@microck/canonfig 2.0.0

package/dist/domain/synchronization.js

@@ -0,0 +1,346 @@
+import { Schema } from "effect";
+import { ActionId, AgentTaskId, BlobId, ContentDigest, FollowerId, ProfileRevisionId, ResourceId as ResourceIdSchema, RunId, Timestamp, } from "./brand.js";
+import { SyncScheduleSchema, } from "../schedule/schedule-manager.types.js";
+import { AutomaticRecipeMethod, BuildPolicy as BuildPolicySchema, RecipeIndexPolicy, } from "./resource.js";
+import { isMissingAutomaticRecipeVersion, RecipeSourceMetadata, recipeValidationError, } from "./recipe-versions.js";
+/** Observed state of one resource target on the follower. */
+export const ObservedObjectKind = Schema.Literals([
+    "regular",
+    "directory",
+    "symlink",
+    "reparse-point",
+    "special",
+]);
+export const PlannedActionKindSchema = Schema.Literals([
+    "no-op",
+    "transfer-blob",
+    "write-file",
+    "write-config",
+    "mirror-directory",
+    "remove-resource",
+    "schedule-default",
+    "install-tool",
+    "verify-only",
+    "human-action",
+    "agent-task",
+    "drift-conflict",
+]);
+const InstallToolActionDetailSchema = Schema.Struct({
+    kind: Schema.Literal("install-tool"),
+    toolId: Schema.NonEmptyString,
+    method: AutomaticRecipeMethod,
+    package: Schema.NonEmptyString,
+    version: Schema.optional(Schema.NonEmptyString),
+    indexPolicy: Schema.optional(RecipeIndexPolicy),
+    source: Schema.optional(Schema.Union([
+        Schema.NonEmptyString,
+        RecipeSourceMetadata,
+    ])),
+    buildPolicy: Schema.optional(BuildPolicySchema),
+}).check(Schema.makeFilter((detail) => {
+    const reason = recipeValidationError(detail);
+    return reason === undefined && !isMissingAutomaticRecipeVersion(detail)
+        ? undefined
+        : {
+            path: ["version"],
+            issue: reason ?? `automatic installer ${detail.method} requires an exact version`,
+        };
+}));
+export const ActionDetailSchema = Schema.Union([
+    Schema.Struct({ kind: Schema.Literal("no-op") }),
+    Schema.Struct({
+        kind: Schema.Literal("transfer-blob"),
+        blob: BlobId,
+        bytes: Schema.Natural,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("write-file"),
+        target: Schema.NonEmptyString,
+        digest: ContentDigest,
+        executable: Schema.optional(Schema.Boolean),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("write-config"),
+        target: Schema.NonEmptyString,
+        keys: Schema.Array(Schema.NonEmptyString),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("mirror-directory"),
+        target: Schema.NonEmptyString,
+        adds: Schema.Array(Schema.NonEmptyString),
+        removes: Schema.Array(Schema.NonEmptyString),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("remove-resource"),
+        target: Schema.NonEmptyString,
+        paths: Schema.Array(Schema.NonEmptyString),
+        keys: Schema.Array(Schema.NonEmptyString),
+        schedule: Schema.optional(SyncScheduleSchema),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("schedule-default"),
+        operation: Schema.Literals(["upsert", "remove"]),
+        schedule: SyncScheduleSchema,
+        previousSchedule: Schema.optional(SyncScheduleSchema),
+    }),
+    InstallToolActionDetailSchema,
+    Schema.Struct({
+        kind: Schema.Literal("verify-only"),
+        method: Schema.NonEmptyString,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("human-action"),
+        reason: Schema.NonEmptyString,
+        instructions: Schema.NonEmptyString,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("agent-task"),
+        taskId: AgentTaskId,
+        summary: Schema.NonEmptyString,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("drift-conflict"),
+        target: Schema.NonEmptyString,
+        desiredDigest: ContentDigest,
+        observedDigest: ContentDigest,
+        desiredExecutable: Schema.optional(Schema.Boolean),
+        observedExecutable: Schema.optional(Schema.Boolean),
+    }),
+]);
+export const PlannedActionSchema = Schema.Struct({
+    id: ActionId,
+    resource: ResourceIdSchema,
+    kind: PlannedActionKindSchema,
+    detail: ActionDetailSchema,
+    before: Schema.Array(ActionId),
+});
+export const SynchronizationPlanSchema = Schema.Struct({
+    revision: ProfileRevisionId,
+    follower: FollowerId,
+    actions: Schema.Array(PlannedActionSchema),
+    encoded: Schema.String,
+    digest: Schema.optional(ContentDigest),
+});
+export const ForbiddenAgentCapabilitySchema = Schema.Literals([
+    "elevation",
+    "login",
+    "restart",
+    "reboot",
+]);
+export const ExecutableAuthorizationSchema = Schema.Struct({
+    executable: Schema.NonEmptyString,
+    behavior: Schema.Literals(["leaf", "script-interpreter"]),
+});
+export const AgentTaskSchema = Schema.Struct({
+    id: AgentTaskId,
+    summary: Schema.NonEmptyString,
+    desiredOutcome: Schema.NonEmptyString,
+    observedEvidence: Schema.Array(Schema.String),
+    allowedPaths: Schema.Array(Schema.NonEmptyString),
+    allowedExecutables: Schema.Array(Schema.NonEmptyString),
+    executableAuthorizations: Schema.optional(Schema.Array(ExecutableAuthorizationSchema)),
+    allowedOrigins: Schema.Array(Schema.NonEmptyString),
+    forbidden: Schema.Array(ForbiddenAgentCapabilitySchema),
+    timeLimitSeconds: Schema.Int.check(Schema.isGreaterThan(0)),
+    outputLimitBytes: Schema.Int.check(Schema.isGreaterThan(0)),
+    verification: Schema.Struct({
+        command: Schema.Array(Schema.NonEmptyString),
+        expectContains: Schema.optional(Schema.String),
+    }),
+});
+export const HumanActionSchema = Schema.Struct({
+    reason: Schema.NonEmptyString,
+    instructions: Schema.NonEmptyString,
+    resource: Schema.optional(ResourceIdSchema),
+});
+export const HumanActionRequiredSchema = Schema.Struct({
+    outcome: Schema.Literal("HumanActionRequired"),
+    run: RunId,
+    actions: Schema.Array(HumanActionSchema),
+});
+export const DriftConflictSchema = Schema.Struct({
+    resource: ResourceIdSchema,
+    target: Schema.NonEmptyString,
+    desiredDigest: ContentDigest,
+    observedDigest: ContentDigest,
+    lastAppliedDigest: ContentDigest,
+    desiredExecutable: Schema.optional(Schema.Boolean),
+    observedExecutable: Schema.optional(Schema.Boolean),
+});
+export const SynchronizationOutcomeSchema = Schema.Union([
+    Schema.Struct({
+        outcome: Schema.Literal("Converged"),
+        run: RunId,
+        verified: Schema.Array(ResourceIdSchema),
+    }),
+    HumanActionRequiredSchema,
+    Schema.Struct({
+        outcome: Schema.Literal("FollowerDrift"),
+        run: RunId,
+        conflicts: Schema.Array(DriftConflictSchema),
+    }),
+    Schema.Struct({
+        outcome: Schema.Literal("Failed"),
+        run: RunId,
+        reason: Schema.NonEmptyString,
+    }),
+    Schema.Struct({
+        outcome: Schema.Literal("Interrupted"),
+        run: RunId,
+        completedActions: Schema.Array(ActionId),
+    }),
+]);
+export const ObservedResourceStateSchema = Schema.Union([
+    Schema.Struct({ state: Schema.Literal("absent") }),
+    Schema.Struct({
+        state: Schema.Literal("present"),
+        digest: ContentDigest,
+        executable: Schema.Boolean,
+        objectKind: Schema.optional(ObservedObjectKind),
+        symlinkTo: Schema.optional(Schema.NonEmptyString),
+    }),
+    Schema.Struct({
+        state: Schema.Literal("directory"),
+        objectKind: Schema.optional(ObservedObjectKind),
+        files: Schema.Array(Schema.Union([
+            Schema.Struct({
+                path: Schema.NonEmptyString,
+                state: Schema.Literal("absent"),
+            }),
+            Schema.Struct({
+                path: Schema.NonEmptyString,
+                digest: ContentDigest,
+                executable: Schema.optional(Schema.Boolean),
+                objectKind: Schema.optional(ObservedObjectKind),
+            }),
+        ])),
+    }),
+    Schema.Struct({
+        state: Schema.Literal("unverifiable"),
+        reason: Schema.NonEmptyString,
+    }),
+]);
+export const AppliedResourceRecordSchema = Schema.Struct({
+    resource: ResourceIdSchema,
+    revision: ProfileRevisionId,
+    digest: ContentDigest,
+    appliedAt: Timestamp,
+    kind: Schema.optional(Schema.Literals([
+        "file",
+        "directory",
+        "config",
+        "skill",
+        "tool",
+        "credential",
+        "schedule",
+    ])),
+    policy: Schema.optional(Schema.Literals([
+        "replace",
+        "mirror-owned",
+        "merge",
+        "replace-if-unmodified",
+        "ensure",
+        "require-local",
+    ])),
+    target: Schema.optional(Schema.NonEmptyString),
+    executable: Schema.optional(Schema.Boolean),
+    symlinkTo: Schema.optional(Schema.NonEmptyString),
+    ownedFiles: Schema.optional(Schema.Array(Schema.Struct({
+        path: Schema.NonEmptyString,
+        digest: ContentDigest,
+        executable: Schema.optional(Schema.Boolean),
+    }))),
+    ownedKeys: Schema.optional(Schema.Array(Schema.NonEmptyString)),
+    configFormat: Schema.optional(Schema.Literals(["toml", "json", "yaml"])),
+    schedule: Schema.optional(SyncScheduleSchema),
+});
+/** Runtime schema aliases share names with their corresponding domain types. */
+export const PlannedActionKind = PlannedActionKindSchema;
+export const ActionDetail = ActionDetailSchema;
+export const PlannedAction = PlannedActionSchema;
+export const SynchronizationPlan = SynchronizationPlanSchema;
+export const AgentTask = AgentTaskSchema;
+export const HumanAction = HumanActionSchema;
+export const HumanActionRequired = HumanActionRequiredSchema;
+export const DriftConflict = DriftConflictSchema;
+export const SynchronizationOutcome = SynchronizationOutcomeSchema;
+export const ObservedResourceState = ObservedResourceStateSchema;
+export const AppliedResourceRecord = AppliedResourceRecordSchema;
+export class DuplicateActionError extends Schema.TaggedError()("DuplicateActionError", { id: Schema.String }) {
+}
+export class MissingActionReferenceError extends Schema.TaggedError()("MissingActionReferenceError", { id: Schema.String, before: Schema.String }) {
+}
+export class ActionCycleError extends Schema.TaggedError()("ActionCycleError", { cycle: Schema.Array(Schema.String) }) {
+}
+export class ActionKindMismatchError extends Schema.TaggedError()("ActionKindMismatchError", { id: Schema.String, kind: Schema.String, detailKind: Schema.String }) {
+}
+/** Validate action references, detail compatibility, and action graph acyclicity. */
+export const validateSynchronizationPlan = (plan) => {
+    const errors = [];
+    const actionIds = new Set();
+    for (const action of plan.actions) {
+        if (actionIds.has(action.id))
+            errors.push(new DuplicateActionError({ id: action.id }));
+        actionIds.add(action.id);
+        if (action.kind !== action.detail.kind) {
+            errors.push(new ActionKindMismatchError({
+                id: action.id,
+                kind: action.kind,
+                detailKind: action.detail.kind,
+            }));
+        }
+    }
+    for (const action of plan.actions) {
+        for (const before of action.before) {
+            if (!actionIds.has(before)) {
+                errors.push(new MissingActionReferenceError({ id: action.id, before }));
+            }
+        }
+    }
+    const cycle = findActionCycle(plan.actions);
+    if (cycle !== null)
+        errors.push(new ActionCycleError({ cycle }));
+    return errors;
+};
+export const findActionCycle = (actions) => {
+    const graph = new Map();
+    for (const action of actions)
+        graph.set(action.id, action.before);
+    const active = [];
+    const complete = new Set();
+    const visit = (id) => {
+        if (complete.has(id))
+            return null;
+        const index = active.indexOf(id);
+        if (index >= 0)
+            return [...active.slice(index), id];
+        active.push(id);
+        for (const next of graph.get(id) ?? []) {
+            if (!graph.has(next))
+                continue;
+            const cycle = visit(next);
+            if (cycle !== null)
+                return cycle;
+        }
+        active.pop();
+        complete.add(id);
+        return null;
+    };
+    for (const action of actions) {
+        const cycle = visit(action.id);
+        if (cycle !== null)
+            return cycle;
+    }
+    return null;
+};
+/** Exit codes for the CLI, mapped from outcomes. */
+export const ExitCode = {
+    success: 0,
+    invalidInput: 2,
+    drift: 3,
+    humanAction: 4,
+    interrupted: 5,
+    operationalFailure: 1,
+};
+/** Agent policy schema re-exported for the profile authoring boundary. */
+export { AgentPolicy } from "./identity.js";

package/dist/enrollment/enrollment.errors.js

@@ -0,0 +1,43 @@
+import { Schema } from "effect";
+export class SourceNotInitializedError extends Schema.TaggedError()("SourceNotInitializedError", { operation: Schema.String }) {
+}
+export class EnrollmentConfigurationError extends Schema.TaggedError()("EnrollmentConfigurationError", {
+    operation: Schema.String,
+    message: Schema.String,
+}) {
+}
+export class InvitationNotFoundError extends Schema.TaggedError()("InvitationNotFoundError", { message: Schema.String }) {
+}
+export class InvitationExpiredError extends Schema.TaggedError()("InvitationExpiredError", { message: Schema.String }) {
+}
+export class InvitationReplayError extends Schema.TaggedError()("InvitationReplayError", { message: Schema.String }) {
+}
+export class EnrollmentSourceMismatchError extends Schema.TaggedError()("EnrollmentSourceMismatchError", { message: Schema.String }) {
+}
+export class EnrollmentFingerprintMismatchError extends Schema.TaggedError()("EnrollmentFingerprintMismatchError", { message: Schema.String }) {
+}
+export class MalformedEnrollmentRequestError extends Schema.TaggedError()("MalformedEnrollmentRequestError", { message: Schema.String }) {
+}
+export class DuplicateFollowerIdentityError extends Schema.TaggedError()("DuplicateFollowerIdentityError", { message: Schema.String }) {
+}
+export class InvalidFollowerCredentialError extends Schema.TaggedError()("InvalidFollowerCredentialError", { message: Schema.String }) {
+}
+export class RevokedFollowerCredentialError extends Schema.TaggedError()("RevokedFollowerCredentialError", { message: Schema.String }) {
+}
+export class EnrollmentTransportError extends Schema.TaggedError()("EnrollmentTransportError", {
+    operation: Schema.String,
+    message: Schema.String,
+}) {
+}
+export class TransportResourceNotFoundError extends Schema.TaggedError()("TransportResourceNotFoundError", { resource: Schema.String }) {
+}
+export class TransportUnauthorizedError extends Schema.TaggedError()("TransportUnauthorizedError", { resource: Schema.String }) {
+}
+export class TransportMalformedResponseError extends Schema.TaggedError()("TransportMalformedResponseError", { operation: Schema.String, message: Schema.String }) {
+}
+export class TransportIntegrityError extends Schema.TaggedError()("TransportIntegrityError", { artifact: Schema.String, message: Schema.String }) {
+}
+export class TransportSizeLimitError extends Schema.TaggedError()("TransportSizeLimitError", { artifact: Schema.String, limit: Schema.Number }) {
+}
+export class TransportInterruptedError extends Schema.TaggedError()("TransportInterruptedError", { operation: Schema.String }) {
+}