@kya-os/cli 2.0.0 → 2.0.3

package/node_modules/@kya-os/contracts/dist/workbench/graph-interfaces.js

@@ -0,0 +1,302 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RepositoryIdentitySchema = exports.ParentIntegrationStatusSchema = exports.ClaimVerificationSchema = exports.ReconciliationDecisionSetSchema = exports.MaterializationPlanSchema = exports.ImportIssueV2Schema = exports.TrackDependencyV2Schema = void 0;
+exports.parseMaterializationPlan = parseMaterializationPlan;
+exports.deriveImportIssueId = deriveImportIssueId;
+exports.deriveConflictId = deriveConflictId;
+exports.parseImportIssueV2 = parseImportIssueV2;
+exports.parseClaimVerification = parseClaimVerification;
+const zod_1 = require("zod");
+const artifact_bindings_js_1 = require("./artifact-bindings.js");
+const Id = zod_1.z
+    .string()
+    .min(1)
+    .max(256)
+    .regex(/^[\x21-\x7e]+$/);
+const Count = zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const Revision = Count.positive();
+const Digest = zod_1.z
+    .string()
+    .length(64)
+    .regex(/^[a-f0-9]{64}$/);
+const RecordDigest = zod_1.z
+    .string()
+    .length(71)
+    .regex(/^sha256:[a-f0-9]{64}$/);
+const AcceptanceId = zod_1.z
+    .string()
+    .length(68)
+    .regex(/^acc:[a-f0-9]{64}$/);
+const GitObject = zod_1.z
+    .string()
+    .regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/)
+    .refine((v) => v.length === 40 || v.length === 64);
+const Text = zod_1.z.string().min(1).max(4096);
+// Claims remain inert until a separately authorized resolver handles them.
+const ClaimUri = Text.refine((uri) => {
+    if (/[\x00-\x20\x7f\\]/.test(uri) || uri.startsWith('//'))
+        return false;
+    try {
+        const parsed = new URL(uri);
+        return ['https:', 'http:'].includes(parsed.protocol) && !!parsed.hostname && !parsed.username && !parsed.password;
+    }
+    catch {
+        return !uri.includes(':');
+    }
+}, 'Evidence must be an HTTP(S) or inert relative reference');
+const Path = zod_1.z
+    .string()
+    .min(1)
+    .max(4096)
+    .refine((v) => !v.includes('\\') &&
+    !v.includes(':') &&
+    !v.split('/').some((p) => !p || p === '.' || p === '..' || p.toLowerCase() === '.git') &&
+    [...v].every((c) => c.charCodeAt(0) >= 32 && c.charCodeAt(0) !== 127), 'Unsafe materialization path');
+const unique = (items) => new Set(items).size === items.length;
+/** Unicode code point order, which is UTF-8 byte order and Rust `str` order. */
+function compareCodePoints(a, b) {
+    const left = Array.from(a, (c) => c.codePointAt(0));
+    const right = Array.from(b, (c) => c.codePointAt(0));
+    for (let i = 0; i < Math.min(left.length, right.length); i++)
+        if (left[i] !== right[i])
+            return left[i] - right[i];
+    return left.length - right.length;
+}
+/** Strictly ascending, so each path appears at most once. */
+const canonicalPaths = (paths) => paths.every((path, i) => i === 0 || compareCodePoints(paths[i - 1], path) < 0);
+const Ids = zod_1.z.array(Id).max(2000).refine(unique, 'Duplicate identity');
+exports.TrackDependencyV2Schema = zod_1.z
+    .object({
+    prerequisiteTaskId: Id,
+    dependentTaskId: Id,
+    requirement: zod_1.z.enum(['accepted_patch', 'merged']),
+    origin: zod_1.z.enum(['source', 'local_edit', 'decomposition', 'lead_proposal']),
+})
+    .strict()
+    .refine((v) => v.prerequisiteTaskId !== v.dependentTaskId, 'Self dependency');
+const IssueId = zod_1.z
+    .string()
+    .length(70)
+    .regex(/^issue:[a-f0-9]{64}$/);
+exports.ImportIssueV2Schema = zod_1.z
+    .object({
+    issueId: IssueId,
+    taskId: Id.nullable(),
+    code: Id,
+    message: Text,
+    origin: zod_1.z.enum(['import_diagnostic', 'reviewer_question']),
+    blocking: zod_1.z.boolean(),
+})
+    .strict();
+exports.MaterializationPlanSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    repositoryId: Id,
+    baseCommit: GitObject,
+    order: zod_1.z.array(AcceptanceId).min(1).max(2000).refine(unique, 'Duplicate acceptance'),
+    entries: zod_1.z
+        .array(zod_1.z
+        .object({
+        path: Path,
+        sourceAcceptanceId: AcceptanceId,
+        kind: zod_1.z.enum(['file', 'executable', 'delete']),
+        contentDigest: Digest.nullable(),
+    })
+        .strict()
+        .refine((v) => (v.kind === 'delete') === (v.contentDigest === null), 'Deletion must not name content'))
+        .max(10000),
+    conflicts: zod_1.z
+        .array(zod_1.z
+        .object({
+        path: Path,
+        acceptanceIds: zod_1.z.array(AcceptanceId).min(2).max(2000).refine(unique),
+        reason: zod_1.z.enum(['divergent_content', 'delete_modify', 'type_change']),
+    })
+        .strict())
+        .max(10000),
+    planDigest: RecordDigest,
+})
+    .strict()
+    .superRefine((v, ctx) => {
+    if (!canonicalPaths(v.entries.map((e) => e.path)) || !canonicalPaths(v.conflicts.map((c) => c.path)))
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'Planned entries and conflicts must be unique and in canonical path order',
+        });
+    const planned = new Set(v.entries.map((e) => e.path));
+    if (v.conflicts.some((c) => planned.has(c.path)))
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'A path is either planned or in conflict, never both',
+        });
+    if (v.entries.some((e) => !v.order.includes(e.sourceAcceptanceId)) ||
+        v.conflicts.some((c) => c.acceptanceIds.some((id) => !v.order.includes(id))))
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: 'Unknown source acceptance' });
+});
+exports.ReconciliationDecisionSetSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    importId: Id,
+    expectedGeneration: Revision,
+    expectedDraftDigest: RecordDigest,
+    conflicts: zod_1.z
+        .array(zod_1.z.object({ conflictId: Id, choice: zod_1.z.enum(['base', 'local', 'incoming']) }).strict())
+        .max(2000),
+    removals: zod_1.z
+        .array(zod_1.z
+        .object({ taskId: Id, decision: zod_1.z.enum(['remove_from_track', 'retain_as_local']) })
+        .strict())
+        .max(2000),
+    issues: zod_1.z
+        .array(zod_1.z
+        .object({
+        issueId: Id,
+        action: zod_1.z.discriminatedUnion('type', [
+            zod_1.z.object({ type: zod_1.z.literal('keep') }).strict(),
+            zod_1.z.object({ type: zod_1.z.literal('resolve'), note: Text }).strict(),
+        ]),
+    })
+        .strict())
+        .max(2000),
+    decidedBy: Id,
+    decidedAtMs: Count,
+})
+    .strict()
+    .refine((v) => unique(v.conflicts.map((c) => c.conflictId)) &&
+    unique(v.removals.map((r) => r.taskId)) &&
+    unique(v.issues.map((i) => i.issueId)), 'Duplicate reconciliation decision');
+exports.ClaimVerificationSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    verificationId: zod_1.z
+        .string()
+        .length(71)
+        .regex(/^claimv:[a-f0-9]{64}$/),
+    taskId: Id,
+    specRevision: Revision,
+    claim: zod_1.z
+        .object({ uri: ClaimUri, label: zod_1.z.string().max(4096).nullable() })
+        .strict(),
+    subject: zod_1.z
+        .object({ repositoryId: Id, locator: artifact_bindings_js_1.ImmutableArtifactLocatorSchema })
+        .strict()
+        .nullable(),
+    criteriaIds: Ids,
+    checkReceiptIds: Ids,
+    verdict: zod_1.z.enum(['valid', 'invalid', 'indeterminate']),
+    reasons: zod_1.z.array(Text).max(2000),
+    reviewer: Id.nullable(),
+    reviewedAtMs: Count.nullable(),
+})
+    .strict()
+    .superRefine((v, ctx) => {
+    if ((v.reviewer === null) !== (v.reviewedAtMs === null))
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: 'Incomplete review attestation' });
+    if (v.verdict === 'valid' &&
+        (!v.subject || !v.criteriaIds.length || !v.checkReceiptIds.length || !v.reviewer))
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'Valid claims require pinned subject, criteria, checks and review',
+        });
+    if (v.subject?.locator.type === 'pull_request_head' &&
+        v.subject.repositoryId !== v.subject.locator.repositoryId)
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: 'Claim repository mismatch' });
+});
+const ChildState = zod_1.z.discriminatedUnion('type', [
+    zod_1.z.object({ type: zod_1.z.literal('accepted'), acceptanceId: AcceptanceId }).strict(),
+    zod_1.z.object({ type: zod_1.z.literal('pending') }).strict(),
+    zod_1.z.object({ type: zod_1.z.literal('blocked'), reasons: zod_1.z.array(Text).min(1).max(2000) }).strict(),
+    zod_1.z.object({ type: zod_1.z.literal('stale'), reasons: artifact_bindings_js_1.StaleReasonsSchema }).strict(),
+]);
+exports.ParentIntegrationStatusSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    parentTaskId: Id,
+    parentSpecRevision: Revision,
+    children: zod_1.z
+        .array(zod_1.z.object({ taskId: Id, repositoryId: Id, state: ChildState }).strict())
+        .min(1)
+        .max(2000),
+    parentOnlyCriteria: zod_1.z
+        .array(zod_1.z.object({ criterionId: Id, evidence: RecordDigest.nullable() }).strict())
+        .max(2000),
+    state: zod_1.z.enum(['not_started', 'partial', 'awaiting_integration', 'satisfied', 'stale']),
+})
+    .strict()
+    .superRefine((v, ctx) => {
+    if (!unique(v.children.map((c) => c.taskId)) ||
+        !unique(v.parentOnlyCriteria.map((c) => c.criterionId)) ||
+        v.children.some((c) => c.taskId === v.parentTaskId))
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: 'Invalid integration identities' });
+    const accepted = v.children.filter((c) => c.state.type === 'accepted').length;
+    const expected = v.children.some((c) => c.state.type === 'stale')
+        ? 'stale'
+        : accepted === v.children.length
+            ? v.parentOnlyCriteria.every((c) => c.evidence !== null)
+                ? 'satisfied'
+                : 'awaiting_integration'
+            : accepted
+                ? 'partial'
+                : 'not_started';
+    if (v.state !== expected)
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'Integration state contradicts evidence',
+        });
+});
+async function parseMaterializationPlan(input) {
+    const value = exports.MaterializationPlanSchema.parse(input);
+    await (0, artifact_bindings_js_1.verifyContractRecordIdentity)(value, 'planDigest', 'sha256:');
+    return value;
+}
+/** D7: `issue:` + SHA-256 of the canonical `{origin, taskId, code, message}`. */
+async function deriveImportIssueId(issue) {
+    const { origin, taskId, code, message } = issue;
+    return 'issue:' + (await (0, artifact_bindings_js_1.contractDigest)({ origin, taskId, code, message }));
+}
+/** D7: `conf:` + SHA-256 of the canonical `{taskId, field, base, local, incoming}`. */
+async function deriveConflictId(conflict) {
+    const { taskId, field, base, local, incoming } = conflict;
+    return 'conf:' + (await (0, artifact_bindings_js_1.contractDigest)({ taskId, field, base, local, incoming }));
+}
+/** Shape plus content identity; use before trusting an issue ID. */
+async function parseImportIssueV2(input) {
+    const value = exports.ImportIssueV2Schema.parse(input);
+    if (value.issueId !== (await deriveImportIssueId(value)))
+        throw new Error('Record identity does not match canonical content');
+    return value;
+}
+async function parseClaimVerification(input) {
+    const value = exports.ClaimVerificationSchema.parse(input);
+    await (0, artifact_bindings_js_1.verifyContractRecordIdentity)(value, 'verificationId', 'claimv:');
+    return value;
+}
+/** Reviewed claim-resolution mapping; it confers no repository access. HTTPS is the v1 transport profile. */
+exports.RepositoryIdentitySchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    repositoryId: Id,
+    remote: zod_1.z
+        .string()
+        .min(1)
+        .max(4096)
+        .refine((value) => {
+        try {
+            const url = new URL(value);
+            return (url.protocol === 'https:' &&
+                !url.username &&
+                !url.password &&
+                !url.search &&
+                !url.hash &&
+                // An empty query or fragment leaves search and hash empty but is
+                // still part of the remote; Rust refuses both.
+                !/[?#]/.test(value) &&
+                url.pathname.split('/').filter(Boolean).length >= 2 &&
+                url.href === value);
+        }
+        catch {
+            return false;
+        }
+    }, 'Expected a canonical credential-free HTTPS repository remote'),
+})
+    .strict();

package/node_modules/@kya-os/contracts/dist/workbench/index.d.ts

@@ -0,0 +1,17 @@
+/** Shared contracts for the accountable autonomous workbench. */
+export * from './cache.js';
+export * from './tracking.js';
+export * from './execution.js';
+export * from './usage.js';
+export * from './mailbox.js';
+export * from './routing.js';
+export * from './economics.js';
+export * from './review.js';
+export * from './governed.js';
+export * from './lead-planner.js';
+export * from './managed-worker.js';
+export * from './a2a.js';
+export * from './artifact-bindings.js';
+export * from './graph-interfaces.js';
+export * from './linear-installation.js';
+export * from './task-status-projection.js';

package/node_modules/@kya-os/contracts/dist/workbench/index.js

@@ -0,0 +1,33 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/** Shared contracts for the accountable autonomous workbench. */
+__exportStar(require("./cache.js"), exports);
+__exportStar(require("./tracking.js"), exports);
+__exportStar(require("./execution.js"), exports);
+__exportStar(require("./usage.js"), exports);
+__exportStar(require("./mailbox.js"), exports);
+__exportStar(require("./routing.js"), exports);
+__exportStar(require("./economics.js"), exports);
+__exportStar(require("./review.js"), exports);
+__exportStar(require("./governed.js"), exports);
+__exportStar(require("./lead-planner.js"), exports);
+__exportStar(require("./managed-worker.js"), exports);
+__exportStar(require("./a2a.js"), exports);
+__exportStar(require("./artifact-bindings.js"), exports);
+__exportStar(require("./graph-interfaces.js"), exports);
+__exportStar(require("./linear-installation.js"), exports);
+__exportStar(require("./task-status-projection.js"), exports);