@astrosheep/keiyaku 2.9.8 → 2.9.10

package/build/core/seal.js

@@ -1,12 +1,12 @@
 import { FlowError } from "../flow-error.js";
 import { createGit, parseRevListOutput, wrapGitError } from "../git/core.js";
-import { KEIYAKU_FILE } from "../keiyaku.js";
-import { formatLedgerEntryCommitMessage } from "./entry.js";
-import { activeLedgerRef, appendWithRetry, readLedger } from "./ledger.js";
-import { refreshContractView } from "./contract-view.js";
-import { normalizeScopePattern, scopePathEvidence, } from "./scope.js";
-import { deriveContractState, isTerminalState } from "./status/lifecycle.js";
-import { casUpdateRefLog, createRefLogCommit } from "./ref-log.js";
+import { effectiveScope } from "./lifecycle-history.js";
+import { scopePathEvidence, } from "./scope.js";
+import { isTerminalState } from "./status/lifecycle.js";
+import { currentLifecycleState, lookupCurrentContract, readRepositoryLifecycle, } from "./repository-ledger/read-model.js";
+import { runLifecycle } from "./lifecycle-runner.js";
+import { taskNamespaceFromScope } from "./task/coordinate.js";
+export { effectiveScope } from "./lifecycle-history.js";
 function findBind(entries) {
     const bind = entries.find((entry) => entry.kind === "bind");
     if (!bind)
@@ -41,17 +41,6 @@ export function getFence(entries) {
 export async function receiptsAfterFence(cwd, entries, head = "HEAD") {
     return revList(cwd, getFence(entries), await resolveCommit(cwd, head));
 }
-export function effectiveScope(entries) {
-    const scope = [...findBind(entries).data.scope];
-    for (const entry of entries) {
-        if (entry.kind !== "amend" || !entry.data.scopeDelta)
-            continue;
-        for (const pattern of entry.data.scopeDelta.add) {
-            scope.push(pattern);
-        }
-    }
-    return scope;
-}
 async function resolveCommit(cwd, revision) {
     const git = createGit(cwd);
     try {
@@ -100,12 +89,37 @@ async function diffstat(cwd, from, to) {
     }
 }
 async function scopeViolations(cwd, paths, scope) {
-    const auditedPaths = paths.filter((changedPath) => changedPath !== KEIYAKU_FILE);
-    return (await scopePathEvidence(cwd, scope, auditedPaths)).filter((evidence) => !evidence.matched);
+    return (await scopePathEvidence(cwd, scope, paths)).filter((evidence) => !evidence.matched);
+}
+function taskNamespaceViolations(paths, scope) {
+    const taskPaths = paths.filter((path) => path.startsWith(".keiyaku/tasks/"));
+    if (taskPaths.length === 0)
+        return [];
+    const namespaces = scope.flatMap((term) => taskNamespaceFromScope(term) ?? []);
+    if (namespaces.length !== 1) {
+        throw new FlowError("INTERNAL_STATE", "accepted bind must carry exactly one contract task namespace");
+    }
+    const prefix = `.keiyaku/tasks/${namespaces[0]}/`;
+    return taskPaths
+        .filter((path) => !path.startsWith(prefix))
+        .map((path) => ({ path, patterns: [], matched: false, outcome: "no-positive-match" }));
+}
+async function acceptedBindScope(cwd, contract) {
+    const outcome = lookupCurrentContract(await readRepositoryLifecycle(cwd), contract);
+    if (outcome.status !== "healthy") {
+        throw new FlowError("INTERNAL_STATE", `cannot resolve accepted bind namespace for contract ${contract}`);
+    }
+    const bind = outcome.model.history.find(({ entry }) => entry.kind === "bind")?.entry;
+    if (!bind || bind.kind !== "bind")
+        throw new FlowError("INTERNAL_STATE", `contract ${contract} has no accepted bind entry`);
+    return bind.data.scope;
 }
 async function auditScope(cwd, entries, paths) {
     const scope = effectiveScope(entries);
-    const scopeViolationEvidence = await scopeViolations(cwd, paths, scope);
+    const scopeViolationEvidence = [
+        ...await scopeViolations(cwd, paths, scope),
+        ...taskNamespaceViolations(paths, findBind(entries).data.scope),
+    ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
     if (scopeViolationEvidence.length > 0) {
         throw new ScopeAuditError(findBind(entries).contract, scope, scopeViolationEvidence);
     }
@@ -115,29 +129,6 @@ async function auditScope(cwd, entries, paths) {
         scopeViolationEvidence,
     };
 }
-const APPEND_SCOPE_AMENDMENT = "Scope extended by lifecycle command.";
-export async function appendScopeTerms(input) {
-    if (!input.patterns || input.patterns.length === 0)
-        return null;
-    const patterns = input.patterns.map(normalizeScopePattern);
-    const at = new Date(input.nowMs).toISOString();
-    const result = await appendWithRetry(input.cwd, activeLedgerRef(input.contractId), (_head, entries) => {
-        assertOperable(input.contractId, entries);
-        return {
-            v: 1,
-            kind: "amend",
-            contract: input.contractId,
-            at,
-            actor: input.actor,
-            data: { amendment: APPEND_SCOPE_AMENDMENT, scopeDelta: { add: patterns } },
-        };
-    });
-    if (!result.ok) {
-        throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} active ledger disappeared while appending scope`);
-    }
-    await refreshContractView({ ledgerCwd: input.cwd, renderCwd: input.renderCwd, contractId: input.contractId });
-    return result.head;
-}
 export class ScopeAuditError extends FlowError {
     scopeViolationEvidence;
     constructor(_contractId, scope, evidence) {
@@ -154,15 +145,38 @@ export class ScopeAuditError extends FlowError {
         this.scopeViolationEvidence = evidence;
     }
 }
-function assertOperable(contractId, entries) {
-    const state = deriveContractState(entries);
-    if (state.state === "corrupt") {
-        throw new FlowError("INTERNAL_STATE", `contract ${contractId} is corrupt at entry ${state.at}: ${state.reason}`);
-    }
+function assertOperable(contractId, model) {
+    const state = currentLifecycleState(model);
     if (isTerminalState(state) || state.state === "petitioned") {
         throw new FlowError("INTERNAL_STATE", `contract ${contractId} cannot seal from state ${state.state}`);
     }
 }
+function currentFoldedSealArc(model) {
+    return model.seal === null ? model.intent.arc : null;
+}
+/** Current-read admission capture: scope and fence come only from the folded model. */
+export async function captureFoldedSeal(cwd, model, head = "HEAD", scopeAppend = []) {
+    const arc = currentFoldedSealArc(model);
+    if (arc === null)
+        return null;
+    const oldFence = model.pins.delivery;
+    const newFence = await resolveCommit(cwd, head);
+    const [receipts, paths, stat] = await Promise.all([
+        revList(cwd, oldFence, newFence),
+        changedPaths(cwd, oldFence, newFence),
+        diffstat(cwd, oldFence, newFence),
+    ]);
+    const effectiveScope = [...model.effectiveScope, ...scopeAppend];
+    const bind = model.history.find((row) => row.entry.kind === "bind")?.entry;
+    const scopeViolationEvidence = [
+        ...await scopeViolations(cwd, paths, effectiveScope),
+        ...taskNamespaceViolations(paths, bind?.kind === "bind" ? bind.data.scope : []),
+    ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
+    if (scopeViolationEvidence.length > 0) {
+        throw new ScopeAuditError(model.contract, effectiveScope, scopeViolationEvidence);
+    }
+    return { arc, oldFence, newFence, receipts, diffstat: stat, scopeAudit: { violations: [] }, scopeViolationEvidence };
+}
 /** Current seal intent: open explicit arc, else derived a0 while no explicit arc has ever existed. */
 export function currentSealArc(entries) {
     const open = findOpenArc(entries);
@@ -207,12 +221,12 @@ export async function previewSeal(cwd, entries, head = "HEAD") {
 export async function captureSeal(cwd, entries, head = "HEAD") {
     return (await previewSeal(cwd, entries, head)).capture;
 }
-/** Preserve original receipt hashes while auditing the rebased delivery content. */
-export async function captureRenewSeal(input) {
-    const arc = currentSealArc(input.entries);
-    if (arc === null)
+/** Folded renew capture: preserve receipt hashes while auditing rebased delivery content. */
+export async function captureFoldedRenewSeal(input) {
+    if (!input.receiptSegmentOpen)
         return null;
-    const oldFence = getFence(input.entries);
+    const arc = input.intent.arc;
+    const oldFence = input.deliveryFence;
     const [receiptHead, contentBase, contentHead] = await Promise.all([
         resolveCommit(input.cwd, input.receiptHead),
         resolveCommit(input.cwd, input.contentBase),
@@ -223,123 +237,116 @@ export async function captureRenewSeal(input) {
         changedPaths(input.cwd, contentBase, contentHead),
         diffstat(input.cwd, contentBase, contentHead),
     ]);
+    const scope = [...input.effectiveScope, ...input.pendingScopeOverlay];
+    const bindScope = await acceptedBindScope(input.cwd, input.contract);
+    const scopeViolationEvidence = [
+        ...await scopeViolations(input.cwd, paths, scope),
+        ...taskNamespaceViolations(paths, bindScope),
+    ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
+    if (scopeViolationEvidence.length > 0) {
+        throw new ScopeAuditError(input.contract, scope, scopeViolationEvidence);
+    }
     return {
         arc,
         oldFence,
         newFence: receiptHead,
         receipts,
         diffstat: stat,
-        ...await auditScope(input.cwd, input.entries, paths),
+        scopeAudit: { violations: [] },
+        scopeViolationEvidence,
     };
 }
 export async function sealCurrentArc(input) {
-    const ledger = await readLedger(input.cwd, input.contractId);
-    if (!ledger) {
-        throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} not found or not active`);
-    }
-    assertOperable(input.contractId, ledger.entries);
-    const capture = input.capture ?? await captureSeal(input.cwd, ledger.entries, "HEAD");
-    if (!capture)
-        return null;
-    const at = new Date(input.nowMs).toISOString();
-    const result = await appendWithRetry(input.cwd, activeLedgerRef(input.contractId), (_head, entries) => {
-        assertOperable(input.contractId, entries);
-        const currentArc = currentSealArc(entries);
-        if (currentArc === null)
-            return null;
-        // a0 is legal only while no explicit arc has ever existed; otherwise treat as concurrent change.
-        if (capture.arc === 0 && getMaxArc(entries) > 0) {
-            throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} changed while sealing arc a${capture.arc}`);
-        }
-        if (currentArc !== capture.arc || getFence(entries) !== capture.oldFence) {
-            throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} changed while sealing arc a${capture.arc}`);
-        }
-        const { scopeViolationEvidence: _scopeViolationEvidence, ...durableCapture } = capture;
-        return {
-            v: 2,
-            kind: "seal",
-            contract: input.contractId,
-            at,
-            actor: "engine",
-            data: { ...durableCapture, sealedBy: input.sealedBy },
-        };
-    });
-    if (!result.ok) {
-        throw new FlowError("INTERNAL_STATE", `failed to seal arc for ${input.contractId}: ${result.reason}`);
-    }
-    await refreshContractView({
-        ledgerCwd: input.cwd,
-        renderCwd: input.renderCwd,
+    const execution = await runLifecycle({
+        cwd: input.cwd,
         contractId: input.contractId,
-    });
-    return {
-        ...capture,
-        sealedBy: input.sealedBy,
-        ledgerHead: result.head,
-    };
-}
-function splitLedgerMessage(entry) {
-    const message = formatLedgerEntryCommitMessage(entry);
-    const separator = message.indexOf("\n\n");
-    return { subject: message.slice(0, separator), body: message.slice(separator + 2).trimEnd() };
-}
-export async function appendRenewSettlement(input) {
-    const ledger = await readLedger(input.cwd, input.contractId);
-    if (!ledger || ledger.head !== input.expectedLedgerHead) {
-        throw new FlowError("CONCURRENT_MODIFICATION", `contract ${input.contractId} changed while renewing`);
-    }
-    assertOperable(input.contractId, ledger.entries);
-    if (input.capture && (currentSealArc(ledger.entries) !== input.capture.arc || getFence(ledger.entries) !== input.capture.oldFence)) {
-        throw new FlowError("CONCURRENT_MODIFICATION", `contract ${input.contractId} changed while renewing`);
-    }
-    const at = new Date(input.nowMs).toISOString();
-    let parentHead = ledger.head;
-    let sealHead;
-    if (input.capture) {
-        const { scopeViolationEvidence: _evidence, ...durableCapture } = input.capture;
-        const sealEntry = {
-            v: 2,
-            kind: "seal",
-            contract: input.contractId,
-            at,
-            actor: "engine",
-            data: { ...durableCapture, newFence: input.newHead, sealedBy: "renew" },
-        };
-        const message = splitLedgerMessage(sealEntry);
-        sealHead = await createRefLogCommit(input.cwd, {
-            ...message,
-            parentHead,
-            errorLabel: `ledger seal ${input.contractId}`,
-        });
-        parentHead = sealHead;
-    }
-    const renewEntry = {
-        v: 1,
-        kind: "renew",
-        contract: input.contractId,
-        at,
-        actor: input.actor,
-        data: {
-            oldBase: input.oldBase,
-            newBase: input.newBase,
-            oldHead: input.oldHead,
-            newHead: input.newHead,
+        mutation: {
+            verb: "seal",
+            matchesAccepted: (transaction) => {
+                const accepted = transaction.entries.at(-1);
+                if (transaction.entries.length !== 1 || accepted?.kind !== "seal" || accepted.data.sealedBy !== input.sealedBy)
+                    return false;
+                if (input.capture === undefined)
+                    return true;
+                if (input.capture === null)
+                    return false;
+                const { scopeViolationEvidence: _evidence, ...durableCapture } = input.capture;
+                return JSON.stringify(accepted.data) === JSON.stringify({ ...durableCapture, sealedBy: input.sealedBy });
+            },
+        },
+        signal: input.signal,
+        admit: (session, replay) => {
+            assertOperable(input.contractId, session.lifecycle);
+            if (session.target.status !== "available")
+                throw new FlowError("INTERNAL_STATE", session.target.reason);
+            const transaction = replay.state === "verb-committed" ? replay.transaction : undefined;
+            const accepted = transaction?.entries.at(-1);
+            let existing;
+            if (accepted?.kind === "seal") {
+                existing = {
+                    transactionObjectId: transaction.transactionObjectId,
+                    capture: {
+                        arc: accepted.data.arc,
+                        oldFence: accepted.data.oldFence,
+                        newFence: accepted.data.newFence,
+                        receipts: [...accepted.data.receipts],
+                        diffstat: { ...accepted.data.diffstat },
+                        scopeAudit: { violations: [...accepted.data.scopeAudit.violations] },
+                        scopeViolationEvidence: [],
+                    },
+                };
+            }
+            return { lifecycle: session.lifecycle, targetRoot: session.target.root, ...(existing ? { existing } : {}) };
+        },
+        prepare: async (admission) => {
+            if (admission.business.existing)
+                return { capture: admission.business.existing.capture, existing: { transactionObjectId: admission.business.existing.transactionObjectId } };
+            return { capture: input.capture ?? await captureFoldedSeal(admission.business.targetRoot, admission.business.lifecycle, "HEAD") };
+        },
+        revalidate: ({ session, prepared }) => {
+            assertOperable(input.contractId, session.lifecycle);
+            if (prepared.existing) {
+                return session.repository.topology.nodes.some((node) => node.objectId === prepared.existing.transactionObjectId)
+                    ? undefined
+                    : { code: "SEAL_STATE_CHANGED", message: "accepted seal changed during replay preparation" };
+            }
+            if (!prepared.capture)
+                return;
+            const currentArc = currentFoldedSealArc(session.lifecycle);
+            if (currentArc !== prepared.capture.arc || session.lifecycle.pins.delivery !== prepared.capture.oldFence)
+                return { code: "SEAL_COORDINATES_CHANGED", message: `contract ${input.contractId} changed while sealing arc a${prepared.capture.arc}` };
+        },
+        effect: async ({ context, prepared }) => {
+            const capture = prepared.capture;
+            if (!capture)
+                return { kind: "refused-before-effects", authoritativeHead: context.session.lifecycle.observedLedgerHead, refusal: { code: "NO_OPEN_ARC", message: "no current arc requires sealing" } };
+            const at = new Date(input.nowMs).toISOString();
+            {
+                const { scopeViolationEvidence: _scopeViolationEvidence, ...durableCapture } = capture;
+                const entry = {
+                    v: 2,
+                    kind: "seal",
+                    contract: input.contractId,
+                    at,
+                    actor: "engine",
+                    data: { ...durableCapture, sealedBy: input.sealedBy },
+                };
+                const result = prepared.existing
+                    ? await context.replayCommitted({ transactionObjectId: prepared.existing.transactionObjectId })
+                    : await context.publishAuthoritative({ verb: "seal", admittedLedgerHead: context.session.lifecycle.observedLedgerHead, acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId, entries: [entry] });
+                if (result.status === "indeterminate")
+                    return { kind: "precommit-effects-only", authoritativeHead: result.currentHead ?? context.session.lifecycle.observedLedgerHead };
+                if (result.status !== "committed")
+                    return { kind: "refused-before-effects", authoritativeHead: result.currentHead ?? context.session.lifecycle.observedLedgerHead, refusal: { code: "LEDGER_CAS_CONFLICT", message: `contract ${input.contractId} changed while sealing` } };
+                return { kind: "committed", commit: result, entryKind: "seal", value: {
+                        ...capture,
+                        sealedBy: input.sealedBy,
+                        ledgerHead: result.transaction.entryObjectIds[result.transaction.entries.findIndex((candidate) => candidate.kind === "seal")],
+                    } };
+            }
         },
-    };
-    const message = splitLedgerMessage(renewEntry);
-    const renewHead = await createRefLogCommit(input.cwd, {
-        ...message,
-        parentHead,
-        errorLabel: `ledger renew ${input.contractId}`,
     });
-    if (!await casUpdateRefLog(input.cwd, activeLedgerRef(input.contractId), renewHead, ledger.head)) {
-        throw new FlowError("CONCURRENT_MODIFICATION", `contract ${input.contractId} changed while renewing`);
-    }
-    const sealed = input.capture ? {
-        ...input.capture,
-        newFence: input.newHead,
-        sealedBy: "renew",
-        ledgerHead: sealHead,
-    } : null;
-    return { ledgerHead: renewHead, sealed };
+    if (execution.kind === "noncommitted" || execution.kind === "contained")
+        return execution.outcome;
+    return execution.payload;
 }