@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.141

package/tools/create-canon-release.mjs

@@ -0,0 +1,33 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { createHash, randomUUID } from "node:crypto";
+import { produceCanonArchive } from "../dist/services/release-provenance.js";
+
+const args = process.argv.slice(2), names = ["canon-root", "commit", "output"];
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write("Usage: node tools/create-canon-release.mjs --canon-root <checkout> --commit <40-hex-commit> --output <new-archive.tgz>\nCreates an immutable Git-object archive with reviewed aliases materialized. Does not publish or qualify a release.\n");
+} else {
+  let temporary;
+  let ownsTemporary = false;
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const bytes = produceCanonArchive(options.get("canon-root"), options.get("commit"));
+    const output = path.resolve(options.get("output"));
+    temporary = path.join(path.dirname(output), `.canon-archive-${randomUUID()}.tmp`);
+    const fd = fs.openSync(temporary, "wx", 0o600);
+    ownsTemporary = true;
+    try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.linkSync(temporary, output); // Atomic no-replace publication, including dangling symlink targets.
+    process.stdout.write(`${JSON.stringify({ ok: true, commit: options.get("commit"), output, bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") })}\n`);
+  } catch {
+    process.stderr.write("Canonical archive production refused; check committed source and a new output path.\n");
+    process.exitCode = 1;
+  } finally { if (temporary && ownsTemporary) fs.rmSync(temporary, { force: true }); }
+}

package/tools/produce-hybrid-release.mjs

@@ -0,0 +1,41 @@
+import { createPrivateKey } from "node:crypto";
+import { Buffer } from "node:buffer";
+import process from "node:process";
+import { publishReleaseBundle } from "../dist/services/release-producer.js";
+import { readBoundedReleaseFile } from "../dist/services/release-source.js";
+import { createReleaseCompatibility, installedCatalogVersions } from "../dist/services/release-compatibility.js";
+import { getCliVersionReport } from "../dist/services/build-info.js";
+import { verifyProducerSource, verifyCanonArchiveSource } from "../dist/services/release-provenance.js";
+
+const names = ["payload-file", "canon-root", "canon-archive", "engine-archive", "key-file", "output", "channel"];
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(`Produce an immutable local signed release bundle from existing qualification evidence.\nUsage: node tools/produce-hybrid-release.mjs ${names.map(name => `--${name} <value>`).join(" ")}\nThis does not publish remotely or qualify a route. Private keys never enter the output.\n`);
+} else {
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const compatibility = createReleaseCompatibility({ channel: options.get("channel"), catalogVersions: installedCatalogVersions, routerVersion: getCliVersionReport().cli.version });
+    const payload = JSON.parse(readBoundedReleaseFile(options.get("payload-file"), 16 * 1024 * 1024).toString("utf8"));
+    const manifest = JSON.parse(Buffer.from(payload.manifest_base64, "base64").toString("utf8"));
+    verifyProducerSource(options.get("canon-root"), payload.source, manifest.canon.version);
+    const canonArchive = readBoundedReleaseFile(options.get("canon-archive"), 256 * 1024 * 1024);
+    verifyCanonArchiveSource(options.get("canon-root"), payload.source.commit, manifest.canon.archive, canonArchive);
+    const result = publishReleaseBundle(options.get("output"), {
+      payload,
+      privateKey: createPrivateKey(readBoundedReleaseFile(options.get("key-file"), 64 * 1024)), compatibility,
+      canonArchive,
+      engineArchive: readBoundedReleaseFile(options.get("engine-archive"), 256 * 1024 * 1024)
+    });
+    process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
+  } catch {
+    // Key/parser/network excerpts must never appear in producer diagnostics.
+    process.stderr.write("Release production refused; check explicit inputs and qualification evidence.\n");
+    process.exitCode = 1;
+  }
+}

package/tools/repair-paused-run-status.mjs

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/* global process, console */
+// Explicit repair of legacy fenced RUN projections; no migrations or process control.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { parseArgs } from 'node:util';
+import { createContext } from '../dist/runtime/context.js';
+import { appendFlowRunTimelineEvent, gitFacts, publishRunProjections } from '../dist/services/runs.js';
+import { appendAudit } from '../dist/services/audit.js';
+
+const { values } = parseArgs({ options: { home: { type: 'string' }, run: { type: 'string' }, project: { type: 'string' }, apply: { type: 'boolean', default: false }, 'cancel-abandoned': { type: 'boolean', default: false } } });
+if (!values.home || !values.run || !values.project) throw new Error('Usage: --home <runtime> --project <project-id> --run <run-id> [--apply]');
+const home = fs.realpathSync(values.home);
+const context = createContext({ ...process.env, DD_FLOW_HOME: home }, values.apply ? 'hook' : 'read_existing');
+const db = context.db;
+let runtimePath, original, backup, report;
+try {
+  const run = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
+  if (!run) throw new Error('RUN not found');
+  const guard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
+  const cancel = values['cancel-abandoned'];
+  if (cancel) {
+    if (fs.existsSync(run.project_root)) throw new Error('Abandoned-fixture cancellation requires an absent project directory');
+    for (const table of ['works', 'sessions', 'run_controllers']) {
+      if (!db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table])) continue;
+      if (db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+    }
+    if (guard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
+  }
+  if (!cancel && !["draining", "sealed", "resuming"].includes(guard?.status)) throw new Error("Repair requires the current recovery to fence productive admission");
+  if (run.status !== 'running') {
+    report = { run_id: run.id, status: run.status, changed: false };
+  } else {
+    runtimePath = fs.realpathSync(run.runtime_path);
+    const relative = path.relative(home, runtimePath);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('Runtime file is outside the selected home');
+    original = fs.readFileSync(runtimePath);
+    if (JSON.parse(original).status !== 'running' || JSON.parse(run.index_json).status !== 'running') throw new Error('RUN projections disagree; manual review required');
+    if (values.apply) {
+      backup = `${runtimePath}.status-repair-${crypto.randomUUID()}.json`;
+      fs.writeFileSync(backup, JSON.stringify({ recovery_id: guard?.recovery_id ?? null, row: run, runtime: original.toString('utf8') }), { flag: 'wx', mode: 0o600 });
+      const git = cancel ? gitFacts(run.workspace_root) : null;
+      db.writeTransaction(() => {
+        const current = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
+        const currentGuard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
+        if (!current || current.status !== 'running' || current.index_json !== run.index_json || current.runtime_path !== run.runtime_path) throw new Error('RUN changed after repair preparation');
+        if (cancel) {
+          if (currentGuard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
+          for (const table of ['works', 'sessions', 'run_controllers']) {
+            if (db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table]) && db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+          }
+        } else if (!currentGuard || currentGuard.recovery_id !== guard.recovery_id || currentGuard.generation !== guard.generation || currentGuard.status !== guard.status) throw new Error('Recovery guard changed after repair preparation');
+        const index = JSON.parse(current.index_json), now = context.now();
+        if (index.status !== 'running') throw new Error('RUN index changed after repair preparation');
+        index.status = cancel ? 'cancelled' : 'paused';
+        index.updated_at = now;
+        index.runtime_revision = (index.runtime_revision ?? 0) + 1;
+        if (cancel) {
+          for (const stage of index.stage_runs) if (['running', 'pending', 'paused', 'blocked'].includes(stage.status)) {
+            stage.status = 'skipped'; stage.updated_at = now; stage.completed_at = now;
+            const elapsed = Date.parse(now) - Date.parse(stage.started_at ?? '');
+            stage.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          }
+          if (!['vnext_specify', 'vnext_protocolize'].includes(index.flow_kind)) index.attempts = index.stage_runs.map(stage => ({ stage: stage.stage, attempt_number: Number((stage.attempt ?? 'try-001').replace('try-', '')) || 1, root: stage.dir, archive: null, status: stage.status, started_at: stage.started_at ?? now, finished_at: stage.completed_at ?? null }));
+          index.verdict = 'cancelled'; index.next_action = null; index.completed_at = now; index.finished_at = now;
+          const elapsed = Date.parse(now) - Date.parse(index.started_at ?? current.created_at);
+          index.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          index.execution = { project_root: index.execution?.project_root ?? current.project_root, workspace_root: index.execution?.workspace_root ?? current.workspace_root, git };
+        }
+        const updated = db.run('UPDATE runs SET status=?, verdict=?, next_action=?, index_json=?, updated_at=?, completed_at=? WHERE project_id=? AND id=? AND status=? AND index_json=?', [index.status, index.verdict, index.next_action, JSON.stringify(index), now, index.completed_at ?? null, values.project, values.run, 'running', current.index_json]);
+        if (updated.changes !== 1) throw new Error('RUN changed before repair commit');
+        if (cancel) {
+          const reason = 'Operator requested cleanup of abandoned fixture: project removed; no Work, Session or controller history.';
+          appendAudit(context, { projectId: values.project, eventType: 'flow_run.manual_override', payload: { run_id: run.id, status: 'cancelled', verdict: 'cancelled', next_action: null, reason } });
+          appendFlowRunTimelineEvent(context, values.project, run.id, { at: now, type: 'run_manual_override', status: 'cancelled', reason });
+        }
+        if (!cancel) db.afterCommit(() => publishRunProjections(context, values.project, run.id));
+      }, 'repair-paused-run-status');
+    }
+    report = { run_id: run.id, from: 'running', to: cancel ? 'cancelled' : 'paused', recovery_id: guard?.recovery_id ?? null, applied: values.apply, backup };
+  }
+  console.log(JSON.stringify(report));
+} finally { db.close(); }