@haystackeditor/cli 0.15.26 → 0.15.27

package/dist/commands/cloud-verifier-data-store-drift.js

@@ -0,0 +1,158 @@
+/**
+ * Data-store drift check.
+ *
+ * A checked-in universe map lists the stores the Cloud Verifier clones. As the
+ * app changes, that map silently goes stale — a new Redis nobody added to the
+ * map, or a Mongo the code dropped — and a stale map makes the verifier clone
+ * the wrong things. The static detector is a pure function of the repo, so the
+ * only moment repo-derived drift can enter is a change to a file the detector
+ * reads. This command catches that at the source: re-detect the stores, diff
+ * against the checked-in baseline, and flag the delta.
+ *
+ * It is built to run per-PR and cost almost nothing: given a base ref, it first
+ * checks whether the diff touches any file the detector reads (the exact gate —
+ * nothing else can change the result) and exits immediately if not.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { findGitRoot } from '../utils/hooks.js';
+import { collectDataStores, isDataStoreInputName } from './cloud-verifier-identity-census.js';
+export const DATA_STORE_BASELINE_PATH = '.haystack/cloud-verifier/data-stores.json';
+export const DATA_STORE_BASELINE_SCHEMA = 'cloud-verifier-data-stores-v1';
+function snapshot(store) {
+    return {
+        engine: store.engine,
+        category: store.category,
+        confidence: store.confidence,
+        clone_strategy: store.clone_strategy,
+    };
+}
+/** Diff two store lists by engine. Pure and order-independent. */
+export function diffDataStores(baseline, current) {
+    const baseByEngine = new Map(baseline.map((store) => [store.engine, store]));
+    const currentByEngine = new Map(current.map((store) => [store.engine, store]));
+    const added = current.filter((store) => !baseByEngine.has(store.engine));
+    const removed = baseline.filter((store) => !currentByEngine.has(store.engine));
+    const changed = [];
+    for (const store of current) {
+        const before = baseByEngine.get(store.engine);
+        if (before && (before.confidence !== store.confidence || before.category !== store.category)) {
+            changed.push({
+                engine: store.engine,
+                from: `${before.category}/${before.confidence}`,
+                to: `${store.category}/${store.confidence}`,
+            });
+        }
+    }
+    return { added, removed, changed };
+}
+export function hasDrift(drift) {
+    return drift.added.length > 0 || drift.removed.length > 0 || drift.changed.length > 0;
+}
+function gitTrackedFiles(root) {
+    return execFileSync('git', ['-C', root, 'ls-files', '-z'], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 })
+        .split('\0')
+        .filter(Boolean);
+}
+// Files changed between a base ref and HEAD. Returns null if git cannot resolve
+// the ref (e.g. a shallow clone missing the base) so the caller can fall back to
+// a full check rather than a false "no store changes" skip.
+function changedFiles(root, baseRef) {
+    try {
+        const range = `${baseRef}...HEAD`;
+        // --no-renames so a rename shows both the removed and added path. Otherwise
+        // renaming an input file to a non-input name (docker-compose.yml -> .bak)
+        // would report only the irrelevant destination and the gate would wrongly
+        // skip a change that actually dropped a store.
+        return execFileSync('git', ['-C', root, 'diff', '--name-only', '--no-renames', range], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+            .split('\n')
+            .filter(Boolean);
+    }
+    catch {
+        return null;
+    }
+}
+function currentStores(root) {
+    return collectDataStores(root, gitTrackedFiles(root)).map(snapshot);
+}
+function readBaseline(path) {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    if (parsed.schema !== DATA_STORE_BASELINE_SCHEMA || !Array.isArray(parsed.stores)) {
+        throw new Error(`Not a data-store baseline (${DATA_STORE_BASELINE_SCHEMA}): ${path}`);
+    }
+    return parsed.stores;
+}
+function writeBaseline(path, stores) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify({ schema: DATA_STORE_BASELINE_SCHEMA, stores }, null, 2)}\n`);
+}
+function emit(payload, json) {
+    if (json) {
+        process.stdout.write(`${JSON.stringify({ schema: 'cloud-verifier-data-store-drift-v1', ...payload }, null, 2)}\n`);
+    }
+}
+export function cloudVerifierDataStoreDriftCommand(options) {
+    const root = options.root ? resolve(options.root) : (findGitRoot() ?? process.cwd());
+    // resolve (not join) so an absolute --baseline is honored as-is and a relative
+    // one resolves against the repo root.
+    const baselinePath = resolve(root, options.baseline ?? DATA_STORE_BASELINE_PATH);
+    // Path gate: with a base ref, skip unless the diff touches a file the detector
+    // reads. This is exact — a file outside that set cannot change the stores.
+    if (options.baseRef && !options.update) {
+        const changed = changedFiles(root, options.baseRef);
+        if (changed !== null) {
+            const relevant = changed.filter((path) => isDataStoreInputName(basename(path).toLowerCase()));
+            if (relevant.length === 0) {
+                emit({ status: 'skipped', reason: 'no-store-relevant-changes', changed_files: changed.length }, options.json ?? false);
+                if (!options.json) {
+                    process.stdout.write('Data-store drift: no store-relevant files changed — skipped.\n');
+                }
+                return;
+            }
+        }
+    }
+    const current = currentStores(root);
+    if (options.update) {
+        writeBaseline(baselinePath, current);
+        emit({ status: 'updated', baseline: options.baseline ?? DATA_STORE_BASELINE_PATH, stores: current }, options.json ?? false);
+        if (!options.json) {
+            process.stdout.write(`Data-store baseline written: ${current.length} stores → ${options.baseline ?? DATA_STORE_BASELINE_PATH}\n`);
+        }
+        return;
+    }
+    if (!existsSync(baselinePath)) {
+        // Not opted in yet: a safe no-op so the check can be added to CI broadly
+        // without breaking repos that have not created a baseline.
+        emit({ status: 'no-baseline', baseline: options.baseline ?? DATA_STORE_BASELINE_PATH }, options.json ?? false);
+        if (!options.json) {
+            process.stdout.write(`Data-store drift: no baseline at ${options.baseline ?? DATA_STORE_BASELINE_PATH}. `
+                + 'Create one with `--update`.\n');
+        }
+        return;
+    }
+    const drift = diffDataStores(readBaseline(baselinePath), current);
+    if (!hasDrift(drift)) {
+        emit({ status: 'ok', stores: current.length }, options.json ?? false);
+        if (!options.json) {
+            process.stdout.write(`Data-store drift: none — map matches ${current.length} detected stores.\n`);
+        }
+        return;
+    }
+    emit({ status: 'drift', drift }, options.json ?? false);
+    if (!options.json) {
+        process.stdout.write('Data-store drift detected — the universe map is out of date:\n');
+        for (const store of drift.added) {
+            process.stdout.write(`  + ${store.engine} (${store.category}, ${store.confidence}) — detected, not in the map\n`);
+        }
+        for (const store of drift.removed) {
+            process.stdout.write(`  - ${store.engine} (${store.category}) — in the map, no longer detected\n`);
+        }
+        for (const change of drift.changed) {
+            process.stdout.write(`  ~ ${change.engine}: ${change.from} → ${change.to}\n`);
+        }
+        process.stdout.write('Sync the map with `--update`, or update the universe map to match.\n');
+    }
+    // Non-zero exit so a CI gate fails until the map is reconciled.
+    process.exitCode = 1;
+}

package/dist/commands/cloud-verifier-identity-census.d.ts

@@ -0,0 +1,88 @@
+import { type DataStore } from './cloud-verifier-data-store-census.js';
+export declare const IDENTITY_CENSUS_SCHEMA_VERSION = "cloud-verifier-identity-census-v1";
+export declare const IDENTITY_CENSUS_CONTRACT_REVISION = 39;
+export type IdentityCensusProjection = 'runtime_roles' | 'stateful_resources' | 'external_dependencies' | 'registry_families' | 'registry_entries' | 'registry_edges';
+export type IdentityCensusProofStatus = 'proof-complete' | 'discovery-lead' | 'non-inventory';
+export interface IdentityCensusSource {
+    path: string;
+    start_line: number;
+    end_line: number;
+    anchor: string;
+}
+export interface IdentityCensusMatrixAxis {
+    symbol_identity_key: string;
+    item_identity_key: string;
+    item_value: string;
+    source: IdentityCensusSource;
+}
+export interface IdentityCensusRecord {
+    id: string;
+    kind: string;
+    projections: IdentityCensusProjection[];
+    presumptive_inventory: boolean;
+    proof_status: IdentityCensusProofStatus;
+    semantic_identity_id?: string;
+    execution_identity_id?: string;
+    identity_components?: Record<string, string | string[]>;
+    missing_proof_components?: string[];
+    owner_identity_key: string;
+    identity_key: string;
+    selector_key?: string;
+    implementation_key?: string;
+    operation_token?: string;
+    address_token?: string;
+    package_name?: string;
+    package_version?: string;
+    package_artifact_kind?: string;
+    package_artifact_filename?: string;
+    package_artifact_url?: string;
+    package_artifact_hash?: string;
+    operation_identity_key?: string;
+    materialization_root_identity_key?: string;
+    reproduction_operation_token?: string;
+    matrix_axes?: IdentityCensusMatrixAxis[];
+    selector_family_record_id?: string;
+    parent_selector_entry_record_id?: string;
+    child_selector_family_record_id?: string;
+    relation_kind?: 'implementation-owns-selector' | 'implementation-invokes-selector' | 'parent-key-partitions-selector';
+    source: IdentityCensusSource;
+    supporting_tokens: string[];
+}
+export interface IdentityCensusResult {
+    schema_version: typeof IDENTITY_CENSUS_SCHEMA_VERSION;
+    contract_revision: typeof IDENTITY_CENSUS_CONTRACT_REVISION;
+    repository_root: string;
+    source_commit: string | null;
+    source_tree: string | null;
+    source_manifest: {
+        digest: string;
+        tracked_files_total: number;
+        production_files_scanned: number;
+        files_omitted: number;
+    };
+    record_digest: string;
+    counts: {
+        records: number;
+        by_kind: Record<string, number>;
+        by_projection: Record<string, number>;
+        by_proof_status: Record<IdentityCensusProofStatus, number>;
+        presumptive_inventory: number;
+    };
+    projection_record_ids: Record<IdentityCensusProjection, string[]>;
+    records: IdentityCensusRecord[];
+    omissions: Array<{
+        path: string;
+        reason: string;
+    }>;
+    data_stores: DataStore[];
+}
+export declare function isDataStoreInputName(lowerName: string): boolean;
+export declare function collectDataStores(root: string, tracked: string[], omissions?: Array<{
+    path: string;
+    reason: string;
+}>): DataStore[];
+export declare function scanUniverseIdentities(repositoryRoot: string): IdentityCensusResult;
+export declare function cloudVerifierIdentityCensusCommand(options: {
+    json?: boolean;
+    root?: string;
+}): void;