@mnstry/atelier 0.2.0-alpha.1

package/src/commands/setup.mjs

@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import {
+  LOCAL_OVERLAY_SCHEMA,
+  LOCAL_STATE_DIR,
+  commandProject,
+  ensureLocalState,
+  firstString,
+  parseArgs,
+  resolveProjectConfig,
+  writeJson,
+} from '../project/config.mjs'
+import { auditRepoIdentities } from '../project/repo-identity.mjs'
+
+const PROFILE_SET = new Set(['single-repo', 'private-domain', 'shared-project', 'multi-repo', 'monorepo', 'control-workspace'])
+const IGNORE_LINES = [
+  '.atelier-local/',
+  'atelier.local.json',
+  'atelier.workspace.local.json',
+  'atelier-attestation-key.local.json',
+  '.mnstry-local/',
+  '.atelier-proposals/',
+  '.atelier-current',
+  '.atelier-current.json',
+  '.atelier-presence.json',
+  '.atelier-nonce',
+  '.atelier-capability-grants.json',
+  '.atelier-events.jsonl',
+  '.atelier-audit.jsonl',
+  '.atelier-session.json',
+  '.atelier-session.jsonl',
+  '.atelier-sessions/',
+  '.atelier-support/',
+  'atelier-output/',
+  'support-bundle*',
+  'support-bundles/',
+  'transcripts/',
+  'prompts/',
+  'node_modules/',
+  'npm-debug.log*',
+  '.DS_Store',
+]
+
+function slug(value) {
+  return String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '') || 'atelier-project'
+}
+
+function appendIgnoreLines(root) {
+  const file = path.join(root, '.gitignore')
+  const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : ''
+  const lines = new Set(existing.split('\n').map((line) => line.trim()).filter(Boolean))
+  const missing = IGNORE_LINES.filter((line) => !lines.has(line))
+  if (!missing.length) return { file, changed: false, added: [] }
+  const prefix = existing && !existing.endsWith('\n') ? '\n' : ''
+  fs.appendFileSync(file, `${prefix}${missing.join('\n')}\n`)
+  return { file, changed: true, added: missing }
+}
+
+function localOverlayFor(project) {
+  const repos = {}
+  for (const repo of project.repos ?? []) {
+    if (!repo.name || !repo.path) continue
+    repos[repo.name] = {
+      path: path.relative(project.configDir, repo.path).split(path.sep).join('/') || '.',
+      pathSource: repo.pathSource || 'tracked-config',
+    }
+  }
+  return {
+    schema: LOCAL_OVERLAY_SCHEMA,
+    generatedBy: 'atelier setup',
+    generatedAt: new Date().toISOString(),
+    repos,
+  }
+}
+
+function writeLocalOverlay(project, { dryRun = false } = {}) {
+  const root = path.join(project.configDir, LOCAL_STATE_DIR)
+  const file = path.join(root, 'workspace.json')
+  const overlay = localOverlayFor(project)
+  if (!dryRun) {
+    fs.mkdirSync(root, { recursive: true })
+    writeJson(file, overlay)
+  }
+  return { file, overlay, wrote: !dryRun }
+}
+
+function runSetup(argv) {
+  const args = parseArgs(argv)
+  const dryRun = Boolean(args['dry-run'])
+  const repair = Boolean(args.yes || args.fix || args._[0] === 'doctor')
+  const project = commandProject({ argv })
+  let ignore = { changed: false, added: [] }
+  let state = ensureLocalState(project, { write: false })
+  if (!state.ignored && repair && !dryRun) {
+    ignore = appendIgnoreLines(project.configDir)
+    state = ensureLocalState(project, { write: false })
+  }
+  if (!state.ignored) {
+    console.error(`Atelier local state is not ignored at ${state.root}`)
+    console.error('Run: atelier setup --yes --project ./atelier.project.json')
+    process.exit(1)
+  }
+  if (!dryRun) state = ensureLocalState(project, { write: true })
+  const overlay = writeLocalOverlay(project, { dryRun })
+  const report = {
+    ok: true,
+    command: 'setup',
+    dryRun,
+    configPath: project.configPath,
+    localState: state,
+    ignore,
+    overlay,
+    repos: project.repos.map((repo) => ({ name: repo.name, path: repo.path, pathSource: repo.pathSource })),
+  }
+  console.log(JSON.stringify(report, null, 2))
+}
+
+function baseBoundaryPolicy({ repoName, profile, actor }) {
+  const privateDomain = profile === 'shared-project' ? `${actor}-private` : repoName
+  const shared = profile === 'shared-project'
+  return {
+    schema: 'mnstry.atelier-boundary-policy@v1',
+    mode: 'strict',
+    actors: {
+      [actor]: {
+        githubLogin: `${actor.toUpperCase()}_GITHUB_LOGIN_PLACEHOLDER`,
+        gitEmails: [`${actor}@example.invalid`],
+        privateDomainRepo: privateDomain,
+      },
+    },
+    repos: {
+      [repoName]: {
+        kind: shared ? 'shared' : 'private_domain',
+        ownerActor: shared ? undefined : actor,
+        readBoundary: shared ? 'team' : 'private',
+        allowedAudiences: shared ? ['team', 'operator', 'staff', 'public'] : ['private', 'sensitive', 'team', 'operator', 'staff', 'public'],
+        forbiddenAudiences: shared ? ['private', 'sensitive'] : [],
+        autoCommit: 'guarded',
+      },
+    },
+    promotion: {
+      requiresGitPromote: true,
+      recordsPath: 'governance/git-promote-events.jsonl',
+    },
+    forbiddenPaths: [
+      '.atelier-local/**',
+      'atelier.local.json',
+      'atelier.workspace.local.json',
+      'atelier-attestation-key.local.json',
+      '.mnstry-local/**',
+      '.atelier-proposals/**',
+      'support-bundles/**',
+      'prompts/**',
+      'transcripts/**',
+    ],
+    governanceLedgerPath: 'governance/repo-boundary-ledger.md',
+  }
+}
+
+function cleanUndefined(value) {
+  if (Array.isArray(value)) return value.map(cleanUndefined)
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).map(([key, item]) => [key, cleanUndefined(item)]))
+  }
+  return value
+}
+
+function runAdopt(argv) {
+  const args = parseArgs(argv)
+  const target = path.resolve(firstString(args.target) || process.cwd())
+  const profile = firstString(args.profile, args.template) || 'single-repo'
+  if (!PROFILE_SET.has(profile)) throw new Error(`unsupported Atelier setup profile: ${profile}`)
+  if (profile === 'monorepo' && !firstString(args.include, args.includes)) {
+    throw new Error('monorepo adopt requires --include so Atelier does not scan the whole repo by accident')
+  }
+  fs.mkdirSync(target, { recursive: true })
+  appendIgnoreLines(target)
+  const repoName = slug(firstString(args.name) || path.basename(target))
+  const actor = slug(firstString(args.actor) || process.env.USER || 'owner')
+  const projectPath = path.join(target, 'atelier.project.json')
+  if (!fs.existsSync(projectPath)) {
+    writeJson(projectPath, {
+      schema: 'mnstry.atelier-project-config@v1',
+      name: repoName,
+      roots: { workspace: '.', repoOps: '.' },
+      graph: { repoAccessPath: 'repo-access.v1.json', outputPath: 'atelier-output/knowledge.graph.json' },
+      projection: { outputRoot: 'atelier-output', readinessPath: 'atelier-output/atelier-readiness.json' },
+      boundaries: { policyPath: 'boundary-policy.v1.json', governanceLedgerPath: 'governance/repo-boundary-ledger.md', strictNewRepos: true },
+      setup: { profile, include: firstString(args.include, args.includes) || null, exclude: firstString(args.exclude, args.excludes) || null },
+      repos: [{ name: repoName, path: '.', readBoundary: profile === 'shared-project' ? 'team' : 'private', role: profile }],
+    })
+  }
+  if (!fs.existsSync(path.join(target, 'repo-access.v1.json'))) {
+    writeJson(path.join(target, 'repo-access.v1.json'), {
+      schema: 'mnstry.atelier-repo-access@v1',
+      defaultReadBoundary: profile === 'shared-project' ? 'team' : 'private',
+      repos: { [repoName]: { readBoundary: profile === 'shared-project' ? 'team' : 'private' } },
+    })
+  }
+  if (!fs.existsSync(path.join(target, 'boundary-policy.v1.json'))) {
+    writeJson(path.join(target, 'boundary-policy.v1.json'), cleanUndefined(baseBoundaryPolicy({ repoName, profile, actor })))
+  }
+  const project = resolveProjectConfig({ cwd: target, argv: ['--project', projectPath] })
+  ensureLocalState(project, { write: true })
+  writeLocalOverlay(project)
+  console.log(JSON.stringify({ ok: true, command: 'adopt', profile, target, projectPath }, null, 2))
+}
+
+function runDoctor(argv) {
+  const args = parseArgs(argv)
+  const project = commandProject({ argv })
+  const dryRun = Boolean(args['dry-run'])
+  const fix = Boolean(args.fix)
+  const stateBefore = ensureLocalState(project, { write: false })
+  let setup = null
+  if (fix) {
+    runSetup(['--project', project.configPath, '--yes', ...(dryRun ? ['--dry-run'] : [])])
+    return
+  }
+  setup = { localState: stateBefore }
+  const identity = auditRepoIdentities(project)
+  const ok = stateBefore.ignored && identity.ok
+  console.log(JSON.stringify({
+    ok,
+    command: 'doctor',
+    configPath: project.configPath,
+    repos: project.repos.map((repo) => ({ name: repo.name, path: repo.path, pathSource: repo.pathSource, external: Boolean(repo.external) })),
+    identity,
+    setup,
+  }, null, 2))
+  process.exit(ok ? 0 : 1)
+}
+
+const argv = process.argv.slice(2)
+const args = parseArgs(argv)
+const subcommand = args._[0] || 'setup'
+try {
+  if (subcommand === 'setup') runSetup(argv.filter((arg) => arg !== 'setup'))
+  else if (subcommand === 'adopt') runAdopt(argv.filter((arg) => arg !== 'adopt'))
+  else if (subcommand === 'doctor') runDoctor(argv.filter((arg) => arg !== 'doctor'))
+  else throw new Error(`unknown setup command: ${subcommand}`)
+} catch (error) {
+  console.error(error.message)
+  process.exit(1)
+}

package/src/commands/support.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runSupportCommand } from '../support/support-bundle.mjs'
+runSupportCommand()

package/src/commands/upgrade.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runUpgradeCommand } from '../upgrade/upgrade.mjs'
+runUpgradeCommand()

package/src/contracts/corpus.mjs

@@ -0,0 +1,171 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// Shared contract corpus: one entry per validated document shape, consumed by
+// test/contract-registry.test.mjs (fixture wiring for otherwise-unreferenced
+// contracts) and scripts/check-contract-compat.mjs (epoch compatibility gate).
+//
+// Entry shape:
+// - name           stable entry id (unique)
+// - contractFile   repo-relative contract path
+// - docPointer     optional JSON pointer fragment ('#/$defs/...') when the
+//                  validated document shape is a subschema rather than the root
+// - fixtureRoot    repo-relative directory containing valid/ and invalid/ subdirs
+// - validFiles     explicit repo-relative valid documents (used instead of
+//                  fixtureRoot when fixtures live in place next to other assets)
+// - invalidFiles   explicit repo-relative invalid documents
+// - registry       true when test/contract-registry.test.mjs owns positive and
+//                  negative coverage for the entry (contracts with no dedicated
+//                  test file); entries covered by an existing dedicated test
+//                  carry registry: false and exist for the compat gate
+// - loadGeneratedDocs  optional async loader returning generated documents that
+//                  must also satisfy the contract (generated docs drift first)
+//
+// The semantic profile (contracts/mnstry-atelier-semantic-profile.v1.json) is a
+// document, not a schema, and is deliberately absent.
+
+export const CONTRACT_CORPUS = [
+  {
+    name: 'atelier-lock',
+    contractFile: 'contracts/atelier-lock.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-lock',
+    registry: false,
+  },
+  {
+    name: 'atelier-migration',
+    contractFile: 'contracts/atelier-migration.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-migration',
+    registry: false,
+  },
+  {
+    name: 'atelier-boundary-policy',
+    contractFile: 'contracts/atelier-boundary-policy.v1.schema.json',
+    fixtureRoot: 'fixtures/boundary-policy',
+    registry: false,
+  },
+  {
+    name: 'atelier-export',
+    contractFile: 'contracts/atelier-export.v1.schema.json',
+    validFiles: ['fixtures/atelier-export/sample-studio-offer.v1.json'],
+    registry: false,
+  },
+  {
+    name: 'atelier-kit-manifest',
+    contractFile: 'contracts/atelier-kit-manifest.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-kit-manifest',
+    registry: false,
+  },
+  {
+    name: 'atelier-extension-pack',
+    contractFile: 'contracts/atelier-extension-pack.v1.schema.json',
+    fixtureRoot: 'fixtures/readiness-protocols/extension-pack',
+    registry: false,
+  },
+  {
+    name: 'atelier-readiness-protocol',
+    contractFile: 'contracts/atelier-readiness-protocol.v1.schema.json',
+    fixtureRoot: 'fixtures/readiness-protocols/protocol',
+    registry: false,
+    loadGeneratedDocs: async () =>
+      (await import('../readiness-protocols/bundled-pack.mjs')).bundledReadinessProtocols,
+  },
+  {
+    name: 'atelier-readiness-run',
+    contractFile: 'contracts/atelier-readiness-run.v1.schema.json',
+    fixtureRoot: 'fixtures/readiness-protocols/run',
+    registry: false,
+  },
+  {
+    name: 'atelier-attestation',
+    contractFile: 'contracts/atelier-attestation.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-attestation',
+    registry: false,
+  },
+  {
+    name: 'atelier-claim',
+    contractFile: 'contracts/atelier-claim.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-claim',
+    registry: true,
+  },
+  {
+    name: 'atelier-project-config',
+    contractFile: 'contracts/atelier-project-config.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-project-config',
+    registry: true,
+  },
+  {
+    name: 'atelier-readiness',
+    contractFile: 'contracts/atelier-readiness.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-readiness',
+    registry: true,
+  },
+  {
+    name: 'atelier-action-intent',
+    contractFile: 'contracts/atelier-action-intent.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-action-intent',
+    registry: true,
+  },
+  {
+    name: 'atelier-analysis-adapter',
+    contractFile: 'contracts/atelier-analysis-adapter.v1.schema.json',
+    fixtureRoot: 'fixtures/atelier-analysis-adapter',
+    registry: true,
+  },
+  {
+    name: 'knowledge-source-sidecar',
+    contractFile: 'contracts/knowledge-source-sidecar.v1.schema.json',
+    fixtureRoot: 'fixtures/knowledge-source-sidecar',
+    registry: true,
+  },
+  {
+    name: 'git-promote-event',
+    contractFile: 'contracts/git-promote-event.v1.schema.json',
+    validFiles: ['fixtures/git-promote/private-to-team.v1.json'],
+    invalidFiles: ['fixtures/git-promote/invalid/provision-named-revocable.v1.json'],
+    registry: true,
+  },
+  {
+    name: 'analysis-adapter-manifest',
+    contractFile: 'contracts/analysis-adapter.v1.schema.json',
+    docPointer: '#/$defs/manifest',
+    validFiles: [
+      'fixtures/analysis-adapter/manifest.disabled.v1.json',
+      'fixtures/analysis-adapter/manifest.enabled-local.v1.json',
+    ],
+    invalidFiles: ['fixtures/analysis-adapter/invalid/manifest-hidden-provider.v1.json'],
+    registry: true,
+  },
+  {
+    name: 'analysis-adapter-claim-output',
+    contractFile: 'contracts/analysis-adapter.v1.schema.json',
+    docPointer: '#/$defs/claimOutput',
+    validFiles: ['fixtures/analysis-adapter/output.claims.v1.json'],
+    invalidFiles: [
+      'fixtures/analysis-adapter/invalid/output-frontmatter-mutation.v1.json',
+      'fixtures/analysis-adapter/invalid/output-native-graph.v1.json',
+    ],
+    registry: true,
+  },
+]
+
+export const CORPUS_ROOT = fileURLToPath(new URL('../..', import.meta.url))
+
+function listJsonFiles(dir) {
+  if (!fs.existsSync(dir)) return []
+  return fs.readdirSync(dir)
+    .filter((name) => name.endsWith('.json'))
+    .sort()
+    .map((name) => path.join(dir, name))
+}
+
+export function corpusValidFiles(entry, root = CORPUS_ROOT) {
+  if (entry.validFiles) return entry.validFiles.map((file) => path.join(root, file))
+  return listJsonFiles(path.join(root, entry.fixtureRoot, 'valid'))
+}
+
+export function corpusInvalidFiles(entry, root = CORPUS_ROOT) {
+  if (entry.invalidFiles) return entry.invalidFiles.map((file) => path.join(root, file))
+  if (!entry.fixtureRoot) return []
+  return listJsonFiles(path.join(root, entry.fixtureRoot, 'invalid'))
+}

package/src/egress/check.mjs

@@ -0,0 +1,45 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+const ROOT = path.resolve(new URL('../..', import.meta.url).pathname)
+const SCAN_DIRS = ['bin', 'src']
+const FORBIDDEN = [
+  { pattern: /fetch\(\s*['"]https?:\/\/(?!127\.0\.0\.1|localhost|\[::1\])/, label: 'non-localhost fetch' },
+  { pattern: /https?\.request\s*\(/, label: 'http request primitive' },
+  { pattern: /new\s+WebSocket\s*\(/, label: 'websocket egress primitive' },
+  { pattern: /net\.connect\s*\(/, label: 'net connect primitive' },
+  { pattern: /dns\./, label: 'dns primitive' },
+  { pattern: /\bcurl\s+https?:\/\//, label: 'shell network call' },
+]
+
+function walk(dir, files = []) {
+  if (!fs.existsSync(dir)) return files
+  for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+    const abs = path.join(dir, ent.name)
+    if (ent.isDirectory()) walk(abs, files)
+    else if (/\.(mjs|js|sh)$/.test(ent.name)) files.push(abs)
+  }
+  return files
+}
+
+export function checkForbiddenEgress(root = ROOT) {
+  const failures = []
+  for (const rel of SCAN_DIRS) {
+    for (const file of walk(path.join(root, rel))) {
+      const text = fs.readFileSync(file, 'utf8')
+      for (const rule of FORBIDDEN) {
+        if (rule.pattern.test(text)) failures.push(`${path.relative(root, file)}:${rule.label}`)
+      }
+    }
+  }
+  return failures
+}
+
+export function runEgressCommand() {
+  const failures = checkForbiddenEgress()
+  if (failures.length) {
+    console.error(failures.join('\n'))
+    process.exit(1)
+  }
+  console.log('[egress:check] no forbidden non-localhost egress found in package runtime paths')
+}