@graphrefly/stack 0.1.0

package/dist/assets/fixtures/flagship/v1/repository-template.json

@@ -0,0 +1,48 @@
+{
+	"schema": "urn:graphrefly-stack:fixture-repository-template:v1",
+	"scenario": "refresh-token-rotation-v1",
+	"stages": {
+		"B0": {
+			".gitignore": ".graphrefly-stack-fixture\n.graphrefly-stack/\n",
+			"package.json": "{\"name\":\"graphrefly-refresh-session-fixture\",\"private\":true,\"type\":\"module\",\"dependencies\":{\"@graphrefly/ts\":\"0.1.1\"}}\n",
+			"fixture-check.mjs": "import assert from 'node:assert/strict';\nimport { readFileSync } from 'node:fs';\nconst checkId = process.argv[2];\nconst read = (path) => readFileSync(new URL(path, import.meta.url), 'utf8');\nif (checkId === 'contracts') {\n  assert.match(read('./src/session/contracts.ts'), /RefreshResult/);\n} else if (checkId === 'refresh-runtime') {\n  const source = read('./src/session/flows/refresh-flow.ts');\n  assert.match(source, /replay/);\n  assert.match(source, /-rotated/);\n  assert.match(source, /family-1/);\n} else if (checkId === 'refresh-api') {\n  const source = read('./src/http/refresh-route.ts');\n  assert.match(source, /status: 200/);\n  assert.match(source, /body: refresh/);\n} else {\n  throw new Error('unknown fixture check: ' + checkId);\n}\nprocess.stdout.write('ok ' + checkId + '\\n');\n",
+			"graphrefly-fixture.mjs": "import { createHash } from 'node:crypto';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { addPasswordResetGraph } from './src/session/flows/password-reset-flow.ts';\nimport { addRefreshGraph } from './src/session/flows/refresh-flow.ts';\nfor (const name of ['GRAPHREFLY_GRAPH_MODULE_URL', 'GRAPHREFLY_OPERATORS_MODULE_URL', 'GRAPHREFLY_RENDER_MODULE_URL']) {\n  if (!process.env[name]) throw new Error('missing GraphReFly runtime module: ' + name);\n}\nconst graphApi = await import(process.env.GRAPHREFLY_GRAPH_MODULE_URL);\nconst operatorApi = await import(process.env.GRAPHREFLY_OPERATORS_MODULE_URL);\nconst renderApi = await import(process.env.GRAPHREFLY_RENDER_MODULE_URL);\nconst policy = JSON.parse(readFileSync(new URL('./src/session/policy.json', import.meta.url), 'utf8'));\nconst runtimeGraph = graphApi.graph({ name: 'session' });\naddPasswordResetGraph(runtimeGraph, operatorApi);\naddRefreshGraph(runtimeGraph, operatorApi);\nif (existsSync(new URL('./src/telemetry/session.ts', import.meta.url))) {\n  const telemetry = await import('./src/telemetry/session.ts');\n  telemetry.addTelemetryGraph(runtimeGraph);\n}\nconst blueprint = await graphApi.withBlueprintHash(\n  runtimeGraph.blueprint({ diagnostics: true, provenance: { source: '@graphrefly/ts', api: 'graph.blueprint()', revision: process.env.GRAPHREFLY_STACK_REVISION, isolation: process.env.GRAPHREFLY_STACK_ISOLATION, entrypoint: 'graphrefly-fixture.mjs' } }),\n  { algorithm: 'sha256', hash: (bytes) => createHash('sha256').update(bytes).digest('hex') },\n);\nconst diagram = renderApi.describeToMermaid(runtimeGraph.describe(), { direction: 'LR' });\nprocess.stdout.write(JSON.stringify({\n  policyRevision: policy.revision,\n  blueprint,\n  diagram: { format: 'mermaid', source: diagram, renderer: '@graphrefly/ts/render.describeToMermaid' },\n}));\n",
+			"src/session/flows/refresh-flow.ts": "export function addRefreshGraph() {}\nexport function refresh(token: string) { return { token, familyId: 'family-1' }; }\n",
+			"src/http/refresh-route.ts": "import { refresh } from '../session/flows/refresh-flow.js';\nexport const postRefresh = refresh;\n",
+			"src/session/flows/password-reset-flow.ts": "export function addPasswordResetGraph(graph) {\n  const intent = graph.state(null, { name: 'password-reset.intent' });\n  graph.effect([intent], () => undefined, { name: 'session.persist.password-reset', meta: { capability: 'session-mutation', mode: 'online' } });\n}\nexport const resetPassword = () => 'persist-direct';\n",
+			"src/session/policy.json": "{\"revision\":\"session-writes.v1\",\"brokerRequired\":false}\n",
+			"tests/session/password-reset-flow.test.ts": "// baseline password-reset behavior\n"
+		},
+		"U1": {
+			"src/session/contracts.ts": "export interface RefreshResult { token: string; familyId: string }\n",
+			"tests/session/contracts.test.ts": "// token-family and replay-rejection contract\n"
+		},
+		"U2": {
+			"src/session/flows/refresh-flow.ts": "const used = new Set<string>();\nexport function addRefreshGraph(graph) {\n  const request = graph.state(null, { name: 'refresh.request' });\n  const validate = graph.derived([request], (token) => token, { name: 'refresh.validate' });\n  const rotate = graph.derived([validate], (token) => token, { name: 'refresh.rotate' });\n  graph.effect([rotate], () => undefined, { name: 'session.persist.refresh', meta: { capability: 'session-mutation', mode: 'online' } });\n}\nexport function refresh(token: string) {\n  if (used.has(token)) throw new Error('replay');\n  used.add(token);\n  return { token: token + '-rotated', familyId: 'family-1' };\n}\n",
+			"tests/session/refresh-flow.test.ts": "// replacement token, stable family, and replay rejection\n"
+		},
+		"U3": {
+			"src/http/refresh-route.ts": "import { refresh } from '../session/flows/refresh-flow.js';\nexport function postRefresh(token: string) { return { status: 200, body: refresh(token) }; }\n",
+			"tests/http/refresh-route.test.ts": "// HTTP adapter returns replacement token\n"
+		},
+		"A1": {
+			"src/session/flows/password-reset-flow.ts": "export function addPasswordResetGraph(graph, operators) {\n  const intent = graph.state(null, { name: 'password-reset.intent' });\n  const broker = graph.initNode({ ...operators.map((value) => value), factory: 'sessionMutationBroker' }, [intent], { name: 'session.mutation-broker.password-reset', meta: { capability: 'session-mutation-broker' } });\n  graph.effect([broker], () => undefined, { name: 'session.persist.password-reset', meta: { capability: 'session-mutation', mode: 'online' } });\n}\nexport const resetPassword = () => 'persist-via-session-mutation-broker';\n",
+			"src/session/policy.json": "{\"revision\":\"session-writes.v2\",\"brokerRequired\":true}\n",
+			"tests/session/password-reset-flow.test.ts": "// online session writes require the broker\n"
+		},
+		"U2_PRIME": {
+			"src/session/flows/refresh-flow.ts": "const used = new Set<string>();\nconst persistViaBroker = (token: string) => token;\nexport function addRefreshGraph(graph, operators) {\n  const request = graph.state(null, { name: 'refresh.request' });\n  const validate = graph.derived([request], (token) => token, { name: 'refresh.validate' });\n  const rotate = graph.derived([validate], (token) => token, { name: 'refresh.rotate' });\n  const broker = graph.initNode({ ...operators.map((value) => value), factory: 'sessionMutationBroker' }, [rotate], { name: 'session.mutation-broker.refresh', meta: { capability: 'session-mutation-broker' } });\n  graph.effect([broker], () => undefined, { name: 'session.persist.refresh', meta: { capability: 'session-mutation', mode: 'online' } });\n}\nexport function refresh(token: string) {\n  if (used.has(token)) throw new Error('replay');\n  used.add(token);\n  const replacement = token + '-rotated';\n  persistViaBroker(replacement);\n  return { token: replacement, familyId: 'family-1' };\n}\n",
+			"tests/session/refresh-flow.test.ts": "// replacement persists through session-mutation-broker\n"
+		},
+		"U3_PRIME": {
+			"src/http/refresh-route.ts": "import { refresh } from '../session/flows/refresh-flow.js';\n// rebound after the broker-aware runtime change\nexport function postRefresh(token: string) { return { status: 200, body: refresh(token) }; }\n",
+			"tests/http/refresh-route.test.ts": "// HTTP adapter rebound to accepted broker-aware runtime\n"
+		},
+		"TELEMETRY": {
+			"src/telemetry/session.ts": "export function addTelemetryGraph(graph) {\n  graph.state(null, { name: 'telemetry.session' });\n}\nexport const recordSessionMetric = () => undefined;\n"
+		},
+		"WRONG_SCOPE": {
+			"docs/unauthorized-session-note.md": "This path is deliberately outside U2's allowed source scope.\n"
+		}
+	}
+}