@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-lens/dist/clients/config-core/merge.js

@@ -1,228 +0,0 @@
-import { denyMemberProvenance, denyProvenance, resolveArrayDeny, resolveBooleanDeny } from "./deny.js";
-import { isUnsafeConfigKey, MAX_CONFIG_DEPTH, safeAssign, UNSAFE_KEY_REASON } from "./safe-object.js";
-import { boundedKeyLabel, MigrationRecordCollector, migrationSubject } from "./records.js";
-import { tierPrecedence } from "./provenance.js";
-import { denyPolicyOf, isConfigObject, isKnownSchemaType, isPlainObject, isSchemaNode, itemsSchema, keyedField, mergeStrategyOf, propertySchema, schemaType } from "./schema.js";
-export function merge(sources, schema, options = {}) {
-  const ordered = [...sources].map((source, order) => ({ source, order })).sort((left, right) => {
-    const byTier = tierPrecedence(left.source.tier) - tierPrecedence(right.source.tier);
-    return byTier !== 0 ? byTier : left.order - right.order;
-  }).map((entry, rank) => ({ source: entry.source, rank }));
-  const contributions = [];
-  for (const entry of ordered) {
-    const value = entry.source.value;
-    if (value === undefined)
-      continue;
-    contributions.push({ source: entry.source, value, rank: entry.rank });
-  }
-  const provenance = new Map;
-  const context = {
-    provenance,
-    collector: options.collector ?? new MigrationRecordCollector,
-    file: options.file ?? ""
-  };
-  const value = mergeNode(contributions, schema, "", context, 0);
-  return { value, provenance };
-}
-function record(context, entry) {
-  const key = boundedKeyLabel(entry.key);
-  context.collector.add({
-    code: entry.code,
-    file: context.file,
-    key,
-    subject: migrationSubject(context.file, key),
-    reason: entry.reason
-  });
-}
-function provenanceOf(contribution, key) {
-  const { source } = contribution;
-  return {
-    tier: source.tier,
-    key,
-    ...source.file === undefined ? {} : { file: source.file },
-    ...source.trust === undefined ? {} : { trust: source.trust }
-  };
-}
-function stamp(context, contribution, key) {
-  context.provenance.set(key, provenanceOf(contribution, key));
-}
-function mergeNode(contributions, schema, key, context, depth) {
-  if (contributions.length === 0)
-    return;
-  if (depth > MAX_CONFIG_DEPTH) {
-    record(context, {
-      code: "PILENS_CFG_0005",
-      key,
-      reason: `config nesting exceeds ${MAX_CONFIG_DEPTH} levels; ignored`
-    });
-    return;
-  }
-  const denyPolicy = denyPolicyOf(schema);
-  if (denyPolicy)
-    return mergeDeny(contributions, denyPolicy, key, context);
-  if (isObjectNode(schema, contributions)) {
-    return mergeObject(contributions, schema, key, context, depth);
-  }
-  if (isArrayNode(schema, contributions)) {
-    return mergeArray(contributions, schema, key, context, depth);
-  }
-  const winner = contributions[contributions.length - 1];
-  stamp(context, winner, key);
-  return winner.value;
-}
-function isObjectNode(schema, contributions) {
-  const declared = schemaType(schema);
-  if (declared === "object")
-    return true;
-  if (isKnownSchemaType(declared))
-    return false;
-  if (schema && isSchemaNode(schema.properties))
-    return true;
-  return contributions.every((entry) => isPlainObject(entry.value));
-}
-function isArrayNode(schema, contributions) {
-  const declared = schemaType(schema);
-  if (declared === "array")
-    return true;
-  if (isKnownSchemaType(declared))
-    return false;
-  return contributions.every((entry) => Array.isArray(entry.value));
-}
-function mergeDeny(contributions, policy, key, context) {
-  const denyContributions = contributions.map((entry) => ({
-    tier: entry.source.tier,
-    value: entry.value,
-    ...entry.source.file === undefined ? {} : { file: entry.source.file },
-    ...entry.source.trust === undefined ? {} : { trust: entry.source.trust }
-  }));
-  const resolution = policy === "boolean-false" ? resolveBooleanDeny(denyContributions) : resolveArrayDeny(denyContributions);
-  const entry = denyProvenance(denyContributions, resolution, key);
-  if (entry)
-    context.provenance.set(key, entry);
-  for (const member of denyMemberProvenance(denyContributions, resolution, key)) {
-    context.provenance.set(member.key, member);
-  }
-  return resolution.value;
-}
-function mergeObject(contributions, schema, key, context, depth) {
-  const objects = contributions.filter((entry) => isConfigObject(entry.value));
-  if (objects.length === 0) {
-    const winner = contributions[contributions.length - 1];
-    stamp(context, winner, key);
-    return winner.value;
-  }
-  const names = [];
-  for (const entry of objects) {
-    for (const name of Object.keys(entry.value)) {
-      if (names.includes(name))
-        continue;
-      if (isUnsafeConfigKey(name)) {
-        record(context, {
-          code: "PILENS_CFG_0006",
-          key: `${key}/${name}`,
-          reason: UNSAFE_KEY_REASON
-        });
-        continue;
-      }
-      names.push(name);
-    }
-  }
-  const out = {};
-  for (const name of names) {
-    const childKey = `${key}/${name}`;
-    const childContributions = [];
-    for (const entry of objects) {
-      const parent = entry.value;
-      if (!Object.hasOwn(parent, name))
-        continue;
-      childContributions.push({
-        source: entry.source,
-        value: parent[name],
-        rank: entry.rank
-      });
-    }
-    const merged = mergeNode(childContributions, propertySchema(schema, name), childKey, context, depth + 1);
-    if (merged !== undefined)
-      safeAssign(out, name, merged);
-  }
-  return out;
-}
-function mergeArray(contributions, schema, key, context, depth) {
-  const arrays = contributions.filter((entry) => Array.isArray(entry.value));
-  if (arrays.length === 0) {
-    const winner = contributions[contributions.length - 1];
-    stamp(context, winner, key);
-    return winner.value;
-  }
-  const strategy = mergeStrategyOf(schema);
-  const keyed = keyedField(strategy);
-  if (keyed !== undefined) {
-    return mergeKeyedArray(arrays, schema, keyed, key, context, depth);
-  }
-  if (strategy === "append")
-    return appendArrays(arrays, key, context);
-  const winner = arrays[arrays.length - 1];
-  stamp(context, winner, key);
-  return [...winner.value];
-}
-function appendArrays(arrays, key, context) {
-  const out = [];
-  for (const entry of arrays) {
-    for (const member of entry.value) {
-      stamp(context, entry, `${key}/${out.length}`);
-      out.push(member);
-    }
-  }
-  stamp(context, arrays[0], key);
-  return out;
-}
-function mergeKeyedArray(arrays, schema, field, key, context, depth) {
-  const items = itemsSchema(schema);
-  const order = [];
-  const groups = new Map;
-  const unkeyed = [];
-  for (const entry of arrays) {
-    for (const member of entry.value) {
-      const identity = keyIdentity(member, field);
-      const memberContribution = {
-        source: entry.source,
-        value: member,
-        rank: entry.rank
-      };
-      if (identity === undefined) {
-        unkeyed.push(memberContribution);
-        continue;
-      }
-      const group = groups.get(identity);
-      if (group) {
-        group.push(memberContribution);
-        continue;
-      }
-      order.push(identity);
-      groups.set(identity, [memberContribution]);
-    }
-  }
-  const out = [];
-  const pushMerged = (group) => {
-    const merged = mergeNode(group, items, `${key}/${out.length}`, context, depth + 1);
-    if (merged !== undefined)
-      out.push(merged);
-  };
-  for (const identity of order)
-    pushMerged(groups.get(identity) ?? []);
-  for (const entry of unkeyed)
-    pushMerged([entry]);
-  stamp(context, arrays[0], key);
-  return out;
-}
-function keyIdentity(member, field) {
-  if (!isConfigObject(member))
-    return;
-  const value = member[field];
-  if (typeof value === "string")
-    return `s:${value}`;
-  if (typeof value === "number" && Number.isFinite(value)) {
-    return `n:${String(value)}`;
-  }
-  return;
-}

package/extensions/dm-lens/dist/clients/config-core/normalize.js

@@ -1,217 +0,0 @@
-import { additionalPropertyPolicy, isKnownSchemaType, isPlainObject, isSchemaNode, itemsSchema, propertySchema, schemaType } from "./schema.js";
-import { isUnsafeConfigKey, MAX_CONFIG_DEPTH, safeAssign, UNSAFE_KEY_REASON } from "./safe-object.js";
-import { boundedKeyLabel, jsonTypeName, MigrationRecordCollector, migrationSubject } from "./records.js";
-import { errorClassName } from "../error-class.js";
-
-export { MAX_CONFIG_DEPTH };
-const DROPPED = Symbol("dropped");
-const OPEN_SCHEMA = { additionalProperties: true };
-export function validate(raw, schema, options = {}) {
-  const collector = options.collector ?? new MigrationRecordCollector;
-  const file = options.file ?? "";
-  const context = {
-    collector,
-    file,
-    tier: options.tier,
-    path: []
-  };
-  let walked;
-  try {
-    walked = walk(raw, schema, context, 0, new Set);
-  } catch (error) {
-    record(context, {
-      code: "PILENS_CFG_0005",
-      key: "",
-      reason: `config validation failed internally (${errorClassName(error)}); document ignored`
-    });
-    walked = DROPPED;
-  }
-  return {
-    value: walked === DROPPED ? undefined : walked,
-    records: collector.records,
-    droppedRecordCount: collector.droppedCount
-  };
-}
-function pointerOf(path) {
-  return path.length === 0 ? "" : `/${path.join("/")}`;
-}
-function record(context, entry) {
-  const key = boundedKeyLabel(entry.key);
-  context.collector.add({
-    code: entry.code,
-    file: context.file,
-    key,
-    subject: migrationSubject(context.file, key),
-    reason: entry.reason,
-    tier: context.tier
-  });
-}
-function walk(value, schema, context, depth, onPath) {
-  const pointer = pointerOf(context.path);
-  if (depth > MAX_CONFIG_DEPTH) {
-    record(context, {
-      code: "PILENS_CFG_0005",
-      key: pointer,
-      reason: `config nesting exceeds ${MAX_CONFIG_DEPTH} levels; ignored`
-    });
-    return DROPPED;
-  }
-  if (typeof value === "object" && value !== null) {
-    if (onPath.has(value)) {
-      record(context, {
-        code: "PILENS_CFG_0005",
-        key: pointer,
-        reason: "config value refers to itself; ignored"
-      });
-      return DROPPED;
-    }
-  }
-  const declared = schemaType(schema);
-  if (declared === "object")
-    return walkObject(value, schema, context, depth, onPath);
-  if (declared === "array")
-    return walkArray(value, schema, context, depth, onPath);
-  if (isKnownSchemaType(declared)) {
-    return walkScalar(value, schema, context, declared);
-  }
-  return walkOpaque(value, schema, context, depth, onPath);
-}
-function walkOpaque(value, schema, context, depth, onPath) {
-  if (isPlainObject(value)) {
-    const effective = claimsChildren(schema) ? schema : OPEN_SCHEMA;
-    return walkObject(value, effective, context, depth, onPath);
-  }
-  if (Array.isArray(value)) {
-    return walkArray(value, schema, context, depth, onPath);
-  }
-  return walkLeaf(value, schema, context);
-}
-function claimsChildren(schema) {
-  if (!schema)
-    return false;
-  return isSchemaNode(schema.properties) || isSchemaNode(schema.patternProperties) || schema.additionalProperties !== undefined;
-}
-function walkLeaf(value, schema, context) {
-  if (!isConfigScalar(value)) {
-    record(context, {
-      code: "PILENS_CFG_0005",
-      key: pointerOf(context.path),
-      reason: `config value is not valid JSON data (${jsonTypeName(value)}); ignored`
-    });
-    return DROPPED;
-  }
-  return checkEnum(value, schema, context) ? value : DROPPED;
-}
-function isConfigScalar(value) {
-  if (value === null)
-    return true;
-  const type = typeof value;
-  if (type === "string" || type === "boolean")
-    return true;
-  return type === "number" && Number.isFinite(value);
-}
-function walkObject(value, schema, context, depth, onPath) {
-  if (!isPlainObject(value)) {
-    record(context, {
-      code: "PILENS_CFG_0005",
-      key: pointerOf(context.path),
-      reason: `expected an object, got ${jsonTypeName(value)}; ignored`
-    });
-    return DROPPED;
-  }
-  const nextPath = onPath.add(value);
-  const policy = additionalPropertyPolicy(schema);
-  const out = {};
-  for (const [name, child] of Object.entries(value)) {
-    if (rejectUnsafeKey(name, context))
-      continue;
-    const childSchema = propertySchema(schema, name);
-    let effective = childSchema;
-    if (!childSchema) {
-      if (policy.kind === "drop") {
-        context.path.push(name);
-        record(context, {
-          code: "PILENS_CFG_0004",
-          key: pointerOf(context.path),
-          reason: "unknown config field; ignored"
-        });
-        context.path.pop();
-        continue;
-      }
-      effective = policy.kind === "validate" ? policy.schema : undefined;
-    }
-    context.path.push(name);
-    const walked = walk(child, effective, context, depth + 1, nextPath);
-    context.path.pop();
-    if (walked !== DROPPED)
-      safeAssign(out, name, walked);
-  }
-  nextPath.delete(value);
-  return out;
-}
-function rejectUnsafeKey(name, context) {
-  if (!isUnsafeConfigKey(name))
-    return false;
-  context.path.push(name);
-  record(context, {
-    code: "PILENS_CFG_0006",
-    key: pointerOf(context.path),
-    reason: UNSAFE_KEY_REASON
-  });
-  context.path.pop();
-  return true;
-}
-function walkArray(value, schema, context, depth, onPath) {
-  if (!Array.isArray(value)) {
-    record(context, {
-      code: "PILENS_CFG_0005",
-      key: pointerOf(context.path),
-      reason: `expected an array, got ${jsonTypeName(value)}; ignored`
-    });
-    return DROPPED;
-  }
-  const nextPath = onPath.add(value);
-  const items = itemsSchema(schema);
-  const out = [];
-  for (const [index, entry] of value.entries()) {
-    context.path.push(String(index));
-    const walked = walk(entry, items, context, depth + 1, nextPath);
-    context.path.pop();
-    if (walked !== DROPPED)
-      out.push(walked);
-  }
-  nextPath.delete(value);
-  return out;
-}
-const SCALAR_CHECKS = {
-  string: (value) => typeof value === "string",
-  number: (value) => typeof value === "number" && Number.isFinite(value),
-  integer: (value) => typeof value === "number" && Number.isInteger(value),
-  boolean: (value) => typeof value === "boolean",
-  null: (value) => value === null
-};
-function walkScalar(value, schema, context, declared) {
-  const check = SCALAR_CHECKS[declared];
-  if (!check(value)) {
-    record(context, {
-      code: "PILENS_CFG_0005",
-      key: pointerOf(context.path),
-      reason: `expected ${declared}, got ${jsonTypeName(value)}; ignored`
-    });
-    return DROPPED;
-  }
-  return checkEnum(value, schema, context) ? value : DROPPED;
-}
-function checkEnum(value, schema, context) {
-  const allowed = schema?.enum;
-  if (!Array.isArray(allowed))
-    return true;
-  if (allowed.some((candidate) => Object.is(candidate, value)))
-    return true;
-  record(context, {
-    code: "PILENS_CFG_0005",
-    key: pointerOf(context.path),
-    reason: `value is not one of ${allowed.map((candidate) => JSON.stringify(candidate)).join(", ")}; ignored`
-  });
-  return false;
-}

package/extensions/dm-lens/dist/clients/config-core/process-spec.js

@@ -1,147 +0,0 @@
-import { incrementDegradationCount } from "../degradation-ledger.js";
-import { homeRelativePath } from "../path-utils.js";
-import { getProjectTrustGeneration, getProjectTrustState } from "../project-trust.js";
-import { compareKeys, isRepoTier } from "./provenance.js";
-export const MAX_ARGV_ENTRIES = 128;
-const MAX_ARGV_BYTES = 32 * 1024;
-export const MAX_ENV_ENTRIES = 64;
-export const MAX_ENV_BYTES = 16 * 1024;
-export const MAX_TIMEOUT_MS = 10 * 60 * 1000;
-const CWD_MODES = ["root", "file-dir"];
-const INPUT_MODES = ["none", "stdin", "file"];
-function byteLength(text) {
-  return Buffer.byteLength(text, "utf8");
-}
-export function buildProcessSpec(input) {
-  const argv = input.argv;
-  if (argv.length === 0) {
-    return reject("empty-argv", "argv is empty; a spec needs a command");
-  }
-  if (argv.length > MAX_ARGV_ENTRIES) {
-    return reject("argv-too-many", `argv has ${argv.length} entries, limit ${MAX_ARGV_ENTRIES}`);
-  }
-  if (!argv.every((entry) => typeof entry === "string")) {
-    return reject("argv-not-strings", "argv entries must all be strings");
-  }
-  const argvStrings = argv;
-  const argvBytes = argvStrings.reduce((total, entry) => total + byteLength(entry), 0);
-  if (argvBytes > MAX_ARGV_BYTES) {
-    return reject("argv-too-large", `argv is ${argvBytes} bytes, limit ${MAX_ARGV_BYTES}`);
-  }
-  if (argvStrings[0].length === 0) {
-    return reject("empty-argv", "argv[0] is empty; a spec needs a command");
-  }
-  const rawEnv = input.env ?? {};
-  const envNames = Object.keys(rawEnv);
-  if (envNames.length > MAX_ENV_ENTRIES) {
-    return reject("env-too-many", `env has ${envNames.length} entries, limit ${MAX_ENV_ENTRIES}`);
-  }
-  const env = {};
-  let envBytes = 0;
-  for (const name of envNames) {
-    const value = rawEnv[name];
-    if (typeof value !== "string") {
-      return reject("env-not-strings", "env values must all be strings");
-    }
-    envBytes += byteLength(name) + byteLength(value);
-    env[name] = value;
-  }
-  if (envBytes > MAX_ENV_BYTES) {
-    return reject("env-too-large", `env is ${envBytes} bytes, limit ${MAX_ENV_BYTES}`);
-  }
-  const cwdMode = input.cwdMode ?? "root";
-  if (!CWD_MODES.includes(cwdMode)) {
-    return reject("invalid-cwd-mode", "cwdMode must be root or file-dir");
-  }
-  const inputMode = input.inputMode ?? "none";
-  if (!INPUT_MODES.includes(inputMode)) {
-    return reject("invalid-input-mode", "inputMode must be none, stdin or file");
-  }
-  const timeoutMs = input.timeoutMs;
-  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMEOUT_MS) {
-    return reject("invalid-timeout", `timeoutMs must be a finite value in (0, ${MAX_TIMEOUT_MS}]`);
-  }
-  return {
-    ok: true,
-    spec: {
-      argv: argvStrings,
-      env,
-      cwdMode,
-      inputMode,
-      timeoutMs,
-      provenance: input.provenance,
-      trust: input.trust ?? getProjectTrustState()
-    }
-  };
-}
-function reject(code, reason) {
-  return { ok: false, rejection: { code, reason } };
-}
-const TRUST_REFUSAL_KIND = "trust-refusal";
-export function toSpawnArgs(spec) {
-  const tier = spec.provenance.tier;
-  if (!isRepoTier(tier)) {
-    return { ok: true, args: spawnArgsOf(spec) };
-  }
-  const hostTrust = getProjectTrustState();
-  if (spec.trust !== "trusted") {
-    return refuse(spec, "spec-trust", hostTrust);
-  }
-  if (hostTrust !== "trusted") {
-    return refuse(spec, "host-trust", hostTrust);
-  }
-  return { ok: true, args: spawnArgsOf(spec) };
-}
-function spawnArgsOf(spec) {
-  return {
-    argv: spec.argv,
-    env: spec.env,
-    cwdMode: spec.cwdMode,
-    inputMode: spec.inputMode,
-    timeoutMs: spec.timeoutMs
-  };
-}
-function refuse(spec, cause, hostTrust) {
-  const tier = spec.provenance.tier;
-  const command = spec.argv[0];
-  const reason = cause === "spec-trust" ? `${tier} config command refused: config trust is ${spec.trust}` : `${tier} config command refused: host trust is now ${hostTrust}`;
-  const trustGeneration = getProjectTrustGeneration();
-  const refusal = {
-    kind: "trust-refusal",
-    cause,
-    reason,
-    tier,
-    command,
-    specTrust: spec.trust,
-    hostTrust,
-    trustGeneration
-  };
-  incrementDegradationCount({
-    kind: TRUST_REFUSAL_KIND,
-    subject: `config-command:g${trustGeneration}:${tier}:${command}`,
-    reason,
-    metadata: {
-      cause,
-      specTrust: spec.trust,
-      hostTrust,
-      trustGeneration,
-      configKey: spec.provenance.key
-    }
-  });
-  return { ok: false, refusal };
-}
-export function redactProcessSpec(spec) {
-  return {
-    command: spec.argv[0],
-    argvCount: spec.argv.length,
-    envNames: Object.keys(spec.env).sort(compareKeys),
-    envCount: Object.keys(spec.env).length,
-    cwdMode: spec.cwdMode,
-    inputMode: spec.inputMode,
-    timeoutMs: spec.timeoutMs,
-    tier: spec.provenance.tier,
-    configKey: spec.provenance.key,
-    ...spec.provenance.file === undefined ? {} : { file: homeRelativePath(spec.provenance.file) },
-    trust: spec.trust
-  };
-}

package/extensions/dm-lens/dist/clients/config-core/provenance.js

@@ -1,54 +0,0 @@
-import { homeRelativePath } from "../path-utils.js";
-export const SOURCE_TIERS = [
-  "builtin",
-  "global",
-  "project",
-  "nested-project",
-  "env",
-  "cli",
-  "host"
-];
-export const TIER_CLASS = {
-  builtin: "default",
-  global: "operator",
-  project: "repo",
-  "nested-project": "repo",
-  env: "operator",
-  cli: "operator",
-  host: "operator"
-};
-export function tierPrecedence(tier) {
-  return SOURCE_TIERS.indexOf(tier);
-}
-export function isRepoTier(tier) {
-  return TIER_CLASS[tier] === "repo";
-}
-export function isOperatorTier(tier) {
-  return TIER_CLASS[tier] === "operator";
-}
-export function provenanceView(resolved, homeDir) {
-  const entries = [...resolved.provenance.values()].map((entry) => ({
-    key: entry.key,
-    tier: entry.tier,
-    ...entry.file === undefined ? {} : { file: homeRelativePath(entry.file, homeDir) },
-    ...entry.trust === undefined ? {} : { trust: entry.trust }
-  })).sort((left, right) => compareKeys(left.key, right.key));
-  return { entries };
-}
-export function provenanceFor(resolved, pointer) {
-  let candidate = pointer;
-  for (;; ) {
-    const entry = resolved.provenance.get(candidate);
-    if (entry)
-      return entry;
-    if (candidate === "")
-      return;
-    const cut = candidate.lastIndexOf("/");
-    candidate = cut <= 0 ? "" : candidate.slice(0, cut);
-  }
-}
-export function compareKeys(left, right) {
-  if (left < right)
-    return -1;
-  return left > right ? 1 : 0;
-}