@ductape/cli 0.2.23 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.3.0 - 2026-07-26
+
+- Added AI-led migration planning with new-codebase defaults and immutable original E2E gates.
+- Added review ledgers, parity slices, multi-repository verification, SCC partition proposals, and semantic database evidence.
+- Added frontend, session, resilience, component, runtime, SDK, generated/vendor, and third-party assurance matrices.
+- Added verified product-environment create/update commands, secured artifacts, Ed25519 signatures, and parallel-review merging.
+
 ## Unreleased
 
 ### Added

package/README.md

@@ -1,5 +1,12 @@
 # @ductape/cli
 
+## AI-led codebase migration
+
+Create and pass project-level E2E tests against the original codebase first, then bind them with
+`ductape migration-e2e init`. Run `ductape migrate-codebase --e2e-baseline <manifest>`; the default is a
+separate new codebase. Migration commands record advisory or verification evidence and never generate
+application source. Finish with the unchanged original suite through `migration-e2e final`.
+
 Terminal interface for Ductape — **same transport as the Workbench** (encrypted sdk-proxy / db-proxy / graph-proxy).
 
 ## Install

package/dist/commands/db-migrate.js

@@ -11,15 +11,41 @@ async function getAppliedTags(proxy, dbContext) {
         const result = await proxy.execute('migration.history', [], dbContext);
         const list = Array.isArray(result)
             ? result
-            : Array.isArray(result.data)
+            : result !== null
+                && typeof result === 'object'
+                && Array.isArray(result.data)
                 ? result.data
-                : [];
-        return list.map((r) => r.tag ?? '').filter(Boolean);
+                : null;
+        if (!Array.isArray(list)) {
+            throw new Error('migration.history returned an invalid response instead of a history array');
+        }
+        return list.map((entry, index) => {
+            if (entry === null || typeof entry !== 'object' || typeof entry.tag !== 'string') {
+                throw new Error(`migration.history returned an invalid entry at index ${index}`);
+            }
+            return entry.tag;
+        });
     }
-    catch {
-        return [];
+    catch (error) {
+        throw new Error(`Could not read migration history for ${dbContext.product}/${dbContext.database}:${dbContext.env}. ` +
+            'Migration state is unknown; no migrations were classified as pending.', { cause: error });
     }
 }
+function getMigrationResult(response, migrationTag) {
+    if (response === null || typeof response !== 'object')
+        return null;
+    const result = response[migrationTag];
+    if (result === null || typeof result !== 'object')
+        return null;
+    const success = result.success;
+    if (typeof success !== 'boolean')
+        return null;
+    const error = result.error;
+    return {
+        success,
+        ...(typeof error === 'string' ? { error } : {}),
+    };
+}
 export async function runDbMigrate(opts) {
     const found = findProjectConfig();
     if (!found)
@@ -59,13 +85,26 @@ export async function runDbMigrate(opts) {
             }
             process.stdout.write(`  Applying ${migration.tag}... `);
             try {
-                await proxy.execute('migration.run', [[migration]], dbContext);
+                const response = await proxy.execute('migration.run', [[migration]], dbContext);
+                const migrationResult = getMigrationResult(response, migration.tag);
+                if (migrationResult && !migrationResult.success) {
+                    throw new Error(migrationResult.error ?? 'SDK reported an unsuccessful migration');
+                }
+                // A successful HTTP response is not proof that the migration was
+                // recorded. Verify history before claiming success, including when
+                // talking to older proxies that serialize Map results as `{}`.
+                const appliedAfterRun = await getAppliedTags(proxy, dbContext);
+                if (!appliedAfterRun.includes(migration.tag)) {
+                    throw new Error('the operation returned without error, but the migration tag is absent from migration history');
+                }
                 console.log('done');
                 totalApplied++;
             }
             catch (err) {
-                console.log('failed');
-                fail(`Migration "${migration.tag}" failed: ${err instanceof Error ? err.message : String(err)}`);
+                console.log('unverified');
+                fail(`Migration "${migration.tag}" could not be verified: ` +
+                    `${err instanceof Error ? err.message : String(err)}. ` +
+                    'Do not rerun it until the live schema and migration history have been inspected.');
             }
         }
     }

package/dist/commands/migrate-codebase.d.ts

@@ -0,0 +1,190 @@
+type MigrationMode = 'in-place' | 'new-codebase';
+type Language = 'typescript' | 'go' | 'java' | 'dotnet';
+interface MigrationPlan {
+    version: 2;
+    artifact_kind: 'ai_review_bootstrap';
+    authority: 'advisory_only';
+    execution_provenance?: {
+        mcp_client?: {
+            name: string;
+            version: string;
+            source: 'mcp_initialize_handshake';
+            trust: 'protocol_asserted_unverified';
+        };
+        ai_model: {
+            status: 'unavailable';
+            reason: 'MCP does not provide a server-verifiable model identity';
+        };
+    };
+    source: string;
+    mode: MigrationMode;
+    destination: string;
+    product: {
+        tag: string;
+        name: string;
+        exists?: boolean;
+        created?: boolean;
+    };
+    target_database: string;
+    languages: Language[];
+    frameworks: string[];
+    workspace_boundaries: Array<{
+        system: 'bazel' | 'buck' | 'pants' | 'nx' | 'turborepo' | 'maven' | 'gradle' | 'dotnet';
+        evidence: string[];
+        requires_ai_review: true;
+    }>;
+    workspace_units: Array<{
+        manifest: string;
+        kind: 'node' | 'go' | 'maven' | 'gradle' | 'dotnet' | 'nx';
+        nearest_boundary?: string;
+        ownership_status: 'contextual_review_required';
+    }>;
+    generated_source_hints: Array<{
+        file: string;
+        evidence: string;
+        confidence: 'low';
+        requires_ai_review: true;
+    }>;
+    scan_safety: {
+        symlinks_followed: false;
+        symlinks_skipped: string[];
+        git_submodules: Array<{
+            name: string;
+            path: string;
+            url?: string;
+        }>;
+    };
+    scan_policy: {
+        max_file_bytes: number;
+        binary_files: 'exclude';
+        include_patterns: string[];
+        exclude_patterns: string[];
+        exclusions: Array<{
+            file: string;
+            reason: string;
+        }>;
+    };
+    environments: string[];
+    secrets: Array<{
+        key: string;
+        source: string;
+        environment: string;
+        value: '[REDACTED]';
+    }>;
+    secret_references: Array<{
+        key: string;
+        source: string;
+        system: 'docker' | 'kubernetes' | 'github' | 'gitlab' | 'jenkins' | 'circleci' | 'azure_devops' | 'spring' | 'dotnet' | 'terraform' | 'aws' | 'gcp' | 'azure';
+        environment: string;
+        value: '[NOT_READ]';
+        requires_ai_review: true;
+    }>;
+    potential_secret_exposures: Array<{
+        source: string;
+        line: number;
+        kind: 'password' | 'token' | 'secret' | 'private_key' | 'connection_string';
+        fingerprint: string;
+        value: '[NOT_RETURNED]';
+        confidence: 'low';
+        requires_human_security_review: true;
+    }>;
+    deterministic_hints: {
+        databases: Array<{
+            evidence: string;
+            kind: string;
+            confidence: 'low';
+            requires_ai_review: true;
+        }>;
+        third_party_apis: Array<{
+            host: string;
+            occurrences: number;
+            methods: string[];
+            paths: string[];
+            recommended_app_tag: string;
+            confidence: 'low';
+            requires_ai_review: true;
+        }>;
+    };
+    existing_migrations: string[];
+    existing_schemas: string[];
+    migration_imports: Array<{
+        source: string;
+        checksum: string;
+        order: number;
+        status: 'manual_review_required';
+        reason: string;
+    }>;
+    conversion_warnings: string[];
+    review_queue: Array<{
+        file: string;
+        review_status: 'pending';
+        inspect_for: string[];
+        safety: 'names_only' | 'normal';
+    }>;
+    evidence_ledger_template: {
+        file: string;
+        purpose: string;
+        dependencies: string[];
+        interfaces: string[];
+        functional_parity_requirements: string[];
+        operational_parity_requirements: string[];
+        findings: Array<{
+            kind: string;
+            evidence: string;
+            location: {
+                start_line: number;
+                end_line: number;
+            };
+            symbol: {
+                kind: 'module' | 'class' | 'interface' | 'function' | 'method' | 'field' | 'route' | 'event' | 'schema' | 'other';
+                name: string;
+                qualified_name?: string;
+            };
+            classification: 'observed' | 'inferred' | 'proposed' | 'confirmed';
+            confidence: 'low' | 'medium' | 'high';
+            requires_followup: string[];
+        }>;
+        decision: 'pending';
+    };
+    ai_working_standards: {
+        global: string[];
+        languages: Record<Language, string[]>;
+    };
+    output_paths: {
+        plan: string;
+        migration_evidence: string;
+        review_ledger_template: string;
+        guide: string;
+    };
+    next_steps: string[];
+}
+export declare function writeMigrationGuidance(plan: MigrationPlan): void;
+export declare function inspectMigrationCodebase(opts: {
+    source: string;
+    mode?: MigrationMode;
+    destination?: string;
+    product?: string;
+    name?: string;
+    database?: string;
+    maxFileBytes?: number;
+    include?: string[];
+    exclude?: string[];
+}): MigrationPlan;
+export declare function runMigrateCodebase(opts: {
+    source?: string;
+    e2eBaseline: string;
+    mode?: MigrationMode;
+    destination?: string;
+    product?: string;
+    name?: string;
+    database?: string;
+    maxFileBytes?: number;
+    include?: string[];
+    exclude?: string[];
+    ensureProduct?: boolean;
+    write?: boolean;
+    json?: boolean;
+    mcpClientName?: string;
+    mcpClientVersion?: string;
+}): Promise<void>;
+export {};