: false,
+        }),
+    });
+}
+export async function inspectSetupAgentAssets(provider) {
+    if (!provider) {
+        return Object.freeze({
+            availability: 'task-136-pending',
+            state: 'action-required',
+            summary: 'The canonical global AOPS agent-assets client is not available in this build yet.',
+            nextActions: Object.freeze([
+                'Complete TASK-136 on the TASK-137 merge base, then run `aops assets status --verify quick --json`.',
+            ]),
+            data: Object.freeze({
+                task: SETUP_AGENT_ASSETS_CONTRACT.task,
+                surface: SETUP_AGENT_ASSETS_CONTRACT.surface,
+                gatewayDestinations: SETUP_AGENT_ASSETS_GATEWAYS,
+                legacyRepoMirrorInstallerUsed: false,
+                transitionRemovalCondition: SETUP_AGENT_ASSETS_CONTRACT.transitionRemovalCondition,
+            }),
+        });
+    }
+    return normalizeProviderStatus(await provider.status());
+}
+export async function applySetupAgentAssets(provider, options) {
+    if (!provider?.apply) {
+        throw new Error('setup_init_agent_assets_contract_unavailable_task_136');
+    }
+    return normalizeProviderStatus(await provider.apply({
+        ...options,
+        target: 'all',
+    }));
+}
+import { verifyAndLoadCommunityCoreReleaseInput } from './agent-assets/release-input.js';
+import { resolveAgentAssetsRoots } from './agent-assets/roots.js';
+import { inspectRuntimeGatewayBindings } from './agent-assets/runtime-binding-reader.js';
+import { readAgentAssetsStoreStatus } from './agent-assets/store-reader.js';
+import { applyVerifiedCommunityCore, repairAgentAssetRuntimeBindings, } from './agent-assets/store-writer.js';
+import { inspectLegacyAopsPointers, migrateLegacyAopsPointers, } from './agent-assets/legacy-pointer-migration.js';
+import { resolveSetupAgentAssetsReleaseV1 } from './setup-agent-assets-release.js';
+import { AGENT_ASSET_RUNTIME_IDS, resolveAgentAssetTargetSelection, selectAgentAssetRuntimeHomes, } from './agent-assets/runtime-targets.js';

package/dist/lib/setup-agent-assets-release.js

@@ -0,0 +1,52 @@
+import { lstatSync, realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { resolveSetupOfficialCatalogReleaseV1, } from './setup-official-catalog-bridge.js';
+function localAgentAssetsReleaseRoot(candidate) {
+    if (!candidate)
+        return undefined;
+    const releaseRoot = path.resolve(candidate);
+    try {
+        const root = lstatSync(releaseRoot);
+        if (!root.isDirectory() || root.isSymbolicLink())
+            return undefined;
+        for (const name of ['agent-assets-release.json', 'agent-assets-release.sigstore.json']) {
+            const entry = lstatSync(path.join(releaseRoot, name));
+            if (!entry.isFile() || entry.isSymbolicLink())
+                return undefined;
+        }
+        const assets = lstatSync(path.join(releaseRoot, 'agent-assets'));
+        if (!assets.isDirectory() || assets.isSymbolicLink())
+            return undefined;
+        return realpathSync.native(releaseRoot);
+    }
+    catch {
+        return undefined;
+    }
+}
+function defaultBundledCandidates() {
+    const moduleDirectory = path.dirname(fileURLToPath(import.meta.url));
+    return Object.freeze([
+        path.resolve(moduleDirectory, '..', 'agent-assets-release'),
+        path.resolve(moduleDirectory, '..', '..', 'agent-assets-release'),
+    ]);
+}
+export function resolveBundledAgentAssetsReleaseV1(dependencies = {}) {
+    for (const candidate of (dependencies.bundledCandidates ?? defaultBundledCandidates)()) {
+        const fromRelease = localAgentAssetsReleaseRoot(candidate);
+        if (fromRelease)
+            return Object.freeze({ fromRelease, source: 'bundled-npm' });
+    }
+    return undefined;
+}
+export async function resolveSetupAgentAssetsReleaseV1(options = {}, dependencies = {}) {
+    const bundled = resolveBundledAgentAssetsReleaseV1(dependencies);
+    if (bundled)
+        return bundled;
+    try {
+        return await (dependencies.fallback ?? resolveSetupOfficialCatalogReleaseV1)(options);
+    }
+    catch {
+        throw new Error('agent_assets_verified_source_unavailable:reinstall_the_official_aops_cli_package_or_use_--from-release_as_an_offline_override');
+    }
+}

package/dist/lib/setup-external-postgres.js

@@ -0,0 +1,108 @@
+import { Client } from 'pg';
+import { loadExternalPostgresUrl } from './community-native-lifecycle.js';
+export class ExternalPostgresProbeError extends Error {
+    category;
+    constructor(code, category, options) {
+        super(code, options);
+        this.name = 'ExternalPostgresProbeError';
+        this.category = category;
+    }
+}
+export function isExternalPostgresTlsProbeError(error) {
+    return error instanceof ExternalPostgresProbeError && error.category === 'tls';
+}
+function safeProbeError(error) {
+    const record = error && typeof error === 'object' ? error : {};
+    const code = String(record.code ?? '');
+    const message = String(record.message ?? '').toLowerCase();
+    if (/ssl|tls|certificate|self[- ]signed|hostname|altname/.test(message) ||
+        ['CERT_HAS_EXPIRED', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'ERR_TLS_CERT_ALTNAME_INVALID',
+            'SELF_SIGNED_CERT_IN_CHAIN', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+            'UNABLE_TO_VERIFY_LEAF_SIGNATURE'].includes(code)) {
+        return new ExternalPostgresProbeError('setup_external_postgres_tls_connection_failed', 'tls', { cause: error });
+    }
+    if (code === '28P01' || code === '28000') {
+        return new ExternalPostgresProbeError('setup_external_postgres_auth_failed', 'auth', { cause: error });
+    }
+    if (code === '3D000') {
+        return new ExternalPostgresProbeError('setup_external_postgres_database_not_found', 'database', { cause: error });
+    }
+    if (['ECONNREFUSED', 'ECONNRESET', 'ENETUNREACH', 'ENOTFOUND', 'ETIMEDOUT'].includes(code)) {
+        return new ExternalPostgresProbeError('setup_external_postgres_unreachable', 'network', { cause: error });
+    }
+    return new ExternalPostgresProbeError('setup_external_postgres_connection_failed', 'unknown', { cause: error });
+}
+function prepareExternalPostgresUrl(value, tlsPolicy) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new ExternalPostgresProbeError('setup_external_postgres_url_invalid', 'database');
+    }
+    if ((url.protocol !== 'postgres:' && url.protocol !== 'postgresql:') ||
+        !url.hostname || !url.username || !url.password || !url.pathname.slice(1)) {
+        throw new ExternalPostgresProbeError('setup_external_postgres_url_invalid', 'database');
+    }
+    if (url.hash) {
+        throw new ExternalPostgresProbeError('setup_external_postgres_url_options_refused', 'database');
+    }
+    url.search = '';
+    if (tlsPolicy === 'disable') {
+        url.searchParams.set('sslmode', 'disable');
+    }
+    else if (tlsPolicy === 'require') {
+        url.searchParams.set('sslmode', 'require');
+        url.searchParams.set('uselibpqcompat', 'true');
+    }
+    else if (tlsPolicy === 'verify-full') {
+        url.searchParams.set('sslmode', 'verify-full');
+    }
+    else {
+        throw new ExternalPostgresProbeError('setup_external_postgres_tls_policy_invalid', 'tls');
+    }
+    return url.toString();
+}
+export async function probeExternalPostgresConnection(options, dependencies = {}) {
+    const requestedTimeout = Number(options.timeoutMs ?? 10_000);
+    const timeoutMs = Number.isFinite(requestedTimeout)
+        ? Math.min(Math.max(requestedTimeout, 500), 30_000)
+        : 10_000;
+    if (Boolean(options.configRef) === Boolean(options.repoUrl)) {
+        throw new ExternalPostgresProbeError('setup_external_postgres_source_required', 'database');
+    }
+    const connectionString = options.repoUrl
+        ? prepareExternalPostgresUrl(options.repoUrl, options.tlsPolicy)
+        : loadExternalPostgresUrl(options.configRef, options.tlsPolicy);
+    const createClient = dependencies.createClient
+        ?? ((config) => new Client(config));
+    const client = createClient({
+        connectionString,
+        connectionTimeoutMillis: timeoutMs,
+        query_timeout: timeoutMs,
+        statement_timeout: timeoutMs,
+    });
+    try {
+        await client.connect();
+        const inspected = await client.query("SELECT current_setting('server_version_num') AS server_version_num");
+        const serverMajor = Math.floor(Number(inspected.rows[0]?.server_version_num) / 10_000);
+        if (!Number.isSafeInteger(serverMajor) || serverMajor < 1) {
+            throw new Error('postgres_server_version_invalid');
+        }
+        const encrypted = options.tlsPolicy !== 'disable';
+        return Object.freeze({
+            status: 'ready',
+            tlsPolicy: options.tlsPolicy,
+            transport: encrypted ? 'encrypted' : 'unencrypted',
+            serverMajor,
+        });
+    }
+    catch (error) {
+        if (error instanceof ExternalPostgresProbeError)
+            throw error;
+        throw safeProbeError(error);
+    }
+    finally {
+        await client.end().catch(() => undefined);
+    }
+}