@delorenj/pjangler 1.4.5 → 1.5.2

package/dist/project-registry-service.js

@@ -0,0 +1,748 @@
+#!/usr/bin/env node
+
+// src/project/registryService.ts
+import { createServer } from "node:http";
+import { Pool } from "pg";
+import { readFile as readFile2 } from "node:fs/promises";
+
+// src/project/executionBinding.ts
+var EXECUTION_LANES = ["Backlog", "Needs Re-evaluation", "Todo", "In Progress", "E2E Testing & QA", "Ready for Documentation", "Done", "Needs Attention", "Cancelled"];
+function executionReadiness(manifest) {
+  const execution = manifest.execution;
+  if (!execution || execution.mode === "legacy") return [];
+  const errors = [];
+  if (!["shadow", "managed"].includes(execution.mode)) errors.push("execution.mode must be legacy, shadow or managed");
+  if (!manifest.project_id) errors.push("canonical project_id missing");
+  if (manifest.ticket_provider?.type !== "plane" || !manifest.ticket_provider.workspace || !manifest.ticket_provider.board_id) errors.push("exact Plane binding missing");
+  if (execution.policy_version !== 2 || !execution.skill_version) errors.push("execution policy or skill pin missing");
+  for (const lane of EXECUTION_LANES) if (!execution.states?.[lane]) errors.push(`lane binding missing: ${lane}`);
+  for (const pin of ["pilot_bundle_sha256", "momo_bundle_sha256"]) if (!/^[a-f0-9]{64}$/.test(execution[pin] ?? "")) errors.push(`${pin} missing`);
+  if (!execution.working_label) errors.push("working label binding missing");
+  if (!execution.actors?.[execution.pm_actor] || execution.actors[execution.pm_actor].role !== "pm") errors.push("PM actor enrollment missing");
+  if (!execution.actors?.[execution.controller_actor] || execution.actors[execution.controller_actor].role !== "operator") errors.push("controller repair actor enrollment missing");
+  const ids = /* @__PURE__ */ new Set();
+  for (const [name, actor] of Object.entries(execution.actors ?? {})) {
+    if (!actor.native_user_id || !actor.key_ref?.startsWith("op://") || !actor.runtime_id) errors.push(`actor ${name}: native identity, op reference and runtime required`);
+    if (ids.has(actor.native_user_id)) errors.push(`actor ${name}: duplicate native identity`);
+    ids.add(actor.native_user_id);
+    if (!["pm", "operator", "reviewer", "interactive"].includes(actor.role)) errors.push(`actor ${name}: invalid role`);
+    if (name === execution.pm_actor && (!Array.isArray(actor.runtime?.planner_argv) || !actor.runtime.planner_argv.length || actor.runtime.planner_argv.some((x) => typeof x !== "string" || !x || x.includes("\0")))) errors.push("PM planner argv missing");
+    if (actor.runtime?.adapter !== "systemd" || !/^[a-zA-Z0-9_-]+$/.test(actor.runtime?.unit_prefix ?? "")) errors.push(`actor ${name}: supervised runtime missing`);
+  }
+  if (execution.legacy_writers_fenced !== true) errors.push("legacy writers not fenced");
+  return errors;
+}
+function validateExecutionBinding(manifest) {
+  if (!manifest.execution) return;
+  if (typeof manifest.execution !== "object" || Array.isArray(manifest.execution)) throw new Error("execution must be an object");
+  if (manifest.execution.mode === "managed") {
+    const errors = executionReadiness(manifest);
+    if (errors.length) throw new Error(`Managed execution not ready: ${errors.join("; ")}`);
+  } else if (!["legacy", "shadow"].includes(manifest.execution.mode)) throw new Error("invalid execution mode");
+}
+
+// src/project/manifestIndex.ts
+import { createHash, randomUUID } from "node:crypto";
+import { constants, lstatSync, readFileSync, realpathSync, renameSync } from "node:fs";
+import { lstat, open, readFile, realpath, unlink } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+
+// src/project/registryClient.ts
+function normalizeProjectId(value) {
+  if (typeof value !== "string") throw new Error("project_id is required");
+  const id = value.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(id) || id.endsWith("-") || id.length > 128) {
+    throw new Error(`Invalid project_id: ${value}; use letters, digits and internal hyphens`);
+  }
+  return id;
+}
+
+// src/project/notebookSettingsValidation.ts
+import { isIP } from "node:net";
+import { isAbsolute } from "node:path";
+
+// src/notebook/types.ts
+var CREDENTIAL_KEY = /(?:^|[_-])(?:password|passwd|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|credential|authorization)(?:$|[_-])/iu;
+var SECRET_SHAPED_VALUE = /(?:-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9])|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|(?:password|api[_-]?key|access[_-]?token|client[_-]?secret)\s*[:=]\s*[^\s]{8,})/iu;
+function notebookCredentialMaterialPath(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  let visited = 0;
+  const walk = (candidate, path, depth) => {
+    if (++visited > 2e3 || depth > 20) return `${path}.[structure-limit]`;
+    if (typeof candidate === "string") return SECRET_SHAPED_VALUE.test(candidate) ? path : null;
+    if (!candidate || typeof candidate !== "object") return null;
+    if (seen.has(candidate)) return `${path}.[cycle]`;
+    seen.add(candidate);
+    if (Array.isArray(candidate)) {
+      for (let index = 0; index < candidate.length; index++) {
+        const found = walk(candidate[index], `${path}[${index}]`, depth + 1);
+        if (found) return found;
+      }
+      return null;
+    }
+    for (const [key, child] of Object.entries(candidate)) {
+      const childPath = path ? `${path}.${key}` : key;
+      if (CREDENTIAL_KEY.test(key)) return childPath;
+      const found = walk(child, childPath, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  };
+  return walk(value, "notebook", 0);
+}
+var DEFAULT_NOTEBOOK_LIMITS = Object.freeze({
+  schema_version: 1,
+  overview_max_chars: 4e3,
+  request_max_bytes: 1048576,
+  response_max_bytes: 4194304,
+  note_max_bytes: 1048576,
+  source_file_max_bytes: 524288,
+  list_max_items: 1e3,
+  note_detail_fetch_concurrency: 8,
+  excerpt_max_chars: 320,
+  diagnostic_max_chars: 512,
+  overall_timeout_ms: 5e3,
+  hook_session_start_timeout_ms: 4e3,
+  hook_session_end_timeout_ms: 250,
+  hook_payload_max_bytes: 1048576,
+  receipt_succeeded_retention_days: 30,
+  receiptless_session_retention_seconds: 86400,
+  unresolved_receipt_max_count: 100,
+  unresolved_receipt_max_bytes: 8388608,
+  receipt_max_bytes: 131072,
+  automatic_attempt_limit: 2,
+  lease_seconds: 300,
+  integrity_max_entries: 20,
+  refusal_max_entries: 100
+});
+
+// src/project/notebookSettingsValidation.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateGlobalNotebookConfig(value) {
+  if (value === void 0) return;
+  if (!isRecord(value)) throw new Error("Project registry notebook must be a mapping");
+  const credentialPath = notebookCredentialMaterialPath(value);
+  if (credentialPath) throw new Error(`Project registry Notebook configuration contains forbidden credential material at ${credentialPath}`);
+  if (value.base_url !== void 0) {
+    if (typeof value.base_url !== "string" || !value.base_url.trim()) throw new Error("Project registry notebook.base_url must be a nonempty URL");
+    let url;
+    try {
+      url = new URL(value.base_url);
+    } catch {
+      throw new Error("Project registry notebook.base_url must be an absolute URL");
+    }
+    if (url.username || url.password || url.search || url.hash) throw new Error("Project registry notebook.base_url may not contain credentials, query, or fragment");
+    const hostname = url.hostname.toLowerCase();
+    const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+    const loopback = hostname === "localhost" || host === "::1" || /^127(?:\.\d{1,3}){3}$/u.test(host);
+    if (isIP(host) !== 0 && !loopback) throw new Error("Project registry notebook.base_url may not use a numeric non-loopback host");
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw new Error("Project registry notebook.base_url must use HTTPS or loopback HTTP");
+  }
+  if (value.auth !== void 0) {
+    if (!isRecord(value.auth) || value.auth.mode !== "none" && value.auth.mode !== "environment") throw new Error("Project registry notebook.auth is invalid");
+    if (value.auth.mode === "environment" && value.auth.env_var !== "OPEN_NOTEBOOK_PASSWORD") throw new Error("Project registry notebook.auth.env_var must be OPEN_NOTEBOOK_PASSWORD");
+    if (value.auth.mode === "none" && value.auth.env_var !== void 0) throw new Error("Project registry notebook.auth none mode may not name a credential variable");
+  }
+  const boundedList = (candidate, name) => {
+    if (!Array.isArray(candidate) || candidate.length > 100 || candidate.some((entry) => typeof entry !== "string" || !entry || Buffer.byteLength(entry, "utf8") > 512)) throw new Error(`Project registry notebook.defaults.${name} must be a bounded string list`);
+  };
+  if (value.defaults !== void 0) {
+    if (!isRecord(value.defaults)) throw new Error("Project registry notebook.defaults must be a mapping");
+    for (const key of ["enabled", "session_start_enabled", "session_capture_enabled"]) {
+      if (value.defaults[key] !== void 0 && typeof value.defaults[key] !== "boolean") throw new Error(`Project registry notebook.defaults.${key} must be boolean`);
+    }
+    if (value.defaults.overview_max_chars !== void 0 && (!Number.isSafeInteger(value.defaults.overview_max_chars) || Number(value.defaults.overview_max_chars) <= 0)) throw new Error("Project registry notebook.defaults.overview_max_chars must be a positive integer");
+    for (const key of ["documentation_globs", "overview_references", "excluded_globs"]) if (value.defaults[key] !== void 0) boundedList(value.defaults[key], key);
+  }
+  const limits = { ...DEFAULT_NOTEBOOK_LIMITS };
+  if (value.limits !== void 0) {
+    if (!isRecord(value.limits)) throw new Error("Project registry notebook.limits must be a mapping");
+    for (const key of Object.keys(DEFAULT_NOTEBOOK_LIMITS)) {
+      const configured = value.limits[key];
+      if (configured === void 0) continue;
+      if (!Number.isSafeInteger(configured) || Number(configured) <= 0) throw new Error(`Project registry notebook.limits.${key} must be a positive integer`);
+      limits[key] = Number(configured);
+    }
+  }
+  if (limits.schema_version !== 1) throw new Error("Project registry notebook.limits.schema_version must be 1");
+  if (limits.receipt_max_bytes > limits.unresolved_receipt_max_bytes) throw new Error("Project registry notebook receipt_max_bytes may not exceed unresolved_receipt_max_bytes");
+  if (limits.hook_payload_max_bytes > DEFAULT_NOTEBOOK_LIMITS.hook_payload_max_bytes) throw new Error("Project registry notebook hook_payload_max_bytes exceeds the packaged ceiling");
+  if (limits.note_detail_fetch_concurrency > DEFAULT_NOTEBOOK_LIMITS.note_detail_fetch_concurrency) throw new Error("Project registry notebook note_detail_fetch_concurrency exceeds the packaged ceiling");
+  if (limits.lease_seconds * 1e3 <= limits.overall_timeout_ms) throw new Error("Project registry notebook lease_seconds must exceed one request timeout");
+  if (isRecord(value.defaults) && value.defaults.overview_max_chars !== void 0 && Number(value.defaults.overview_max_chars) > limits.note_max_bytes) throw new Error("Project registry notebook overview_max_chars exceeds note_max_bytes");
+  if (value.summarizer !== void 0) {
+    if (!isRecord(value.summarizer) || typeof value.summarizer.executable !== "string" || !isAbsolute(value.summarizer.executable) || value.summarizer.executable.includes("\0") || Buffer.byteLength(value.summarizer.executable, "utf8") > 1024) throw new Error("Project registry notebook.summarizer executable must be a bounded absolute path");
+    if (value.summarizer.args !== void 0 && (!Array.isArray(value.summarizer.args) || value.summarizer.args.length > 32 || value.summarizer.args.some((entry) => typeof entry !== "string" || entry.includes("\0") || Buffer.byteLength(entry, "utf8") > 1024))) throw new Error("Project registry notebook.summarizer args must be bounded strings");
+  }
+}
+
+// src/project/manifestIndex.ts
+var RegistryError = class extends Error {
+  constructor(message, status = 422, code = "invalid_manifest") {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+};
+function normalizeProjectId2(value) {
+  try {
+    return normalizeProjectId(value);
+  } catch (error) {
+    throw new RegistryError(error instanceof Error ? error.message : String(error));
+  }
+}
+function object(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function stable(value) {
+  return JSON.stringify(value, (_key, v) => object(v) ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, v[k]])) : v);
+}
+function equal(a, b) {
+  return stable(a) === stable(b);
+}
+function mergeMissing(current, fallback) {
+  if (current === void 0) return fallback;
+  if (!object(current) || !object(fallback)) return current;
+  return Object.fromEntries([.../* @__PURE__ */ new Set([...Object.keys(current), ...Object.keys(fallback)])].map((key) => [key, mergeMissing(current[key], fallback[key])]));
+}
+function hash(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function validateManifestFields(manifest, path) {
+  validateExecutionBinding(manifest);
+  const fail = (field, shape) => {
+    throw new RegistryError(`Manifest ${path}: ${field} must be ${shape}`);
+  };
+  const strings = (value, names, prefix = "") => {
+    for (const name of names) if (value[name] !== void 0 && typeof value[name] !== "string") fail(`${prefix}${name}`, "a string");
+  };
+  strings(manifest, ["project_name", "name", "project_description", "description", "status", "repo_path", "created_at", "updated_at"]);
+  for (const field of ["ticket_provider", "agents", "template", "notebook", "automation"]) if (manifest[field] !== void 0 && !object(manifest[field])) fail(field, "an object");
+  if (manifest.source_artifacts !== void 0 && !Array.isArray(manifest.source_artifacts)) fail("source_artifacts", "an array");
+  for (const [index, artifact] of (manifest.source_artifacts ?? []).entries()) {
+    if (!object(artifact)) fail(`source_artifacts.${index}`, "an object");
+    strings(artifact, ["kind", "path", "package_name"], `source_artifacts.${index}.`);
+  }
+  if (manifest.ticket_provider) strings(manifest.ticket_provider, ["type", "workspace", "identifier", "identifier_source", "identifier_fetched_at", "board_id", "board_confirmed_at", "board_url", "state"], "ticket_provider.");
+  for (const [name, agent] of Object.entries(manifest.agents ?? {})) {
+    if (!object(agent)) fail(`agents.${name}`, "an object");
+    strings(agent, ["role", "role_dir", "provisioning_state"], `agents.${name}.`);
+  }
+  if (manifest.template?.commonproject !== void 0) {
+    if (!object(manifest.template.commonproject)) fail("template.commonproject", "an object");
+    const template = manifest.template.commonproject;
+    if (template.enabled !== void 0 && typeof template.enabled !== "boolean") fail("template.commonproject.enabled", "boolean");
+    strings(template, ["primary_language"], "template.commonproject.");
+  }
+  for (const field of ["binding", "policy"]) if (manifest.notebook?.[field] !== void 0 && !object(manifest.notebook[field])) fail(`notebook.${field}`, "an object");
+  if (manifest.notebook?.binding) strings(manifest.notebook.binding, ["provider", "state", "notebook_name", "blocked_reason", "notebook_id", "overview_note_id", "created_at", "updated_at"], "notebook.binding.");
+  if (manifest.notebook?.policy) {
+    try {
+      validateGlobalNotebookConfig({ defaults: manifest.notebook.policy });
+    } catch (error) {
+      throw new RegistryError(`Manifest ${path}: invalid notebook policy: ${String(error)}`);
+    }
+  }
+}
+function serializedManifest(manifest) {
+  const serialized = `${JSON.stringify(manifest, null, 2)}
+`;
+  if (Buffer.byteLength(serialized) > 2 * 1024 * 1024) throw new RegistryError("Serialized manifest exceeds 2 MiB; no manifest was written", 413, "manifest_too_large");
+  return serialized;
+}
+async function readManifest(path) {
+  path = resolve(path);
+  const stat = await lstat(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || basename(path) !== ".project.json") {
+    throw new RegistryError(`Expected a regular .project.json file: ${path}`);
+  }
+  path = await realpath(path);
+  const raw = await readFile(path, "utf8");
+  if (Buffer.byteLength(raw) > 2 * 1024 * 1024) throw new RegistryError(`Manifest exceeds 2 MiB: ${path}`);
+  let manifest;
+  try {
+    manifest = JSON.parse(raw);
+  } catch {
+    throw new RegistryError(`Malformed JSON: ${path}`);
+  }
+  if (!object(manifest)) throw new RegistryError(`Expected a JSON object: ${path}`);
+  validateManifestFields(manifest, path);
+  const id = normalizeProjectId2(manifest.project_id ?? manifest.project_slug);
+  if (manifest.project_id && manifest.project_slug && normalizeProjectId2(manifest.project_slug) !== id) {
+    throw new RegistryError(`Conflicting project_id and project_slug: ${path}`, 409, "identity_conflict");
+  }
+  return { path, raw, manifest, id, hash: hash(raw), mode: stat.mode & 511 };
+}
+function recordFromManifest(manifest, path) {
+  const id = normalizeProjectId2(manifest.project_id ?? manifest.project_slug);
+  const { project_slug: _old, project_name: _name, project_description: _description, notebook, ...rest } = manifest;
+  return {
+    ...rest,
+    project_id: id,
+    slug: id,
+    name: manifest.project_name ?? manifest.name ?? id,
+    description: manifest.project_description ?? manifest.description ?? "",
+    repo_path: dirname(path),
+    status: manifest.status ?? "active",
+    source_artifacts: manifest.source_artifacts ?? [],
+    template: manifest.template ?? { commonproject: { enabled: true, primary_language: "typescript" } },
+    ticket_provider: manifest.ticket_provider ?? { type: "none", state: "skipped" },
+    agents: manifest.agents ?? {},
+    ...notebook?.binding ? { notebook: notebook.binding } : {},
+    ...notebook?.policy ? { notebook_policy: notebook.policy } : {},
+    created_at: manifest.created_at ?? "",
+    updated_at: manifest.updated_at ?? ""
+  };
+}
+async function writeManifest(original, manifest) {
+  validateManifestFields(manifest, original.path);
+  const serialized = serializedManifest(manifest);
+  const temp = join(dirname(original.path), `.project.json.${randomUUID()}.tmp`);
+  let committed = false;
+  try {
+    const handle = await open(temp, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, original.mode);
+    try {
+      await handle.writeFile(serialized);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const stat = lstatSync(original.path);
+    if (!stat.isFile() || stat.isSymbolicLink() || realpathSync(original.path) !== original.path) throw new RegistryError(`Manifest path changed: ${original.path}`, 409, "stale_manifest");
+    const currentHash = hash(readFileSync(original.path, "utf8"));
+    if (currentHash !== original.hash) throw new RegistryError(`Manifest changed while saving ${original.path}; reload and retry`, 409, "stale_manifest");
+    renameSync(temp, original.path);
+    committed = true;
+    const dir = await open(dirname(original.path), constants.O_RDONLY);
+    try {
+      await dir.sync();
+    } finally {
+      await dir.close();
+    }
+    return await readManifest(original.path);
+  } catch (error) {
+    if (committed) throw new RegistryError(`Manifest committed at ${original.path}, but indexing is stale. Run pj reindex --all. ${String(error)}`, 503, "index_stale");
+    throw error;
+  } finally {
+    await unlink(temp).catch(() => {
+    });
+  }
+}
+function mergeChanges(base, desired, current, path) {
+  if (equal(base, desired) || equal(current, desired)) return current;
+  if (equal(current, base)) return desired;
+  if (object(base) && object(desired) && object(current)) {
+    const merged = { ...current };
+    for (const key of /* @__PURE__ */ new Set([...Object.keys(base), ...Object.keys(desired)])) {
+      const value = mergeChanges(base[key], desired[key], current[key], `${path}.${key}`);
+      if (value === void 0) delete merged[key];
+      else Object.defineProperty(merged, key, { value, writable: true, enumerable: true, configurable: true });
+    }
+    return merged;
+  }
+  throw new RegistryError(`Concurrent manifest change conflicts at ${path}; reload the registry and retry`, 409, "stale_manifest");
+}
+function applyRecord(manifest, current, next) {
+  const result = structuredClone(manifest);
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(current), ...Object.keys(next)])) {
+    if (["slug", "project_id", "repo_path", "index_status", "index_error"].includes(key) || key.startsWith("__registry_") || equal(current[key], next[key])) continue;
+    const target = key === "name" ? "project_name" : key === "description" ? "project_description" : key;
+    if (key === "notebook" || key === "notebook_policy") {
+      const part = key === "notebook" ? "binding" : "policy";
+      result.notebook = { ...object(result.notebook) ? result.notebook : {} };
+      if (next[key] === void 0) delete result.notebook[part];
+      else result.notebook[part] = next[key];
+    } else if (next[key] === void 0) delete result[target];
+    else Object.defineProperty(result, target, { value: next[key], enumerable: true, writable: true, configurable: true });
+  }
+  result.project_id = normalizeProjectId2(next.project_id ?? next.slug);
+  delete result.project_slug;
+  return result;
+}
+var ManifestIndex = class {
+  constructor(pool) {
+    this.pool = pool;
+  }
+  queue = Promise.resolve();
+  committed = /* @__PURE__ */ new WeakMap();
+  async initialize() {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT pg_advisory_xact_lock(hashtext('pjangler_index.manifests'))");
+      await client.query(`CREATE EXTENSION IF NOT EXISTS citext;
+        CREATE SCHEMA IF NOT EXISTS pjangler_index;
+        CREATE TABLE IF NOT EXISTS pjangler_index.projects (
+          project_id citext PRIMARY KEY,
+          manifest_path text UNIQUE NOT NULL, snapshot jsonb NOT NULL,
+          content_hash text NOT NULL, indexed_at timestamptz NOT NULL DEFAULT now(),
+          status text NOT NULL DEFAULT 'ok', error text
+        );
+        ALTER TABLE pjangler_index.projects DROP CONSTRAINT IF EXISTS projects_project_id_check;
+        ALTER TABLE pjangler_index.projects DROP CONSTRAINT IF EXISTS project_id_canonical;
+        DO $$ BEGIN
+          IF EXISTS (SELECT 1 FROM pg_attribute
+            WHERE attrelid='pjangler_index.projects'::regclass AND attname='project_id'
+            AND atttypid <> 'citext'::regtype) THEN
+            ALTER TABLE pjangler_index.projects ALTER COLUMN project_id TYPE citext USING project_id::citext;
+          END IF;
+        END $$;
+        ALTER TABLE pjangler_index.projects ADD CONSTRAINT project_id_canonical
+          CHECK (project_id::text ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?$' AND length(project_id::text) <= 128);
+        CREATE TABLE IF NOT EXISTS pjangler_index.settings (key text PRIMARY KEY, value jsonb NOT NULL);`);
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  serialized(fn) {
+    const run = this.queue.then(async () => {
+      const client = await this.pool.connect();
+      try {
+        await client.query("BEGIN");
+        await client.query("SELECT pg_advisory_xact_lock(hashtext('pjangler_index.manifests'))");
+        const result = await fn(client);
+        await client.query("COMMIT");
+        return result;
+      } catch (error) {
+        await client.query("ROLLBACK").catch(() => {
+        });
+        const path = this.committed.get(client);
+        if (path && !(error instanceof RegistryError && error.code === "index_stale")) throw new RegistryError(`Manifest committed at ${path}; index is stale. Retry the same request or reindex. ${String(error)}`, 503, "index_stale");
+        throw error;
+      } finally {
+        this.committed.delete(client);
+        client.release();
+      }
+    });
+    this.queue = run.catch(() => {
+    });
+    return run;
+  }
+  async registrationRows(client, read) {
+    const result = await client.query("SELECT project_id,manifest_path FROM pjangler_index.projects WHERE project_id=$1 OR manifest_path=$2", [read.id, read.path]);
+    for (const row of result.rows) {
+      if (row.manifest_path === read.path) continue;
+      let missing = false;
+      try {
+        await lstat(row.manifest_path);
+      } catch (error) {
+        missing = ["ENOENT", "ENOTDIR"].includes(error.code ?? "");
+      }
+      if (!missing) throw new RegistryError(`project_id ${read.id} is already registered at ${row.manifest_path}; its canonical manifest must be missing before relocation`, 409, "identity_collision");
+    }
+    return result.rows;
+  }
+  async persist(client, read, oldId) {
+    await this.registrationRows(client, read);
+    if (oldId && oldId !== read.id) await client.query("DELETE FROM pjangler_index.projects WHERE project_id=$1 AND manifest_path=$2", [oldId, read.path]);
+    await client.query(`INSERT INTO pjangler_index.projects(project_id,manifest_path,snapshot,content_hash) VALUES($1,$2,$3,$4)
+      ON CONFLICT(project_id) DO UPDATE SET manifest_path=excluded.manifest_path,snapshot=excluded.snapshot,
+      content_hash=excluded.content_hash,indexed_at=now(),status='ok',error=NULL`, [read.id, read.path, JSON.stringify(recordFromManifest(read.manifest, read.path)), read.hash]);
+  }
+  async register(client, path) {
+    let read = await readManifest(path);
+    const collision = await this.registrationRows(client, read);
+    const manifest = { ...read.manifest, project_id: read.id };
+    delete manifest.project_slug;
+    let committed = false;
+    try {
+      if (!equal(manifest, read.manifest)) {
+        read = await writeManifest(read, manifest);
+        committed = true;
+        this.committed.set(client, read.path);
+      }
+      await this.persist(client, read, collision.find((r) => r.manifest_path === read.path)?.project_id);
+    } catch (error) {
+      if (committed) throw new RegistryError(`Manifest saved at ${read.path}; index is stale. Retry registration or reindex. ${String(error)}`, 503, "index_stale");
+      throw error;
+    }
+  }
+  async refresh(client) {
+    const rows = (await client.query("SELECT * FROM pjangler_index.projects ORDER BY project_id")).rows;
+    for (const row of rows) {
+      try {
+        const read = await readManifest(row.manifest_path);
+        if (read.hash !== row.content_hash || row.status !== "ok" || !equal(row.snapshot, recordFromManifest(read.manifest, read.path))) await this.persist(client, read, row.project_id);
+      } catch (error) {
+        if (!(error instanceof RegistryError) && !["ENOENT", "ENOTDIR", "ELOOP", "EACCES", "EPERM"].includes(error.code ?? "")) throw error;
+        await client.query("UPDATE pjangler_index.projects SET status=$2,error=$3 WHERE project_id=$1", [row.project_id, ["ENOENT", "ENOTDIR"].includes(error.code ?? "") ? "missing" : "invalid", String(error)]);
+      }
+    }
+  }
+  async snapshot(client) {
+    const rows = (await client.query("SELECT * FROM pjangler_index.projects ORDER BY project_id")).rows;
+    const settings = (await client.query("SELECT key,value FROM pjangler_index.settings")).rows;
+    const projects = /* @__PURE__ */ Object.create(null), hashes = /* @__PURE__ */ Object.create(null), statuses = /* @__PURE__ */ Object.create(null), baseline = /* @__PURE__ */ Object.create(null);
+    for (const row of rows) {
+      projects[row.project_id] = row.snapshot;
+      hashes[row.project_id] = row.content_hash;
+      baseline[row.project_id] = structuredClone(row.snapshot);
+      statuses[row.project_id] = { status: row.status, error: row.error, manifest_path: row.manifest_path, content_hash: row.content_hash, indexed_at: row.indexed_at };
+    }
+    const global = Object.fromEntries(settings.map((row) => [row.key, row.value]));
+    return { ...global, schema_version: 1, projects, __registry_hashes: hashes, __registry_baseline: baseline, __registry_status: statuses, __registry_settings_baseline: structuredClone(global) };
+  }
+  load() {
+    return this.serialized(async (client) => {
+      await this.refresh(client);
+      return this.snapshot(client);
+    });
+  }
+  index(path) {
+    return this.serialized(async (client) => {
+      await this.register(client, path);
+      await this.refresh(client);
+      return this.snapshot(client);
+    });
+  }
+  rebuild(paths) {
+    return this.serialized(async (client) => {
+      const discovered = /* @__PURE__ */ new Map();
+      for (const path of paths) {
+        const read = await readManifest(path);
+        if (discovered.has(read.id) && discovered.get(read.id) !== read.path) throw new RegistryError(`Duplicate project_id ${read.id} in rebuild paths`, 409, "identity_collision");
+        discovered.set(read.id, read.path);
+        await this.registrationRows(client, read);
+      }
+      for (const path of discovered.values()) await this.register(client, path);
+      await this.refresh(client);
+      return this.snapshot(client);
+    });
+  }
+  remove(id) {
+    return this.serialized(async (client) => {
+      await client.query("DELETE FROM pjangler_index.projects WHERE project_id=$1", [normalizeProjectId2(id)]);
+      return this.snapshot(client);
+    });
+  }
+  settings(settings) {
+    return this.serialized(async (client) => {
+      await this.saveSettings(client, settings);
+      return this.snapshot(client);
+    });
+  }
+  validateSettings(settings) {
+    try {
+      validateGlobalNotebookConfig(settings.notebook);
+    } catch (error) {
+      throw new RegistryError(error instanceof Error ? error.message : String(error), 422, "invalid_settings");
+    }
+  }
+  async saveSettings(client, settings) {
+    this.validateSettings(settings);
+    for (const [key, value] of Object.entries(settings)) {
+      if (["schema_version", "projects"].includes(key) || key.startsWith("__registry_")) continue;
+      if (value === void 0) {
+        await client.query("DELETE FROM pjangler_index.settings WHERE key=$1", [key]);
+        continue;
+      }
+      await client.query("INSERT INTO pjangler_index.settings(key,value) VALUES($1,$2) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [key, JSON.stringify(value)]);
+    }
+  }
+  save(registry) {
+    if (!object(registry.projects)) return Promise.reject(new RegistryError("Expected registry.projects object"));
+    return this.serialized(async (client) => {
+      await this.refresh(client);
+      const rows = (await client.query("SELECT * FROM pjangler_index.projects")).rows;
+      const writes = [];
+      const ids = /* @__PURE__ */ new Set();
+      for (const [key, desiredInput] of Object.entries(registry.projects)) {
+        if (!object(desiredInput)) throw new RegistryError(`Invalid project record ${key}`);
+        const id = normalizeProjectId2(desiredInput.project_id ?? desiredInput.slug ?? key);
+        if (normalizeProjectId2(key) !== id || desiredInput.slug && normalizeProjectId2(desiredInput.slug) !== id) throw new RegistryError(`Identity aliases disagree for ${key}`, 409, "identity_conflict");
+        if (ids.has(id)) throw new RegistryError(`Duplicate normalized project_id ${id}`, 409, "identity_collision");
+        ids.add(id);
+        const desired = { ...desiredInput, project_id: id, slug: id };
+        const row = rows.find((r) => r.project_id === id);
+        if (object(registry.__registry_baseline?.[id])) {
+          if (equal(registry.__registry_baseline[id], desired)) continue;
+          if (!row) throw new RegistryError(`Project ${id} was removed after this snapshot; reload before explicitly registering it`, 409, "stale_manifest");
+        }
+        const path = row?.manifest_path ?? join(String(desired.repo_path ?? ""), ".project.json");
+        const read = await readManifest(path);
+        if (read.id !== id) throw new RegistryError(`Manifest at ${path} declares ${read.id}, not ${id}`, 409, "identity_conflict");
+        const current = recordFromManifest(read.manifest, read.path);
+        const suppliedBase = registry.__registry_baseline?.[id];
+        const base = object(suppliedBase) ? suppliedBase : row && registry.__registry_hashes?.[id] === row.content_hash ? row.snapshot : void 0;
+        let next;
+        if (!row) {
+          next = { ...desired, ...current };
+          for (const [field, value] of Object.entries(desired)) {
+            const manifestKey = field === "name" ? "project_name" : field === "description" ? "project_description" : field;
+            if (field === "notebook" ? read.manifest.notebook?.binding === void 0 : field === "notebook_policy" ? read.manifest.notebook?.policy === void 0 : read.manifest[manifestKey] === void 0) next[field] = value;
+            else next[field] = mergeMissing(current[field], value);
+          }
+        } else if (base) next = mergeChanges(base, desired, current, id);
+        else if (equal(current, desired)) next = current;
+        else throw new RegistryError(`Missing concurrency baseline for ${id}; reload the registry and retry`, 409, "stale_manifest");
+        if (next.repo_path !== current.repo_path) throw new RegistryError(`Cannot move ${id} through a registry snapshot; register its canonical manifest path`, 409, "identity_conflict");
+        const manifest = applyRecord(read.manifest, current, next);
+        validateManifestFields(manifest, path);
+        serializedManifest(manifest);
+        writes.push({ read, manifest, oldId: row?.project_id });
+      }
+      let settings = Object.fromEntries(Object.entries(registry).filter(([key]) => !["schema_version", "projects"].includes(key) && !key.startsWith("__registry_")));
+      if (object(registry.__registry_settings_baseline)) {
+        const currentSettings = Object.fromEntries((await client.query("SELECT key,value FROM pjangler_index.settings")).rows.map((row) => [row.key, row.value]));
+        settings = Object.fromEntries([.../* @__PURE__ */ new Set([...Object.keys(registry.__registry_settings_baseline), ...Object.keys(settings)])].map((key) => [key, mergeChanges(registry.__registry_settings_baseline[key], settings[key], currentSettings[key], `settings.${key}`)]));
+      }
+      this.validateSettings(settings);
+      let committedPath;
+      try {
+        for (const write of writes) {
+          let read = write.read;
+          if (!equal(read.manifest, write.manifest)) {
+            read = await writeManifest(read, write.manifest);
+            committedPath = read.path;
+            this.committed.set(client, read.path);
+          }
+          await this.persist(client, read, write.oldId);
+        }
+        await this.saveSettings(client, settings);
+        return await this.snapshot(client);
+      } catch (error) {
+        if (committedPath) throw new RegistryError(`Manifest saved at ${committedPath}; index is stale. Retry the same save or reindex. ${String(error)}`, 503, "index_stale");
+        throw error;
+      }
+    });
+  }
+};
+
+// src/project/registryService.ts
+var MAX_BODY = 8 * 1024 * 1024;
+async function body(request) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > MAX_BODY) throw new RegistryError("Request exceeds 8 MiB", 413, "request_too_large");
+    chunks.push(chunk);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new RegistryError("Expected JSON request body", 400, "invalid_request");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new RegistryError("Expected JSON object", 400, "invalid_request");
+  return parsed;
+}
+async function createRegistryService(options = {}) {
+  const pool = options.pool ?? new Pool({ database: process.env.PGDATABASE ?? "33god", connectionTimeoutMillis: 5e3, statement_timeout: 15e3 });
+  const index = new ManifestIndex(pool);
+  try {
+    await index.initialize();
+  } catch (error) {
+    if (!options.pool) await pool.end();
+    throw error;
+  }
+  const server = createServer(async (request, response) => {
+    response.setHeader("content-type", "application/json");
+    response.setHeader("cache-control", "no-store");
+    try {
+      const route = `${request.method} ${new URL(request.url ?? "/", "http://localhost").pathname}`;
+      let result;
+      switch (route) {
+        case "GET /health":
+          await pool.query("SELECT 1");
+          result = { ok: true, service: "pjangler-project-registry", schema_version: 1 };
+          break;
+        case "GET /v1/registry":
+          result = await index.load();
+          break;
+        case "POST /v1/reindex":
+          result = await index.load();
+          break;
+        case "POST /v1/rebuild": {
+          const payload = await body(request);
+          let paths = payload.manifest_paths;
+          if (payload.receipt_path !== void 0) {
+            if (typeof payload.receipt_path !== "string" || paths !== void 0) throw new RegistryError("Supply either manifest_paths or receipt_path", 400, "invalid_request");
+            const raw = await readFile2(payload.receipt_path, "utf8");
+            if (Buffer.byteLength(raw) > MAX_BODY) throw new RegistryError("Discovery receipt exceeds 8 MiB", 413, "request_too_large");
+            let receipt;
+            try {
+              receipt = JSON.parse(raw);
+            } catch {
+              throw new RegistryError("Malformed discovery receipt", 422, "invalid_request");
+            }
+            if (!receipt || !Array.isArray(receipt.projects)) throw new RegistryError("Discovery receipt must contain projects array", 422, "invalid_request");
+            paths = receipt.projects.map((project) => project?.manifest_path);
+          }
+          if (!Array.isArray(paths) || paths.length > 1e4 || paths.some((path) => typeof path !== "string")) throw new RegistryError("manifest_paths must be an array of at most 10000 paths", 400, "invalid_request");
+          result = await index.rebuild(paths);
+          break;
+        }
+        case "POST /v1/index": {
+          const payload = await body(request);
+          if (typeof payload.manifest_path !== "string") throw new RegistryError("manifest_path is required", 400, "invalid_request");
+          result = await index.index(payload.manifest_path);
+          break;
+        }
+        case "PUT /v1/registry":
+          result = await index.save(await body(request));
+          break;
+        case "POST /v1/remove":
+          result = await index.remove((await body(request)).project_id);
+          break;
+        case "POST /v1/settings":
+          result = await index.settings(await body(request));
+          break;
+        default:
+          throw new RegistryError("Unknown registry endpoint", 404, "not_found");
+      }
+      response.end(JSON.stringify(result));
+    } catch (error) {
+      response.statusCode = error instanceof RegistryError ? error.status : 503;
+      response.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error), code: error instanceof RegistryError ? error.code : "registry_unavailable" }));
+    }
+  });
+  server.requestTimeout = 3e4;
+  server.headersTimeout = 1e4;
+  server.keepAliveTimeout = 1e3;
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? Number(process.env.PJ_REGISTRY_PORT ?? 8764), options.host ?? "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve2();
+    });
+  }).catch(async (error) => {
+    if (!options.pool) await pool.end();
+    throw error;
+  });
+  const address = server.address();
+  return {
+    server,
+    pool,
+    index,
+    url: `http://127.0.0.1:${typeof address === "object" ? address?.port : options.port}`,
+    async close() {
+      await new Promise((resolve2, reject) => server.close((error) => error ? reject(error) : resolve2()));
+      if (!options.pool) await pool.end();
+    }
+  };
+}
+async function startRegistryService() {
+  const service = await createRegistryService();
+  console.log(`PJangler project registry listening at ${service.url}`);
+  const stop = () => {
+    void service.close().then(() => process.exit(0), (error) => {
+      console.error(error);
+      process.exit(1);
+    });
+  };
+  process.once("SIGTERM", stop);
+  process.once("SIGINT", stop);
+  return service;
+}
+
+// src/project-registry-service.ts
+await startRegistryService();
+//# sourceMappingURL=project-registry-service.js.map