@bakers-build/conductor 0.0.0-stage → 0.1.0-next.42

package/dist/src/cli/config-validation.d.ts

@@ -0,0 +1,12 @@
+import { type ConfigFileReport, type ConfigInventoryOptions, type ConfigReport } from '@bakers-build/core';
+/**
+ * Known addons and the CONDUCTOR slots each fills. An empty list means "known
+ * addon, fills no conductor slot" — a UI-only addon (BB-562) belongs in a
+ * conductor `addons[]` but contributes a cockpit tab, not a slot. Listing it is
+ * not cosmetic: an UNKNOWN specifier sets `addonsAreOpaque` below, which
+ * downgrades a genuinely missing remote/executor/workspace from
+ * `missing_required_key` to `unknown_value`.
+ */
+export declare const CONDUCTOR_ADDON_SLOTS: Record<string, string[]>;
+/** Resolve only documented generated wiring and primitive const bindings. Never execute code. */
+export declare function validateConfigSources(options: ConfigInventoryOptions, texts: Map<string, string | null>, files: ConfigFileReport[]): ConfigReport;

package/dist/src/cli/config-validation.js

@@ -0,0 +1,353 @@
+import { configRecheckCommand, inventoryConfig, shellQuote, } from '@bakers-build/core';
+import { ConfigSourceEditor } from './config-source-edit.js';
+/**
+ * Known addons and the CONDUCTOR slots each fills. An empty list means "known
+ * addon, fills no conductor slot" — a UI-only addon (BB-562) belongs in a
+ * conductor `addons[]` but contributes a cockpit tab, not a slot. Listing it is
+ * not cosmetic: an UNKNOWN specifier sets `addonsAreOpaque` below, which
+ * downgrades a genuinely missing remote/executor/workspace from
+ * `missing_required_key` to `unknown_value`.
+ */
+export const CONDUCTOR_ADDON_SLOTS = {
+    '@bakers-build/addon-remote-drupal': ['remote'],
+    '@bakers-build/addon-herdr': ['executor', 'workspace'],
+    '@bakers-build/addon-fake': ['remote', 'executor', 'workspace'],
+    '@bakers-build/addon-workspace-git': ['workspace'],
+    '@bakers-build/addon-claude': ['agent'],
+    '@bakers-build/addon-codex': ['agent'],
+    '@bakers-build/addon-grok': ['agent'],
+    '@bakers-build/addon-kimi': ['agent'],
+    '@bakers-build/addon-opencode': ['agent'],
+    '@bakers-build/addon-pi': ['agent'],
+    '@bakers-build/addon-ports': [],
+    '@bakers-build/addon-ports-cloudflare': [],
+    '@bakers-build/addon-ports-cloudflare-quick': [],
+    '@bakers-build/addon-ports-frp': [],
+    '@bakers-build/addon-bakers-ui': [],
+    '@bakers-build/addon-bakers-ui-artifacts': [],
+    '@bakers-build/addon-agents': [],
+    '@bakers-build/addon-auth-basic': [],
+    '@bakers-build/addon-ddev': [],
+    '@bakers-build/addon-deployment': [],
+    '@bakers-build/addon-docker-compose': [],
+    '@bakers-build/addon-dropsh': [],
+    '@bakers-build/addon-essentials': [],
+    '@bakers-build/addon-info': [],
+    '@bakers-build/addon-name-refs': [],
+    '@bakers-build/addon-track': [],
+    '@bakers-build/addon-workspace': [],
+};
+function validateConductorSources(options, editors, report) {
+    const recheck = configRecheckCommand((options.scope ?? 'all'), report.roots.project);
+    const localFile = report.files.find((candidate) => candidate.kind === 'local');
+    const localEditor = localFile ? editors.get(localFile.path) : undefined;
+    for (const file of report.files.filter((candidate) => candidate.selected && candidate.kind === 'conductor')) {
+        const editor = editors.get(file.path);
+        if (editor?.source.shape !== 'object')
+            continue;
+        const start = report.findings.length;
+        const add = (code, key, expected, property = editor.property(key), findingPath = file.path) => {
+            const unknown = code === 'unknown_value';
+            report.findings.push({
+                code,
+                severity: unknown ? 'warning' : 'error',
+                stage: 'schema',
+                path: findingPath,
+                key,
+                expected,
+                observed: unknown ? '[COMPUTED]' : (property?.value ?? null),
+                owner: 'project',
+                related: [],
+                statically_determined: property?.staticallyDetermined ?? false,
+                remediation: `${unknown ? 'Determine' : 'Set'} ${key} in ${shellQuote(findingPath)}, then run ${recheck}.`,
+                recheck,
+                ...(property ? { line: property.line, column: property.column } : {}),
+            });
+        };
+        for (const legacy of ['project', 'bb_workspace']) {
+            if (!editor.property(legacy))
+                continue;
+            add('misplaced_key', legacy, `Committed bakers.build identity belongs under bakers.${legacy === 'project' ? 'project' : 'workspace'}.`);
+            const finding = report.findings.at(-1);
+            if (finding)
+                finding.remediation = `Run bakers config upgrade --scope project, then ${recheck}.`;
+        }
+        const bakers = editor.property('bakers');
+        const bakersExpression = editor.expression('bakers');
+        if (bakers &&
+            (bakers.nodeType !== 'ObjectExpression' ||
+                (bakersExpression &&
+                    new ConfigSourceEditor(`export default ${bakersExpression};`).source
+                        .unknownKeys))) {
+            add('unsupported_source_shape', 'bakers', 'A statically inspectable bakers object without spreads is required.');
+            const finding = report.findings.at(-1);
+            if (finding)
+                finding.remediation = `Run bakers config upgrade --scope project, then ${recheck}.`;
+        }
+        const validateIdentity = (key) => {
+            const property = editor.property(key) ??
+                (key === 'conductor_id' ? editor.property('machine_id') : undefined);
+            const expression = property ? editor.expression(property.key) : undefined;
+            const generatedConductor = key === 'conductor_id' &&
+                /^(?:local\.(?:conductor_id|machine_id)\s*\?\?\s*)+(?:composedConductorId|composedMachineId)$/.test(expression ?? '') &&
+                /const composed(?:Conductor|Machine)Id\s*=/.test(editor.text) &&
+                /machine\.user_id/.test(editor.text) &&
+                /machine\.machine_id/.test(editor.text);
+            if (generatedConductor) {
+                if (!localEditor)
+                    return;
+                const localMatches = (expression ?? '').matchAll(/local\.(conductor_id|machine_id)\s*\?\?/g);
+                for (const match of localMatches) {
+                    const localKey = match[1];
+                    if (!localKey)
+                        continue;
+                    const override = localEditor.property(localKey);
+                    if (!override) {
+                        if (!localEditor.source.unknownKeys)
+                            continue;
+                        add('unknown_value', localKey, 'A nonempty effective conductor identity.', undefined, localFile?.path ?? file.path);
+                        return;
+                    }
+                    if (override.staticallyDetermined && override.value === null)
+                        continue;
+                    if (override.staticallyDetermined &&
+                        typeof override.value === 'string' &&
+                        override.value.trim() !== '')
+                        return;
+                    add(override.staticallyDetermined ? 'invalid_value' : 'unknown_value', localKey, 'A nonempty effective conductor identity.', override, localFile?.path ?? file.path);
+                    return;
+                }
+                return;
+            }
+            if (!property) {
+                add(editor.source.unknownKeys ? 'unknown_value' : 'missing_required_key', key, `A nonempty conductor ${key === 'bakers.project' ? 'project' : 'identity'}.`);
+            }
+            else if (property.staticallyDetermined &&
+                typeof property.value === 'string' &&
+                property.value.trim() !== '') {
+                return;
+            }
+            else {
+                add(property.staticallyDetermined ? 'invalid_value' : 'unknown_value', key, `A nonempty conductor ${key === 'bakers.project' ? 'project' : 'identity'}.`, property);
+            }
+        };
+        validateIdentity('bakers.project');
+        validateIdentity('conductor_id');
+        const addon = editor.property('addons');
+        const addonSlots = new Set();
+        let addonsAreOpaque = false;
+        if (addon) {
+            if (addon.nodeType !== 'ArrayExpression')
+                addonsAreOpaque = true;
+            else
+                for (let index = 0; index < (addon.arrayLength ?? 0); index++) {
+                    const entry = `addons[${index}]`;
+                    const specifier = editor.property(entry)?.value ??
+                        editor.property(`${entry}.use`)?.value;
+                    if (typeof specifier !== 'string')
+                        addonsAreOpaque = true;
+                    else {
+                        const contributions = CONDUCTOR_ADDON_SLOTS[specifier];
+                        if (!contributions)
+                            addonsAreOpaque = true;
+                        else
+                            for (const slot of contributions)
+                                addonSlots.add(slot);
+                    }
+                }
+        }
+        // The `agent` slot is intentionally excluded: agent ownership now belongs to
+        // machine.config.js (machine schema v3+). A conductor config that declares
+        // no agent slot or no agent-contributing addons is valid — machine.config.js
+        // provides the candidates at runtime. Existing pre-migration configs that
+        // still carry agent addons continue to validate until the conductor 0→1
+        // migration removes them.
+        for (const slot of ['remote', 'executor', 'workspace']) {
+            const property = editor.property(slot);
+            if (slot === 'workspace' &&
+                property?.staticallyDetermined &&
+                typeof property.value === 'string' &&
+                property.value.trim() !== '' &&
+                addonSlots.has('workspace'))
+                continue;
+            if (!property) {
+                if (addonSlots.has(slot))
+                    continue;
+                add(addon && addonsAreOpaque ? 'unknown_value' : 'missing_required_key', slot, `A conductor ${slot} plugin supplied by an explicit slot or known addon.`);
+                continue;
+            }
+            if (!property.staticallyDetermined) {
+                add('unknown_value', slot, `A conductor ${slot} plugin supplied by an explicit slot or known addon.`, property);
+                continue;
+            }
+            const descriptor = (prefix, kind) => {
+                const plugin = editor.property(`${prefix}.plugin`)?.value;
+                return ((typeof plugin === 'string' && plugin.trim() !== '') ||
+                    editor.property(`${prefix}.kind`)?.value === kind);
+            };
+            if (slot === 'agent' && property.nodeType === 'ArrayExpression') {
+                let unknownCandidate = false;
+                let invalidCandidate = (property.arrayLength ?? 0) === 0;
+                for (let index = 0; index < (property.arrayLength ?? 0); index++) {
+                    const prefix = `agent[${index}]`;
+                    const candidate = editor.property(prefix);
+                    const wrapped = editor.property(`${prefix}.agent`);
+                    if (!candidate?.staticallyDetermined ||
+                        wrapped?.staticallyDetermined === false)
+                        unknownCandidate = true;
+                    else if (!descriptor(prefix, 'agent') &&
+                        !descriptor(`${prefix}.agent`, 'agent'))
+                        invalidCandidate = true;
+                }
+                if (unknownCandidate)
+                    add('unknown_value', slot, `A conductor ${slot} plugin supplied by an explicit slot or known addon.`, property);
+                else if (invalidCandidate)
+                    add('invalid_value', slot, `A conductor ${slot} plugin supplied by an explicit slot or known addon.`, property);
+                continue;
+            }
+            if (property.nodeType !== 'ObjectExpression' || !descriptor(slot, slot))
+                add('invalid_value', slot, `A conductor ${slot} plugin supplied by an explicit slot or known addon.`, property);
+        }
+        const findings = report.findings.slice(start);
+        if (findings.some((finding) => finding.severity === 'error'))
+            file.state = 'partial';
+        else if (findings.some((finding) => finding.code === 'unknown_value'))
+            file.state = 'computed';
+    }
+}
+/** Resolve only documented generated wiring and primitive const bindings. Never execute code. */
+export function validateConfigSources(options, texts, files) {
+    const editors = new Map([...texts]
+        .filter((entry) => entry[1] !== null)
+        .map(([path, text]) => [path, new ConfigSourceEditor(text)]));
+    const resolved = new Set();
+    const global = files.find((f) => f.kind === 'connection');
+    const local = files.find((f) => f.kind === 'local');
+    const globalEditor = global ? editors.get(global.path) : undefined;
+    const localEditor = local ? editors.get(local.path) : undefined;
+    const primitive = (e, key) => {
+        const p = e?.property(key);
+        return p?.staticallyDetermined && p.value !== undefined
+            ? JSON.stringify(p.value)
+            : undefined;
+    };
+    const fallback = (localKey, defaultExpression) => {
+        const p = localEditor?.property(localKey);
+        if (!p || (p.staticallyDetermined && p.value === null))
+            return defaultExpression;
+        return primitive(localEditor, localKey);
+    };
+    let inherits = false;
+    for (const file of files) {
+        const e = editors.get(file.path);
+        if (!e)
+            continue;
+        const declarations = new Map();
+        for (const name of ['baseUrl', 'clientId', 'clientSecret', 'workspaceId']) {
+            const match = new RegExp(`const ${name} = ([^;]+);`).exec(e.text);
+            if (!match)
+                continue;
+            const value = primitive(new ConfigSourceEditor(`export default {value:${match[1]}};`), 'value');
+            if (value !== undefined)
+                declarations.set(name, value);
+        }
+        const isProject = file.kind === 'project-connection';
+        const generated = isProject &&
+            (e.text.includes('const connection = (await import(') ||
+                e.text.includes('const connection = await loadConnection();'));
+        if (generated) {
+            inherits ||= file.selected;
+            const auth = [...(globalEditor?.source.properties ?? [])]
+                .find(([key, p]) => /^plugins\[\d+\]\.plugin$/.test(key) &&
+                p.value === '@dropsh/plugin-oauth2')?.[0]
+                .replace(/\.plugin$/, '');
+            const values = {
+                baseUrl: fallback('base_url', primitive(globalEditor, 'site.base_url')),
+                workspaceId: fallback('workspace_id', primitive(globalEditor, 'workspace_id')),
+                clientId: fallback('oauth.client_id', auth ? primitive(globalEditor, `${auth}.with.client_id`) : undefined),
+                clientSecret: fallback('oauth.client_secret', auth
+                    ? primitive(globalEditor, `${auth}.with.client_secret`)
+                    : undefined),
+            };
+            for (const [name, value] of Object.entries(values))
+                if (value !== undefined)
+                    declarations.set(name, value);
+            for (const [key, name] of [
+                ['site.base_url', 'baseUrl'],
+                ['workspace_id', 'workspaceId'],
+            ]) {
+                const expr = e.expression(key);
+                if (expr === name ||
+                    expr ===
+                        `local.${name === 'baseUrl' ? 'base_url' : 'workspace_id'} ?? connection.${name === 'baseUrl' ? 'site.base_url' : 'workspace_id'}`) {
+                    const value = values[name];
+                    if (value !== undefined) {
+                        e.set(key, value);
+                        resolved.add(`${file.path}:${key}`);
+                    }
+                }
+            }
+            if (e.expression('plugins')?.includes('connection.plugins.map(') &&
+                globalEditor?.property('plugins')?.nodeType === 'ArrayExpression') {
+                e.set('plugins', globalEditor.expression('plugins'));
+                resolved.add(`${file.path}:plugins`);
+                if (auth)
+                    for (const [name, value] of [
+                        ['client_id', values.clientId],
+                        ['client_secret', values.clientSecret],
+                    ]) {
+                        const key = `${auth}.with.${name}`;
+                        e.set(key, value ?? 'unknownLocalValue');
+                        resolved.add(`${file.path}:${key}`);
+                    }
+            }
+        }
+        for (const key of [...e.source.properties.keys()]) {
+            const expression = e.expression(key);
+            let value = expression ? declarations.get(expression) : undefined;
+            if (expression === 'local.oauth?.client_secret')
+                value = primitive(localEditor, 'oauth.client_secret');
+            if (value !== undefined) {
+                e.set(key, value);
+                resolved.add(`${file.path}:${key}`);
+            }
+        }
+    }
+    const overlay = new Map(texts);
+    for (const [path, e] of editors)
+        overlay.set(path, e.text);
+    const report = inventoryConfig({ ...options, sourceTexts: overlay }).report;
+    validateConductorSources(options, editors, report);
+    // Literal values resolved from the local file are not secrets stored in the committed file.
+    report.findings = report.findings.filter((f) => !(f.code === 'misplaced_key' &&
+        f.key?.endsWith('client_secret') &&
+        resolved.has(`${f.path}:${f.key}`)));
+    // Project operations validate selected prerequisites, attributing defects to the real owner.
+    if (report.resolved_scopes.includes('project')) {
+        const hasProject = files.some((f) => f.kind === 'project-connection' && editors.has(f.path));
+        for (const layer of ['machine', 'connection']) {
+            if (layer === 'connection' && hasProject && !inherits)
+                continue;
+            const prerequisites = inventoryConfig({
+                ...options,
+                scope: layer,
+                sourceTexts: overlay,
+            }).report;
+            report.findings.push(...prerequisites.findings.filter((f) => !report.findings.some((p) => p.path === f.path && p.key === f.key && p.code === f.code)));
+        }
+    }
+    // Preserve real locations; offsets in the validation-only rendering are not source locations.
+    for (const f of report.findings) {
+        const raw = texts.get(f.path);
+        const p = raw && f.key ? new ConfigSourceEditor(raw).property(f.key) : undefined;
+        if (p) {
+            f.line = p.line;
+            f.column = p.column;
+        }
+        else {
+            delete f.line;
+            delete f.column;
+        }
+    }
+    return report;
+}

package/dist/src/cli/migrate-addon-names.d.ts

@@ -0,0 +1,82 @@
+/** Suffix of the pre-rewrite backup a real (non-dry) rewrite leaves behind. */
+export declare const ADDON_RENAME_BAK_SUFFIX = ".pre-addon-rename.bak";
+/**
+ * The 14 addon packages renamed by BB-224 (spec v3 decision 14), including
+ * the BB-220 `pi` agent addon merged in from develop. A CLOSED
+ * set — the pass rewrites only these exact specifiers, so an unknown
+ * `@bakers-build/plugin-something` is left alone rather than silently retargeted at a
+ * package that does not exist.
+ */
+export declare const RENAMED_ADDONS: readonly ["auth-basic", "claude", "codex", "deployment", "dropsh", "essentials", "fake", "bakers-ui", "herdr", "kimi", "opencode", "pi", "remote-drupal", "workspace-git"];
+/**
+ * Where each export of the host barrels lives now — the DELETED
+ * `@bakers-build/core/plugins` and (BB-230) the meta package's
+ * `@bakers-build/bakers/plugins`, which is unresolvable from a dev-clone install.
+ *
+ * The key set is the barrel's own export list — `core/src/plugins/registry-exports.ts`
+ * as of the commit that deleted it — re-pointed at the addon that owns each
+ * factory today. `defaultExport` records whether the target package
+ * DEFAULT-exports exactly that factory; when it does, the descriptor's `export:`
+ * becomes redundant and is dropped.
+ *
+ * Deliberately absent, so they are left untouched:
+ *   - `selectRemote`/`selectWorkspace`/`selectExecutor`/`selectAgent(s)` — moved
+ *     to `@bakers-build/conductor/contract`, but they are config-shape SELECTORS, not
+ *     plugin factories, so no descriptor can legitimately name them;
+ *   - any other/unknown export name — a config naming one is reported by the
+ *     loader rather than silently retargeted at a package that may not have it.
+ */
+export declare const CORE_PLUGINS_BARREL_EXPORTS: Readonly<Record<string, {
+    target: string;
+    defaultExport: boolean;
+}>>;
+/**
+ * The host-barrel specifiers a descriptor may name. Both map through
+ * `CORE_PLUGINS_BARREL_EXPORTS`: `@bakers-build/core/plugins` is DELETED, and
+ * `@bakers-build/bakers/plugins` (BB-230) is unresolvable from a dev-clone install
+ * because the meta package that exports it is the workspace's leaf sink.
+ */
+export declare const HOST_BARREL_PATHS: readonly ["@bakers-build/core/plugins", "@bakers-build/bakers/plugins"];
+/** Which surface a config file speaks — decides the ambiguous builtins mapping. */
+export type ConfigSurface = 'connection' | 'engine';
+/**
+ * Rewrite the legacy specifiers in one config's SOURCE TEXT — all of them: the
+ * renamed `@bakers-build/plugin-*` packages, the deleted `@bakers-build/core/builtins`
+ * preset, and the host-barrel descriptors naming either `@bakers-build/core/plugins`
+ * (deleted) or `@bakers-build/bakers/plugins` (BB-230). Pure; line
+ * count is preserved (every replacement is line-local), which is what lets the
+ * reported diff be a plain index-aligned line diff.
+ */
+export declare function migrateAddonNames(text: string, surface: ConfigSurface): {
+    text: string;
+    count: number;
+};
+/** The outcome of the rename pass over a single config file. */
+export interface AddonRenameResult {
+    /** Report line, in the shape of the other upgrade steps. */
+    action: string;
+    /** `- old` / `+ new` lines for the rewritten specifiers. */
+    diff: string[];
+    /** Number of rewritten specifiers. */
+    count: number;
+}
+/**
+ * Rename pass over ONE config file. Returns `undefined` when the file is absent
+ * or already on the new names (idempotency: no write, no backup, no report
+ * line — the file stays byte-identical).
+ */
+export declare function migrateAddonNamesInFile(path: string, surface: ConfigSurface, opts?: {
+    dryRun?: boolean;
+}): AddonRenameResult | undefined;
+/**
+ * Rename pass over every recognised config in the given `.bakers/` dirs (project
+ * + home). Emits report lines ONLY for files it actually rewrites, so an install
+ * already on `addon-*` adds no noise to the upgrade report.
+ */
+export declare function runAddonRenameMigration(opts?: {
+    bakersDirs: string[];
+    dryRun?: boolean;
+}): {
+    actions: string[];
+    changed: boolean;
+};