@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.140

package/dist/services/memory-repair-publication-plan.js

@@ -0,0 +1,160 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { MemoryRepairDocumentBaseline } from "./memory-repair-document-delta.js";
+const token = Symbol("retained-memory-repair-publication-plan");
+function refuse(reason) {
+    throw new AppError("memory_repair_publication_plan_invalid", "Retained publication metadata or bytes are inconsistent", 1, { reason, effect: "no_effect" });
+}
+function decode(value, limit) {
+    if (typeof value !== "string" || value.length > Math.ceil(limit / 3) * 4)
+        refuse("unbounded_or_invalid_bytes");
+    const bytes = Buffer.from(value, "base64");
+    if (bytes.length > limit || bytes.toString("base64") !== value)
+        refuse("noncanonical_retained_bytes");
+    return bytes;
+}
+function ordered(entries) {
+    return [...entries].sort((a, b) => {
+        const left = a.path.split("/"), right = b.path.split("/");
+        for (let index = 0; index < Math.min(left.length, right.length); index++) {
+            if (left[index] !== right[index])
+                return left[index] < right[index] ? -1 : 1;
+        }
+        return left.length - right.length;
+    });
+}
+/** Strict retained metadata decoder, not SQL/Session authority or permission
+ * to apply files. The publication owner must independently select its receipt.
+ * Restoration never captures today's partly published workspace as baseline.
+ */
+export class RetainedMemoryRepairPublicationPlan {
+    sha256;
+    #receipt;
+    #before;
+    #writePaths;
+    constructor(key, receipt, before) {
+        if (key !== token)
+            refuse("retained_plan_token_required");
+        this.#receipt = structuredClone(receipt);
+        this.#before = before;
+        this.#writePaths = JSON.parse(before.bytes().toString("utf8")).write_paths;
+        this.sha256 = hybridDigest(receipt);
+        Object.freeze(this);
+    }
+    static restore(bytes, expectedSha256) {
+        try {
+            if (!(bytes instanceof Uint8Array) || !bytes.length || bytes.length > 160 * 1024 * 1024
+                || typeof expectedSha256 !== "string" || !/^[a-f0-9]{64}$/.test(expectedSha256))
+                refuse("invalid_retained_plan");
+            const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+            if (!value || Object.keys(value).sort().join(",") !== "actions,after_base64,after_sha256,before_base64,before_sha256"
+                || !Array.isArray(value.actions) || value.actions.length > 20_000 || hybridDigest(value) !== expectedSha256
+                || !Buffer.from(JSON.stringify(value)).equals(Buffer.from(bytes)))
+                refuse("invalid_retained_plan");
+            const before = MemoryRepairDocumentBaseline.restore(decode(value.before_base64, 8 * 1024 * 1024), value.before_sha256);
+            const after = MemoryRepairDocumentBaseline.restore(decode(value.after_base64, 8 * 1024 * 1024), value.after_sha256);
+            const writes = JSON.parse(before.bytes().toString("utf8")).write_paths;
+            if (hybridDigest(writes) !== hybridDigest(JSON.parse(after.bytes().toString("utf8")).write_paths))
+                refuse("write_paths_changed");
+            const current = new Map(before.entries().map(entry => [entry.path, entry]));
+            const final = new Map(after.entries().map(entry => [entry.path, entry]));
+            const directories = new Set();
+            for (const entry of final.values())
+                if (entry.kind === "file") {
+                    const parts = entry.path.split("/");
+                    for (let length = 1; length < parts.length; length++)
+                        directories.add(parts.slice(0, length).join("/"));
+                }
+            const seen = new Set();
+            let total = 0;
+            for (const action of value.actions) {
+                if (!action || Object.keys(action).sort().join(",") !== "after,before,bytes_base64,path" || typeof action.path !== "string"
+                    || seen.has(action.path) || hybridDigest(action.before) !== hybridDigest(current.get(action.path) ?? null)
+                    || hybridDigest(action.after) !== hybridDigest(final.get(action.path) ?? null)
+                    || hybridDigest(action.before) === hybridDigest(action.after))
+                    refuse("invalid_retained_action");
+                seen.add(action.path);
+                if (action.after?.kind === "directory") {
+                    if (action.before || ![0o700, 0o755].includes(action.after.mode) || action.bytes_base64 !== null
+                        || !directories.has(action.path))
+                        refuse("unassigned_directory_action");
+                }
+                else {
+                    if (!writes.includes(action.path) || action.before?.kind === "directory"
+                        || action.after && action.after.kind !== "file")
+                        refuse("unassigned_file_action");
+                    if (action.after) {
+                        if (action.before ? action.before.mode !== action.after.mode : ![0o600, 0o644].includes(action.after.mode))
+                            refuse("file_mode_action");
+                        const content = decode(action.bytes_base64, 16 * 1024 * 1024);
+                        total += content.length;
+                        if (total > 64 * 1024 * 1024 || createHash("sha256").update(content).digest("hex") !== action.after.sha256
+                            || action.before?.sha256 === action.after.sha256)
+                            refuse("retained_output_bytes_changed");
+                    }
+                    else if (!action.before || action.bytes_base64 !== null)
+                        refuse("invalid_delete_action");
+                }
+                if (action.after) {
+                    const parent = action.path.slice(0, action.path.lastIndexOf("/"));
+                    if (current.get(parent)?.kind !== "directory")
+                        refuse("parent_action_out_of_order");
+                    current.set(action.path, action.after);
+                }
+                else
+                    current.delete(action.path);
+            }
+            if (hybridDigest(ordered(current.values())) !== hybridDigest(after.entries()))
+                refuse("unexplained_after_view");
+            return new RetainedMemoryRepairPublicationPlan(token, value, before);
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "memory_repair_publication_plan_invalid")
+                throw error;
+            return refuse("invalid_retained_plan");
+        }
+    }
+    actions() { return structuredClone(this.#receipt.actions); }
+    bytes() { return Buffer.from(JSON.stringify(this.#receipt)); }
+    output(logical) {
+        const action = this.#receipt.actions.find(item => item.path === logical && item.after?.kind === "file");
+        if (!action)
+            refuse("unselected_output");
+        return decode(action.bytes_base64, 16 * 1024 * 1024);
+    }
+    state(completed) {
+        if (!Number.isSafeInteger(completed) || completed < 0 || completed > this.#receipt.actions.length)
+            refuse("invalid_cursor");
+        const entries = new Map(this.#before.entries().map(entry => [entry.path, entry]));
+        for (const action of this.#receipt.actions.slice(0, completed)) {
+            if (action.after)
+                entries.set(action.path, action.after);
+            else
+                entries.delete(action.path);
+        }
+        const value = { schema_id: "dd-flow/memory-repair-document-baseline@1", entries: ordered(entries.values()), write_paths: this.#writePaths };
+        return MemoryRepairDocumentBaseline.restore(Buffer.from(JSON.stringify(value)), hybridDigest({ entries: value.entries, write_paths: value.write_paths }));
+    }
+    classify(workspace) {
+        const actual = MemoryRepairDocumentBaseline.capture(workspace, this.#writePaths);
+        const entries = new Map(actual.entries().map(entry => [entry.path, entry]));
+        let completed = 0, pending = false;
+        for (const action of this.#receipt.actions) {
+            const current = entries.get(action.path) ?? null;
+            if (hybridDigest(current) === hybridDigest(action.after)) {
+                if (pending)
+                    refuse("unknown_publication_prefix");
+                completed++;
+            }
+            else if (hybridDigest(current) === hybridDigest(action.before))
+                pending = true;
+            else
+                refuse("unknown_publication_prefix");
+        }
+        if (actual.sha256 !== this.state(completed).sha256)
+            refuse("unknown_publication_prefix");
+        return { completed, total: this.#receipt.actions.length,
+            status: completed === this.#receipt.actions.length ? "after" : completed === 0 ? "before" : "partial" };
+    }
+}

package/dist/services/memory-repair-publication-source.js

@@ -0,0 +1,225 @@
+import { AppError } from "../shared/errors.js";
+import { appendAudit } from "./audit.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { selectMemoryRepairGraph } from "./memory-repair-current-view.js";
+import { PreparedSettledMemoryRepair } from "./memory-repair-history.js";
+import { PreparedRegisteredMemoryCorrections } from "./memory-repair-registration.js";
+import { PreparedMemoryRepairWorkBaseline } from "./memory-repair-work-baseline.js";
+import { PreparedBoundMemoryRepairCopy } from "./memory-repair-writer-copy.js";
+const token = Symbol("memory-repair-publication-source"), event = "memory.repair_publication_source";
+const nonMemory = (entry) => entry.path !== ".memory-bank" && !entry.path.startsWith(".memory-bank/");
+function refuse(reason) {
+    throw new AppError("memory_repair_publication_source_invalid", "Publication source lacks independently settled custody", 1, { reason, effect: "no_effect" });
+}
+function retained(context, baseline) {
+    const scope = baseline.receipt();
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [scope.project_id, event, scope.run_id, scope.work_id, scope.generation]);
+    if (!rows.length)
+        return null;
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 40 * 1024 * 1024)
+        refuse("ambiguous_or_unbounded_source_receipt");
+    try {
+        const value = JSON.parse(rows[0].payload_json);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            refuse("invalid_source_receipt");
+        return value;
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("invalid_source_receipt");
+    }
+}
+function assertOwners(context, registration, baseline, copy, workSessionId) {
+    if (!(registration instanceof PreparedRegisteredMemoryCorrections))
+        refuse("registered_corrections_required");
+    if (!PreparedMemoryRepairWorkBaseline.isPrepared(baseline) || !PreparedBoundMemoryRepairCopy.isPrepared(copy))
+        refuse("registered_start_owners_required");
+    if (typeof workSessionId !== "string" || !workSessionId || workSessionId.length > 256)
+        refuse("registered_start_session_required");
+    registration.assertCustody(context);
+    baseline.assertRegisteredCustody(context);
+    copy.assertCommittedStartCustody(context, workSessionId);
+    const scope = baseline.receipt(), owner = registration.receipt(), input = copy.input();
+    if (scope.registration_sha256 !== registration.sha256 || scope.project_id !== owner.scope.project_id || scope.run_id !== owner.run_id
+        || scope.workspace_root !== copy.sourceRoot() || input.work_id !== scope.work_id || input.generation !== scope.generation
+        || input.baseline_registration_sha256 !== baseline.sha256)
+        refuse("foreign_start_owners");
+}
+function compose(start, histories, paths) {
+    if (!histories.length)
+        return start;
+    let current = histories[0].before().withWritePaths(paths);
+    const versions = new Set([hybridDigest(current.entries())]);
+    for (const history of histories) {
+        if (!versions.has(hybridDigest(history.before().entries())))
+            refuse("unexplained_peer_input_view");
+        current = current.composeSettledDelta(history.before(), history.after());
+        versions.add(hybridDigest(current.entries()));
+    }
+    if (!versions.has(hybridDigest(start.entries())))
+        refuse("unexplained_writer_start_view");
+    return current;
+}
+/** Running-Work shared before-view. Explicit registration records only source
+ * custody; it neither authorizes a private delta nor applies/settles anything.
+ * Retained restoration does not adopt current shared bytes after partial apply.
+ */
+export class PreparedMemoryRepairPublicationSource {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #graph in value;
+    }
+    sha256;
+    #registration;
+    #baseline;
+    #copy;
+    #workSessionId;
+    #graph;
+    #histories;
+    #before;
+    #body;
+    #registered = false;
+    constructor(key, registration, baseline, copy, workSessionId, graph, histories, before, startSha256) {
+        if (key !== token)
+            refuse("source_token_required");
+        this.#registration = registration;
+        this.#baseline = baseline;
+        this.#copy = copy;
+        this.#workSessionId = workSessionId;
+        this.#graph = structuredClone(graph);
+        this.#histories = histories;
+        this.#before = before;
+        const scope = baseline.receipt();
+        this.#body = { schema_id: "dd-flow/memory-repair-publication-source@1", project_id: scope.project_id, run_id: scope.run_id,
+            work_id: scope.work_id, generation: scope.generation, work_session_id: workSessionId,
+            registration_sha256: registration.sha256, baseline_registration_sha256: baseline.sha256, start_receipt_sha256: startSha256,
+            copy_input_sha256: hybridDigest(copy.input()), source_root: copy.sourceRoot(), selected: structuredClone(graph),
+            histories: histories.map(history => ({ work_id: history.workId, sha256: history.sha256 })),
+            before_sha256: before.sha256, before_base64: before.bytes().toString("base64") };
+        this.sha256 = hybridDigest(this.#body);
+        Object.freeze(this);
+    }
+    static #observe(context, registration, baseline, copy, workSessionId, states) {
+        assertOwners(context, registration, baseline, copy, workSessionId);
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const graph = context.db.readSnapshot(() => {
+            assertOwners(context, registration, baseline, copy, workSessionId);
+            const selected = selectMemoryRepairGraph(context, registration, baseline.workId, "running", states);
+            if (selected.generation !== baseline.receipt().generation)
+                refuse("foreign_source_generation");
+            return selected;
+        });
+        const histories = graph.settlements.map(item => PreparedSettledMemoryRepair.prepare(context, registration, item.work_id));
+        const immutableInputs = hybridDigest(copy.workspaceManifest().entries().filter(nonMemory));
+        if (histories.some(history => hybridDigest(history.workspaceManifest().entries().filter(nonMemory)) !== immutableInputs))
+            refuse("peer_non_memory_inputs_changed");
+        const before = compose(baseline.baseline(), histories, graph.target.payload.memory_repair.write_paths);
+        return new PreparedMemoryRepairPublicationSource(token, registration, baseline, copy, workSessionId, graph, histories, before, copy.startReceiptSha256(context, workSessionId));
+    }
+    static prepare(context, registration, baseline, copy, workSessionId) {
+        const prepared = this.#observe(context, registration, baseline, copy, workSessionId);
+        prepared.#assertNoIntent(context);
+        prepared.revalidate(context);
+        return prepared;
+    }
+    static restore(context, registration, baseline, copy, workSessionId) {
+        assertOwners(context, registration, baseline, copy, workSessionId);
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const value = retained(context, baseline);
+        if (!value)
+            refuse("registered_source_required");
+        const selected = value.selected;
+        if (!selected || !Array.isArray(selected.states))
+            refuse("invalid_source_receipt");
+        const prepared = this.#observe(context, registration, baseline, copy, workSessionId, selected.states);
+        if (hybridDigest(prepared.receipt()) !== hybridDigest(value))
+            refuse("registered_source_changed");
+        prepared.#registered = true;
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    receipt() {
+        const value = { ...structuredClone(this.#body), source_view_sha256: this.sha256 };
+        if (Buffer.byteLength(JSON.stringify(value)) > 40 * 1024 * 1024)
+            refuse("unbounded_source_receipt");
+        return value;
+    }
+    before() { return this.#before; }
+    matches(baseline, copy, workSessionId) {
+        return baseline === this.#baseline && copy === this.#copy && workSessionId === this.#workSessionId;
+    }
+    #assertNoIntent(context) {
+        const scope = this.#baseline.receipt();
+        if (context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type='memory.repair_publication_intent' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 1", [scope.project_id, scope.run_id, scope.work_id, scope.generation]))
+            refuse("source_registration_before_intent_required");
+    }
+    #assertRegisteredOrder(context) {
+        const scope = this.#baseline.receipt();
+        const rows = context.db.all("SELECT id,event_type FROM audit_events WHERE project_id=? AND event_type IN ('memory.repair_work_start','memory.repair_publication_source','memory.repair_publication_intent') AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? ORDER BY id LIMIT 4", [scope.project_id, scope.run_id, scope.work_id, scope.generation]);
+        const starts = rows.filter(row => row.event_type === "memory.repair_work_start");
+        const sources = rows.filter(row => row.event_type === event);
+        const intents = rows.filter(row => row.event_type === "memory.repair_publication_intent");
+        if (rows.length > 3 || starts.length !== 1 || sources.length !== 1 || intents.length > 1
+            || starts[0].id >= sources[0].id || intents.some(row => row.id <= sources[0].id)
+            || this.#graph.settlements.some(row => row.id >= sources[0].id))
+            refuse("source_receipt_order_changed");
+    }
+    assertCustody(context) {
+        assertOwners(context, this.#registration, this.#baseline, this.#copy, this.#workSessionId);
+        const selected = selectMemoryRepairGraph(context, this.#registration, this.#baseline.workId, "running", this.#registered ? this.#graph.states : undefined);
+        if (hybridDigest(selected) !== hybridDigest(this.#graph)
+            || this.#copy.startReceiptSha256(context, this.#workSessionId) !== this.#body.start_receipt_sha256)
+            refuse("source_custody_changed");
+        for (const history of this.#histories)
+            history.assertCustody(context);
+        if (this.#registered) {
+            if (hybridDigest(retained(context, this.#baseline)) !== hybridDigest(this.receipt()))
+                refuse("registered_source_changed");
+            this.#assertRegisteredOrder(context);
+        }
+    }
+    assertRegisteredCustody(context) {
+        if (!this.#registered)
+            refuse("registered_source_required");
+        this.assertCustody(context);
+    }
+    revalidate(context) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        this.assertCustody(context);
+        this.#copy.verifyPrivateInputs(context, this.#workSessionId);
+        this.#copy.verifyPublicationSourceInputs(context, this.#workSessionId, this.#before);
+        for (const history of this.#histories)
+            history.revalidate(context);
+        this.assertCustody(context);
+    }
+    register(context) {
+        this.revalidate(context);
+        const receipt = this.receipt(), expected = hybridDigest(receipt), scope = this.#baseline.receipt();
+        const result = context.db.writeTransaction(() => {
+            if (!context.db.isOwnedWriteTransaction?.())
+                refuse("owned_source_writer_required");
+            this.assertCustody(context);
+            this.#assertNoIntent(context);
+            const prior = retained(context, this.#baseline);
+            if (prior && hybridDigest(prior) !== expected)
+                refuse("registered_source_changed");
+            if (!prior)
+                appendAudit(context, { projectId: scope.project_id, eventType: event, payload: receipt });
+            if (hybridDigest(retained(context, this.#baseline)) !== expected)
+                refuse("source_readback_failed");
+            this.#assertRegisteredOrder(context);
+            return { work_id: scope.work_id, source_view_sha256: this.sha256, receipt_sha256: expected, replayed: Boolean(prior) };
+        });
+        this.#registered = true;
+        try {
+            this.revalidate(context);
+        }
+        catch (error) {
+            throw new AppError("memory_repair_publication_source_pending", "Source view committed but custody changed before publication", 1, { effect: "committed", source_view_sha256: this.sha256, cause: error instanceof Error ? error.message : String(error) });
+        }
+        return result;
+    }
+}