@ornexus/neocortex 4.60.73 → 4.60.75

package/packages/client/dist/migrations/state-json.js

@@ -1,393 +1,4 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { existsSync, linkSync, lstatSync, mkdirSync, readFileSync, realpathSync, statSync, unlinkSync, } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { assertStateMigrationPlanV1, assertStateMigrationReceiptV1, planStateMigration, stateMigrationDigest, STATE_MIGRATION_RECEIPT_SCHEMA, StateMigrationHardStopError, } from '../../../shared/dist/state/index.js';
-import { atomicReplaceUtf8, durableCreateUtf8, fsyncDirectoryBestEffort, recoverAtomicReplaceUtf8, } from '../fs/atomic-state-replace.js';
-const STATE_RELATIVE_PATH = join('.neocortex', 'state.json');
-const MANIFEST_RELATIVE_PATH = join('.neocortex', 'state-migration.json');
-const LOCK_RELATIVE_PATH = join('.neocortex', 'state-migration.lock');
-export const STATE_MIGRATION_INPUT_LIMIT_BYTES = 4 * 1024 * 1024;
-export class StateMigrationApplyError extends Error {
-    reasonCode;
-    receipt;
-    constructor(reasonCode, message = reasonCode, receipt) {
-        super(message);
-        this.reasonCode = reasonCode;
-        this.receipt = receipt;
-        this.name = 'StateMigrationApplyError';
-    }
-}
-const sha256Bytes = (value) => createHash('sha256').update(value).digest('hex');
-const stateRaw = (state) => `${JSON.stringify(state, null, 2)}\n`;
-function safeRoot(projectRoot) {
-    let root;
-    try {
-        root = realpathSync(resolve(projectRoot));
-    }
-    catch {
-        throw new StateMigrationApplyError('state_migration_root_invalid');
-    }
-    if (!statSync(root).isDirectory())
-        throw new StateMigrationApplyError('state_migration_root_invalid');
-    for (const relative of ['.neocortex', STATE_RELATIVE_PATH, MANIFEST_RELATIVE_PATH]) {
-        const path = join(root, relative);
-        if (!existsSync(path))
-            continue;
-        const stat = lstatSync(path);
-        if (stat.isSymbolicLink() || (relative !== '.neocortex' && !stat.isFile()) || (relative === '.neocortex' && !stat.isDirectory())) {
-            throw new StateMigrationApplyError('state_migration_symlink_or_type_rejected');
-        }
-    }
-    return root;
-}
-function parseState(raw) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
-            return parsed;
-    }
-    catch { /* normalized below */ }
-    throw new StateMigrationApplyError('state_migration_state_corrupt');
-}
-function readBoundedState(root) {
-    const statePath = join(root, STATE_RELATIVE_PATH);
-    if (!existsSync(statePath))
-        throw new StateMigrationApplyError('state_migration_state_missing');
-    const size = statSync(statePath).size;
-    if (size > STATE_MIGRATION_INPUT_LIMIT_BYTES)
-        throw new StateMigrationApplyError('state_migration_input_too_large');
-    const raw = readFileSync(statePath, 'utf8');
-    const bytes = Buffer.byteLength(raw, 'utf8');
-    if (bytes !== size || bytes > STATE_MIGRATION_INPUT_LIMIT_BYTES) {
-        throw new StateMigrationApplyError('state_migration_source_changed');
-    }
-    return { state: parseState(raw), raw, digest: sha256Bytes(raw), bytes };
-}
-export function collectStateMigrationAuthority(projectRoot) {
-    const source = readBoundedState(safeRoot(projectRoot));
-    let decision;
-    try {
-        decision = planStateMigration(source.state);
-    }
-    catch (error) {
-        if (error instanceof StateMigrationHardStopError)
-            throw new StateMigrationApplyError(error.reasonCode, error.message);
-        throw error;
-    }
-    const target = decision.kind === 'migrate' ? decision.plan.targetState : source.state;
-    const count = (record, key) => {
-        const value = record[key];
-        return value && typeof value === 'object' && !Array.isArray(value) ? Object.keys(value).length : 0;
-    };
-    const plan = decision.kind === 'migrate'
-        ? (({ targetState: _privateTargetState, ...publicPlan }) => publicPlan)(decision.plan)
-        : null;
-    return Object.freeze({
-        schemaVersion: 'StateMigrationAuthority/1.0',
-        sourceByteDigest: source.digest,
-        sourceCanonicalHash: decision.kind === 'migrate' ? decision.plan.sourceCanonicalHash : decision.sourceCanonicalHash,
-        sourceByteLength: source.bytes,
-        before: { epics: count(source.state, 'epics'), stories: count(source.state, 'stories') },
-        after: { epics: count(target, 'epics'), stories: count(target, 'stories') },
-        outcome: decision.kind,
-        plan,
-        publicSafe: true,
-    });
-}
-export function readStateMigrationSourceSnapshot(projectRoot) {
-    const source = readBoundedState(safeRoot(projectRoot));
-    return Object.freeze({
-        state: source.state,
-        raw: source.raw,
-        byteDigest: source.digest,
-        byteLength: source.bytes,
-    });
-}
-/**
- * Restore one migration preimage only while both current postimage and backup
- * bytes remain exact. This is intentionally narrower than a general reset and
- * never removes the backup or migration history.
- */
-export function restoreStateMigrationPreimage(input) {
-    if (!/^smig_[a-f0-9]{32}$/.test(input.operationId)
-        || !/^[a-f0-9]{64}$/.test(input.expectedCurrentDigest)
-        || !/^[a-f0-9]{64}$/.test(input.expectedBackupDigest)) {
-        throw new StateMigrationApplyError('state_migration_rollback_binding_invalid');
-    }
-    const root = safeRoot(input.projectRoot);
-    const release = claimLock(root);
-    try {
-        const statePath = join(root, STATE_RELATIVE_PATH);
-        const backupPath = join(root, '.neocortex', `state.json.migration-backup-${input.operationId}`);
-        if (!existsSync(backupPath))
-            throw new StateMigrationApplyError('state_migration_backup_missing');
-        const backupInfo = lstatSync(backupPath);
-        if (!backupInfo.isFile() || backupInfo.isSymbolicLink()) {
-            throw new StateMigrationApplyError('state_migration_backup_conflict');
-        }
-        const currentRaw = readFileSync(statePath, 'utf8');
-        const backupRaw = readFileSync(backupPath, 'utf8');
-        if (sha256Bytes(currentRaw) !== input.expectedCurrentDigest) {
-            throw new StateMigrationApplyError('state_migration_rollback_postimage_conflict');
-        }
-        if (sha256Bytes(backupRaw) !== input.expectedBackupDigest) {
-            throw new StateMigrationApplyError('state_migration_backup_conflict');
-        }
-        atomicReplaceUtf8(statePath, backupRaw);
-        if (sha256Bytes(readFileSync(statePath)) !== input.expectedBackupDigest) {
-            throw new StateMigrationApplyError('state_migration_rollback_failed');
-        }
-        return { restoredDigest: input.expectedBackupDigest, backupPreserved: true };
-    }
-    finally {
-        release();
-    }
-}
-function claimLock(root) {
-    const lockPath = join(root, LOCK_RELATIVE_PATH);
-    mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 });
-    const ownerToken = randomUUID();
-    const ownerContents = `${process.pid}:${ownerToken}\n`;
-    const acquire = () => {
-        const ownerPath = `${lockPath}.${process.pid}.${randomUUID()}.owner`;
-        durableCreateUtf8(ownerPath, ownerContents);
-        try {
-            linkSync(ownerPath, lockPath);
-        }
-        finally {
-            try {
-                unlinkSync(ownerPath);
-            }
-            catch { /* orphan owners have no authority */ }
-            fsyncDirectoryBestEffort(dirname(lockPath));
-        }
-    };
-    try {
-        acquire();
-    }
-    catch (error) {
-        if (error.code !== 'EEXIST')
-            throw new StateMigrationApplyError('state_migration_lock_failed');
-        const stat = lstatSync(lockPath);
-        if (stat.isSymbolicLink() || !stat.isFile())
-            throw new StateMigrationApplyError('state_migration_lock_corrupt');
-        const owner = readFileSync(lockPath, 'utf8');
-        const ownerMatch = owner.match(/^([1-9][0-9]*):([a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12})\n$/i);
-        if (!ownerMatch || owner.length > 64)
-            throw new StateMigrationApplyError('state_migration_lock_corrupt');
-        let alive = true;
-        try {
-            process.kill(Number(ownerMatch[1]), 0);
-        }
-        catch (probe) {
-            alive = probe.code !== 'ESRCH';
-        }
-        if (alive)
-            throw new StateMigrationApplyError('state_migration_locked');
-        try {
-            unlinkSync(lockPath);
-            acquire();
-        }
-        catch {
-            throw new StateMigrationApplyError('state_migration_locked');
-        }
-    }
-    return () => {
-        try {
-            if (readFileSync(lockPath, 'utf8') !== ownerContents)
-                return;
-            unlinkSync(lockPath);
-            fsyncDirectoryBestEffort(dirname(lockPath));
-        }
-        catch { /* cleanup is best effort; never delete an unproven foreign lock */ }
-    };
-}
-function parseManifest(root) {
-    const path = join(root, MANIFEST_RELATIVE_PATH);
-    recoverAtomicReplaceUtf8(path);
-    if (!existsSync(path))
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        throw new StateMigrationApplyError('state_migration_manifest_corrupt');
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-        throw new StateMigrationApplyError('state_migration_manifest_corrupt');
-    const value = parsed;
-    if (value.schemaVersion !== 1
-        || typeof value.operationId !== 'string' || !/^smig_[a-f0-9]{32}$/.test(value.operationId)
-        || !['prepared', 'applied', 'rolled-back'].includes(String(value.phase))
-        || typeof value.sourceCanonicalHash !== 'string' || !/^[a-f0-9]{64}$/.test(value.sourceCanonicalHash)
-        || typeof value.sourceByteDigest !== 'string' || !/^[a-f0-9]{64}$/.test(value.sourceByteDigest)
-        || typeof value.targetCanonicalHash !== 'string' || !/^[a-f0-9]{64}$/.test(value.targetCanonicalHash)
-        || typeof value.targetByteDigest !== 'string' || !/^[a-f0-9]{64}$/.test(value.targetByteDigest)
-        || !Number.isSafeInteger(value.migratedEpicCount) || (value.migratedEpicCount ?? -1) < 0
-        || !Number.isSafeInteger(value.migratedStoryCount) || (value.migratedStoryCount ?? -1) < 0
-        || !Number.isSafeInteger(value.preservedUnknownFieldCount) || (value.preservedUnknownFieldCount ?? -1) < 0
-        || typeof value.backupPath !== 'string'
-        || value.backupPath !== join('.neocortex', `state.json.migration-backup-${value.operationId}`)) {
-        throw new StateMigrationApplyError('state_migration_manifest_corrupt');
-    }
-    return value;
-}
-function writeManifest(root, manifest) {
-    atomicReplaceUtf8(join(root, MANIFEST_RELATIVE_PATH), `${JSON.stringify(manifest, null, 2)}\n`);
-}
-function receipt(outcome, operationId, sourceBytesHash, targetBytesHash, sourceCanonicalHash, targetCanonicalHash, backupHash, rollbackStatus, migratedEpicCount, migratedStoryCount, preservedUnknownFieldCount, reasonCodes) {
-    const value = {
-        schemaVersion: STATE_MIGRATION_RECEIPT_SCHEMA,
-        operationId,
-        outcome,
-        sourceBytesHash,
-        targetBytesHash,
-        sourceCanonicalHash,
-        targetCanonicalHash,
-        backupHash,
-        rollbackStatus,
-        migratedEpicCount,
-        migratedStoryCount,
-        preservedUnknownFieldCount,
-        reasonCodes,
-        publicSafe: true,
-    };
-    assertStateMigrationReceiptV1(value);
-    return value;
-}
-export function previewStateMigration(projectRoot) {
-    const root = safeRoot(projectRoot);
-    let decision;
-    try {
-        decision = planStateMigration(readBoundedState(root).state);
-    }
-    catch (error) {
-        if (error instanceof StateMigrationHardStopError)
-            throw new StateMigrationApplyError(error.reasonCode, error.message);
-        throw error;
-    }
-    return decision.kind === 'migrate' ? decision.plan : null;
-}
-/** Apply one shared plan under a client-owned lock, byte CAS and durable backup. */
-export function applyStateMigration(projectRoot, expectedPlan, hooks = {}) {
-    const root = safeRoot(projectRoot);
-    const release = claimLock(root);
-    try {
-        const statePath = join(root, STATE_RELATIVE_PATH);
-        try {
-            recoverAtomicReplaceUtf8(statePath);
-        }
-        catch {
-            throw new StateMigrationApplyError('state_migration_atomic_recovery_failed');
-        }
-        if (!existsSync(statePath))
-            throw new StateMigrationApplyError('state_migration_state_missing');
-        const initialRaw = readBoundedState(root).raw;
-        if (expectedPlan?.sourceByteDigest && sha256Bytes(initialRaw) !== expectedPlan.sourceByteDigest) {
-            throw new StateMigrationApplyError('state_migration_expected_bytes_conflict');
-        }
-        let decision;
-        try {
-            decision = planStateMigration(parseState(initialRaw));
-        }
-        catch (error) {
-            if (error instanceof StateMigrationHardStopError)
-                throw new StateMigrationApplyError(error.reasonCode, error.message);
-            throw error;
-        }
-        const existing = parseManifest(root);
-        const currentBytesHash = sha256Bytes(initialRaw);
-        if (decision.kind === 'unchanged') {
-            if (expectedPlan && decision.sourceCanonicalHash !== expectedPlan.targetCanonicalHash) {
-                throw new StateMigrationApplyError('state_migration_expected_plan_conflict');
-            }
-            if (existing && existing.targetCanonicalHash === decision.sourceCanonicalHash) {
-                if (existing.targetByteDigest !== currentBytesHash) {
-                    throw new StateMigrationApplyError('state_migration_state_drift');
-                }
-                if (existing.phase === 'prepared')
-                    writeManifest(root, { ...existing, phase: 'applied' });
-                if (existing.phase === 'rolled-back')
-                    throw new StateMigrationApplyError('state_migration_state_drift');
-                return receipt('already-applied', existing.operationId, existing.sourceByteDigest, existing.targetByteDigest, existing.sourceCanonicalHash, existing.targetCanonicalHash, existing.sourceByteDigest, 'not-required', existing.migratedEpicCount, existing.migratedStoryCount, existing.preservedUnknownFieldCount, ['migration_replay_verified']);
-            }
-            if (existing)
-                throw new StateMigrationApplyError('state_migration_state_drift');
-            return receipt('already-applied', expectedPlan?.operationId ?? 'smig_00000000000000000000000000000000', currentBytesHash, currentBytesHash, decision.sourceCanonicalHash, decision.sourceCanonicalHash, null, 'not-required', 0, 0, 0, ['canonical_state_unchanged']);
-        }
-        const plan = decision.plan;
-        assertStateMigrationPlanV1(plan);
-        if (expectedPlan && (expectedPlan.operationId !== plan.operationId
-            || expectedPlan.sourceCanonicalHash !== plan.sourceCanonicalHash
-            || expectedPlan.targetCanonicalHash !== plan.targetCanonicalHash)) {
-            throw new StateMigrationApplyError('state_migration_expected_plan_conflict');
-        }
-        if (existing && existing.operationId !== plan.operationId) {
-            throw new StateMigrationApplyError('state_migration_operation_conflict');
-        }
-        const sourceByteDigest = currentBytesHash;
-        const targetRaw = stateRaw(plan.targetState);
-        const targetByteDigest = sha256Bytes(targetRaw);
-        const backupPath = join('.neocortex', `state.json.migration-backup-${plan.operationId}`);
-        const backupAbsolute = join(root, backupPath);
-        if (existsSync(backupAbsolute)) {
-            const backupStat = lstatSync(backupAbsolute);
-            if (backupStat.isSymbolicLink() || !backupStat.isFile() || sha256Bytes(readFileSync(backupAbsolute)) !== sourceByteDigest) {
-                throw new StateMigrationApplyError('state_migration_backup_conflict');
-            }
-        }
-        else {
-            durableCreateUtf8(backupAbsolute, initialRaw);
-        }
-        const manifest = {
-            schemaVersion: 1,
-            operationId: plan.operationId,
-            phase: 'prepared',
-            sourceCanonicalHash: plan.sourceCanonicalHash,
-            sourceByteDigest,
-            targetCanonicalHash: plan.targetCanonicalHash,
-            targetByteDigest,
-            migratedEpicCount: plan.migratedEpicIds.length,
-            migratedStoryCount: plan.migratedStoryIds.length,
-            preservedUnknownFieldCount: plan.preservedUnknownFieldCount,
-            backupPath,
-        };
-        writeManifest(root, manifest);
-        hooks.afterPrepared?.(statePath);
-        if (sha256Bytes(readFileSync(statePath)) !== sourceByteDigest) {
-            throw new StateMigrationApplyError('state_migration_source_cas_conflict');
-        }
-        try {
-            atomicReplaceUtf8(statePath, targetRaw);
-            hooks.afterReplace?.(statePath);
-            const installedRaw = readFileSync(statePath, 'utf8');
-            const installed = parseState(installedRaw);
-            if (sha256Bytes(installedRaw) !== targetByteDigest || stateMigrationDigest(installed) !== plan.targetCanonicalHash) {
-                throw new Error('readback-digest-mismatch');
-            }
-            writeManifest(root, { ...manifest, phase: 'applied' });
-        }
-        catch (error) {
-            try {
-                const backupRaw = readFileSync(backupAbsolute, 'utf8');
-                if (sha256Bytes(backupRaw) !== sourceByteDigest)
-                    throw new Error('rollback-backup-digest-mismatch');
-                atomicReplaceUtf8(statePath, backupRaw);
-                if (sha256Bytes(readFileSync(statePath)) !== sourceByteDigest)
-                    throw new Error('rollback-digest-mismatch');
-                writeManifest(root, { ...manifest, phase: 'rolled-back' });
-            }
-            catch {
-                const unverified = receipt('blocked', plan.operationId, sourceByteDigest, targetByteDigest, plan.sourceCanonicalHash, plan.targetCanonicalHash, sourceByteDigest, 'unverified', plan.migratedEpicIds.length, plan.migratedStoryIds.length, plan.preservedUnknownFieldCount, ['apply_failed', 'rollback_unverified']);
-                throw new StateMigrationApplyError('state_migration_rollback_failed', String(error), unverified);
-            }
-            const rolledBack = receipt('blocked', plan.operationId, sourceByteDigest, targetByteDigest, plan.sourceCanonicalHash, plan.targetCanonicalHash, sourceByteDigest, 'restored', plan.migratedEpicIds.length, plan.migratedStoryIds.length, plan.preservedUnknownFieldCount, ['apply_failed', 'rollback_verified']);
-            throw new StateMigrationApplyError('state_migration_apply_rolled_back', String(error), rolledBack);
-        }
-        return receipt('applied', plan.operationId, sourceByteDigest, targetByteDigest, plan.sourceCanonicalHash, plan.targetCanonicalHash, sourceByteDigest, 'not-required', plan.migratedEpicIds.length, plan.migratedStoryIds.length, plan.preservedUnknownFieldCount, ['lock_acquired', 'source_cas_verified', 'backup_verified', 'atomic_replace_verified']);
-    }
-    finally {
-        release();
-    }
-}
+import{createHash as z,randomUUID as U}from"node:crypto";import{existsSync as m,linkSync as J,lstatSync as I,mkdirSync as G,readFileSync as f,realpathSync as K,statSync as L,unlinkSync as T}from"node:fs";import{dirname as x,join as p,resolve as X}from"node:path";import{assertStateMigrationPlanV1 as Y,assertStateMigrationReceiptV1 as Q,planStateMigration as M,stateMigrationDigest as W,STATE_MIGRATION_RECEIPT_SCHEMA as Z,StateMigrationHardStopError as R}from"../../../shared/dist/state/index.js";import{atomicReplaceUtf8 as H,durableCreateUtf8 as N,fsyncDirectoryBestEffort as O,recoverAtomicReplaceUtf8 as P}from"../fs/atomic-state-replace.js";const E=p(".neocortex","state.json"),$=p(".neocortex","state-migration.json"),tt=p(".neocortex","state-migration.lock"),V=4*1024*1024;class a extends Error{reasonCode;receipt;constructor(t,r=t,e){super(r),this.reasonCode=t,this.receipt=e,this.name="StateMigrationApplyError"}}const _=o=>z("sha256").update(o).digest("hex"),et=o=>`${JSON.stringify(o,null,2)}
+`;function b(o){let t;try{t=K(X(o))}catch{throw new a("state_migration_root_invalid")}if(!L(t).isDirectory())throw new a("state_migration_root_invalid");for(const r of[".neocortex",E,$]){const e=p(t,r);if(!m(e))continue;const s=I(e);if(s.isSymbolicLink()||r!==".neocortex"&&!s.isFile()||r===".neocortex"&&!s.isDirectory())throw new a("state_migration_symlink_or_type_rejected")}return t}function j(o){try{const t=JSON.parse(o);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{}throw new a("state_migration_state_corrupt")}function v(o){const t=p(o,E);if(!m(t))throw new a("state_migration_state_missing");const r=L(t).size;if(r>V)throw new a("state_migration_input_too_large");const e=f(t,"utf8"),s=Buffer.byteLength(e,"utf8");if(s!==r||s>V)throw new a("state_migration_source_changed");return{state:j(e),raw:e,digest:_(e),bytes:s}}function ct(o){const t=v(b(o));let r;try{r=M(t.state)}catch(l){throw l instanceof R?new a(l.reasonCode,l.message):l}const e=r.kind==="migrate"?r.plan.targetState:t.state,s=(l,g)=>{const i=l[g];return i&&typeof i=="object"&&!Array.isArray(i)?Object.keys(i).length:0},c=r.kind==="migrate"?(({targetState:l,...g})=>g)(r.plan):null;return Object.freeze({schemaVersion:"StateMigrationAuthority/1.0",sourceByteDigest:t.digest,sourceCanonicalHash:r.kind==="migrate"?r.plan.sourceCanonicalHash:r.sourceCanonicalHash,sourceByteLength:t.bytes,before:{epics:s(t.state,"epics"),stories:s(t.state,"stories")},after:{epics:s(e,"epics"),stories:s(e,"stories")},outcome:r.kind,plan:c,publicSafe:!0})}function lt(o){const t=v(b(o));return Object.freeze({state:t.state,raw:t.raw,byteDigest:t.digest,byteLength:t.bytes})}function gt(o){if(!/^smig_[a-f0-9]{32}$/.test(o.operationId)||!/^[a-f0-9]{64}$/.test(o.expectedCurrentDigest)||!/^[a-f0-9]{64}$/.test(o.expectedBackupDigest))throw new a("state_migration_rollback_binding_invalid");const t=b(o.projectRoot),r=q(t);try{const e=p(t,E),s=p(t,".neocortex",`state.json.migration-backup-${o.operationId}`);if(!m(s))throw new a("state_migration_backup_missing");const c=I(s);if(!c.isFile()||c.isSymbolicLink())throw new a("state_migration_backup_conflict");const l=f(e,"utf8"),g=f(s,"utf8");if(_(l)!==o.expectedCurrentDigest)throw new a("state_migration_rollback_postimage_conflict");if(_(g)!==o.expectedBackupDigest)throw new a("state_migration_backup_conflict");if(H(e,g),_(f(e))!==o.expectedBackupDigest)throw new a("state_migration_rollback_failed");return{restoredDigest:o.expectedBackupDigest,backupPreserved:!0}}finally{r()}}function q(o){const t=p(o,tt);G(x(t),{recursive:!0,mode:448});const r=U(),e=`${process.pid}:${r}
+`,s=()=>{const c=`${t}.${process.pid}.${U()}.owner`;N(c,e);try{J(c,t)}finally{try{T(c)}catch{}O(x(t))}};try{s()}catch(c){if(c.code!=="EEXIST")throw new a("state_migration_lock_failed");const l=I(t);if(l.isSymbolicLink()||!l.isFile())throw new a("state_migration_lock_corrupt");const g=f(t,"utf8"),i=g.match(/^([1-9][0-9]*):([a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12})\n$/i);if(!i||g.length>64)throw new a("state_migration_lock_corrupt");let h=!0;try{process.kill(Number(i[1]),0)}catch(n){h=n.code!=="ESRCH"}if(h)throw new a("state_migration_locked");try{T(t),s()}catch{throw new a("state_migration_locked")}}return()=>{try{if(f(t,"utf8")!==e)return;T(t),O(x(t))}catch{}}}function rt(o){const t=p(o,$);if(P(t),!m(t))return null;let r;try{r=JSON.parse(f(t,"utf8"))}catch{throw new a("state_migration_manifest_corrupt")}if(!r||typeof r!="object"||Array.isArray(r))throw new a("state_migration_manifest_corrupt");const e=r;if(e.schemaVersion!==1||typeof e.operationId!="string"||!/^smig_[a-f0-9]{32}$/.test(e.operationId)||!["prepared","applied","rolled-back"].includes(String(e.phase))||typeof e.sourceCanonicalHash!="string"||!/^[a-f0-9]{64}$/.test(e.sourceCanonicalHash)||typeof e.sourceByteDigest!="string"||!/^[a-f0-9]{64}$/.test(e.sourceByteDigest)||typeof e.targetCanonicalHash!="string"||!/^[a-f0-9]{64}$/.test(e.targetCanonicalHash)||typeof e.targetByteDigest!="string"||!/^[a-f0-9]{64}$/.test(e.targetByteDigest)||!Number.isSafeInteger(e.migratedEpicCount)||(e.migratedEpicCount??-1)<0||!Number.isSafeInteger(e.migratedStoryCount)||(e.migratedStoryCount??-1)<0||!Number.isSafeInteger(e.preservedUnknownFieldCount)||(e.preservedUnknownFieldCount??-1)<0||typeof e.backupPath!="string"||e.backupPath!==p(".neocortex",`state.json.migration-backup-${e.operationId}`))throw new a("state_migration_manifest_corrupt");return e}function D(o,t){H(p(o,$),`${JSON.stringify(t,null,2)}
+`)}function S(o,t,r,e,s,c,l,g,i,h,n,u){const w={schemaVersion:Z,operationId:t,outcome:o,sourceBytesHash:r,targetBytesHash:e,sourceCanonicalHash:s,targetCanonicalHash:c,backupHash:l,rollbackStatus:g,migratedEpicCount:i,migratedStoryCount:h,preservedUnknownFieldCount:n,reasonCodes:u,publicSafe:!0};return Q(w),w}function pt(o){const t=b(o);let r;try{r=M(v(t).state)}catch(e){throw e instanceof R?new a(e.reasonCode,e.message):e}return r.kind==="migrate"?r.plan:null}function ut(o,t,r={}){const e=b(o),s=q(e);try{const c=p(e,E);try{P(c)}catch{throw new a("state_migration_atomic_recovery_failed")}if(!m(c))throw new a("state_migration_state_missing");const l=v(e).raw;if(t?.sourceByteDigest&&_(l)!==t.sourceByteDigest)throw new a("state_migration_expected_bytes_conflict");let g;try{g=M(j(l))}catch(d){throw d instanceof R?new a(d.reasonCode,d.message):d}const i=rt(e),h=_(l);if(g.kind==="unchanged"){if(t&&g.sourceCanonicalHash!==t.targetCanonicalHash)throw new a("state_migration_expected_plan_conflict");if(i&&i.targetCanonicalHash===g.sourceCanonicalHash){if(i.targetByteDigest!==h)throw new a("state_migration_state_drift");if(i.phase==="prepared"&&D(e,{...i,phase:"applied"}),i.phase==="rolled-back")throw new a("state_migration_state_drift");return S("already-applied",i.operationId,i.sourceByteDigest,i.targetByteDigest,i.sourceCanonicalHash,i.targetCanonicalHash,i.sourceByteDigest,"not-required",i.migratedEpicCount,i.migratedStoryCount,i.preservedUnknownFieldCount,["migration_replay_verified"])}if(i)throw new a("state_migration_state_drift");return S("already-applied",t?.operationId??"smig_00000000000000000000000000000000",h,h,g.sourceCanonicalHash,g.sourceCanonicalHash,null,"not-required",0,0,0,["canonical_state_unchanged"])}const n=g.plan;if(Y(n),t&&(t.operationId!==n.operationId||t.sourceCanonicalHash!==n.sourceCanonicalHash||t.targetCanonicalHash!==n.targetCanonicalHash))throw new a("state_migration_expected_plan_conflict");if(i&&i.operationId!==n.operationId)throw new a("state_migration_operation_conflict");const u=h,w=et(n.targetState),y=_(w),F=p(".neocortex",`state.json.migration-backup-${n.operationId}`),k=p(e,F);if(m(k)){const d=I(k);if(d.isSymbolicLink()||!d.isFile()||_(f(k))!==u)throw new a("state_migration_backup_conflict")}else N(k,l);const A={schemaVersion:1,operationId:n.operationId,phase:"prepared",sourceCanonicalHash:n.sourceCanonicalHash,sourceByteDigest:u,targetCanonicalHash:n.targetCanonicalHash,targetByteDigest:y,migratedEpicCount:n.migratedEpicIds.length,migratedStoryCount:n.migratedStoryIds.length,preservedUnknownFieldCount:n.preservedUnknownFieldCount,backupPath:F};if(D(e,A),r.afterPrepared?.(c),_(f(c))!==u)throw new a("state_migration_source_cas_conflict");try{H(c,w),r.afterReplace?.(c);const d=f(c,"utf8"),B=j(d);if(_(d)!==y||W(B)!==n.targetCanonicalHash)throw new Error("readback-digest-mismatch");D(e,{...A,phase:"applied"})}catch(d){try{const C=f(k,"utf8");if(_(C)!==u)throw new Error("rollback-backup-digest-mismatch");if(H(c,C),_(f(c))!==u)throw new Error("rollback-digest-mismatch");D(e,{...A,phase:"rolled-back"})}catch{const C=S("blocked",n.operationId,u,y,n.sourceCanonicalHash,n.targetCanonicalHash,u,"unverified",n.migratedEpicIds.length,n.migratedStoryIds.length,n.preservedUnknownFieldCount,["apply_failed","rollback_unverified"]);throw new a("state_migration_rollback_failed",String(d),C)}const B=S("blocked",n.operationId,u,y,n.sourceCanonicalHash,n.targetCanonicalHash,u,"restored",n.migratedEpicIds.length,n.migratedStoryIds.length,n.preservedUnknownFieldCount,["apply_failed","rollback_verified"]);throw new a("state_migration_apply_rolled_back",String(d),B)}return S("applied",n.operationId,u,y,n.sourceCanonicalHash,n.targetCanonicalHash,u,"not-required",n.migratedEpicIds.length,n.migratedStoryIds.length,n.preservedUnknownFieldCount,["lock_acquired","source_cas_verified","backup_verified","atomic_replace_verified"])}finally{s()}}export{V as STATE_MIGRATION_INPUT_LIMIT_BYTES,a as StateMigrationApplyError,ut as applyStateMigration,ct as collectStateMigrationAuthority,pt as previewStateMigration,lt as readStateMigrationSourceSnapshot,gt as restoreStateMigrationPreimage};

package/packages/client/dist/policy/architecture-policy.js

@@ -1,184 +1,2 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * Epic P107.02: Client-side Policy Reader
- *
- * Reads `.neocortex/architecture-policy.json` from consumer project root,
- * validates structure against P107.01 wire-format types, and exposes to
- * `collectStateSnapshot` hook so the server receives it via request body.
- *
- * Fail-soft by design -- NEVER throws. File absent / malformed / invalid
- * schema all return `undefined` (warning to stderr when non-trivial).
- *
- * Pattern reference:
- * - P101.06/07 (client-side file reader + hook pattern)
- * - P63.01 (UTF-8 BOM defense)
- * - P103.06 (CRLF normalization)
- */
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-/**
- * Relative path from project root to consumer policy file.
- * Consumer copies `architecture-policy.template.json` (from repo root) to
- * this path and edits.
- */
-export const POLICY_FILE_PATH = '.neocortex/architecture-policy.json';
-// Frozen canonical enum sets mirroring JSON Schema (core/data/architecture-policy-schema.json).
-// Kept in sync with SSoT types in @neocortex/shared/types/architecture-policy.ts.
-const VALID_MODES = Object.freeze([
-    'interactive',
-    'yoloop_friendly',
-    'fully_automated',
-]);
-const VALID_CLOUD_PROVIDERS = Object.freeze(['aws', 'gcp', 'oci', 'azure', 'any']);
-const VALID_API_STYLES = Object.freeze(['REST', 'GraphQL', 'tRPC']);
-const VALID_INTEGRATION_STYLES = Object.freeze(['sync', 'async', 'hybrid']);
-const VALID_UI_PRIORITIES = Object.freeze(['mobile-first', 'desktop-first', 'responsive']);
-const VALID_REFACTOR_AGGRESSIVENESS = Object.freeze(['conservative', 'balanced', 'aggressive']);
-const VALID_TEST_WORKFLOWS = Object.freeze(['TDD', 'test-after', 'BDD']);
-/** Known optional default field names per ArchitectureDefaults interface. */
-const KNOWN_DEFAULT_FIELDS = new Set([
-    'primary_persona',
-    'cloud_provider',
-    'api_style',
-    'integration_style',
-    'ui_priority',
-    'refactor_aggressiveness',
-    'test_workflow',
-]);
-/**
- * Pure function validator. Zero I/O. Deterministic.
- *
- * Returns `ArchitecturePolicyValidationResult` with:
- * - `valid: true` iff all required fields correct and no hard errors
- * - `errors`: hard failures (schema version mismatch, bad mode, type errors)
- * - `warnings`: soft issues (unknown optional fields -- forward-compat)
- */
-export function validatePolicy(candidate) {
-    const errors = [];
-    const warnings = [];
-    if (typeof candidate !== 'object' || candidate === null || Array.isArray(candidate)) {
-        return {
-            valid: false,
-            errors: Object.freeze(['Policy must be a plain object']),
-            warnings: Object.freeze([]),
-        };
-    }
-    const c = candidate;
-    // schema_version: must be literal 1
-    if (c.schema_version !== 1) {
-        errors.push(`schema_version must be 1, got ${JSON.stringify(c.schema_version)}`);
-    }
-    // mode: must be one of 3 valid values
-    if (typeof c.mode !== 'string' || !VALID_MODES.includes(c.mode)) {
-        errors.push(`mode must be one of [${VALID_MODES.join(', ')}], got ${JSON.stringify(c.mode)}`);
-    }
-    // defaults: optional object, each field must match its enum (or null/undefined)
-    if (c.defaults !== undefined && c.defaults !== null) {
-        if (typeof c.defaults !== 'object' || Array.isArray(c.defaults)) {
-            errors.push('defaults must be an object');
-        }
-        else {
-            const defaults = c.defaults;
-            // Unknown-field warnings (forward-compat: future versions may add fields)
-            for (const key of Object.keys(defaults)) {
-                if (!KNOWN_DEFAULT_FIELDS.has(key)) {
-                    warnings.push(`defaults.${key}: unknown field (ignored)`);
-                }
-            }
-            // Per-field value validation (null is allowed -- means "unset", asks human)
-            if (defaults.primary_persona !== undefined &&
-                defaults.primary_persona !== null &&
-                typeof defaults.primary_persona !== 'string') {
-                errors.push(`defaults.primary_persona must be string or null`);
-            }
-            validateEnumField(defaults, 'cloud_provider', VALID_CLOUD_PROVIDERS, errors);
-            validateEnumField(defaults, 'api_style', VALID_API_STYLES, errors);
-            validateEnumField(defaults, 'integration_style', VALID_INTEGRATION_STYLES, errors);
-            validateEnumField(defaults, 'ui_priority', VALID_UI_PRIORITIES, errors);
-            validateEnumField(defaults, 'refactor_aggressiveness', VALID_REFACTOR_AGGRESSIVENESS, errors);
-            validateEnumField(defaults, 'test_workflow', VALID_TEST_WORKFLOWS, errors);
-        }
-    }
-    // preserved_interactions: optional array of strings
-    if (c.preserved_interactions !== undefined && c.preserved_interactions !== null) {
-        if (!Array.isArray(c.preserved_interactions) ||
-            !c.preserved_interactions.every((s) => typeof s === 'string')) {
-            errors.push('preserved_interactions must be array of strings');
-        }
-    }
-    return {
-        valid: errors.length === 0,
-        errors: Object.freeze(errors),
-        warnings: Object.freeze(warnings),
-    };
-}
-/**
- * Async reader. NEVER throws.
- *
- * Returns `undefined` when:
- * - file does not exist (ENOENT; silent, expected default)
- * - permission denied (EACCES; warns stderr)
- * - malformed JSON (warns stderr with path)
- * - schema invalid (warns stderr with error list)
- *
- * Returns typed `ArchitecturePolicy` on full success.
- */
-export async function readArchitecturePolicy(projectRoot) {
-    const absPath = join(projectRoot, POLICY_FILE_PATH);
-    let raw;
-    try {
-        raw = await readFile(absPath, 'utf8');
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === 'ENOENT') {
-            // Silent: file absent is the expected default.
-            return undefined;
-        }
-        const msg = err.message ?? String(err);
-        // Defensive warn -- operational issue (permission, etc).
-        // eslint-disable-next-line no-console
-        console.warn(`[Neocortex] architecture-policy read failed (${absPath}): ${msg}`);
-        return undefined;
-    }
-    // Encoding normalization (P63 BOM + P103 CRLF patterns).
-    // eslint-disable-next-line no-misleading-character-class
-    const normalized = raw.replace(/^/, '').replace(/\r\n/g, '\n');
-    let parsed;
-    try {
-        parsed = JSON.parse(normalized);
-    }
-    catch (err) {
-        const msg = err.message ?? String(err);
-        // eslint-disable-next-line no-console
-        console.warn(`[Neocortex] architecture-policy malformed JSON (${absPath}): ${msg}. Proceeding without policy.`);
-        return undefined;
-    }
-    const result = validatePolicy(parsed);
-    if (!result.valid) {
-        // eslint-disable-next-line no-console
-        console.warn(`[Neocortex] architecture-policy schema invalid (${absPath}): ${result.errors.join('; ')}. Proceeding without policy.`);
-        return undefined;
-    }
-    return parsed;
-}
-// ── Internal helpers ──────────────────────────────────────────────────────
-function validateEnumField(defaults, field, validValues, errors) {
-    const val = defaults[field];
-    if (val === undefined || val === null)
-        return; // unset is OK
-    if (typeof val !== 'string' || !validValues.includes(val)) {
-        errors.push(`defaults.${field} must be one of [${validValues.join(', ')}] or null, got ${JSON.stringify(val)}`);
-    }
-}
+import{readFile as u}from"node:fs/promises";import{join as d}from"node:path";const p=".neocortex/architecture-policy.json",f=Object.freeze(["interactive","yoloop_friendly","fully_automated"]),y=Object.freeze(["aws","gcp","oci","azure","any"]),_=Object.freeze(["REST","GraphQL","tRPC"]),g=Object.freeze(["sync","async","hybrid"]),m=Object.freeze(["mobile-first","desktop-first","responsive"]),O=Object.freeze(["conservative","balanced","aggressive"]),b=Object.freeze(["TDD","test-after","BDD"]),h=new Set(["primary_persona","cloud_provider","api_style","integration_style","ui_priority","refactor_aggressiveness","test_workflow"]);function v(n){const r=[],o=[];if(typeof n!="object"||n===null||Array.isArray(n))return{valid:!1,errors:Object.freeze(["Policy must be a plain object"]),warnings:Object.freeze([])};const t=n;if(t.schema_version!==1&&r.push(`schema_version must be 1, got ${JSON.stringify(t.schema_version)}`),(typeof t.mode!="string"||!f.includes(t.mode))&&r.push(`mode must be one of [${f.join(", ")}], got ${JSON.stringify(t.mode)}`),t.defaults!==void 0&&t.defaults!==null)if(typeof t.defaults!="object"||Array.isArray(t.defaults))r.push("defaults must be an object");else{const e=t.defaults;for(const c of Object.keys(e))h.has(c)||o.push(`defaults.${c}: unknown field (ignored)`);e.primary_persona!==void 0&&e.primary_persona!==null&&typeof e.primary_persona!="string"&&r.push("defaults.primary_persona must be string or null"),i(e,"cloud_provider",y,r),i(e,"api_style",_,r),i(e,"integration_style",g,r),i(e,"ui_priority",m,r),i(e,"refactor_aggressiveness",O,r),i(e,"test_workflow",b,r)}return t.preserved_interactions!==void 0&&t.preserved_interactions!==null&&(!Array.isArray(t.preserved_interactions)||!t.preserved_interactions.every(e=>typeof e=="string"))&&r.push("preserved_interactions must be array of strings"),{valid:r.length===0,errors:Object.freeze(r),warnings:Object.freeze(o)}}async function A(n){const r=d(n,p);let o;try{o=await u(r,"utf8")}catch(s){if(s.code==="ENOENT")return;const l=s.message??String(s);console.warn(`[Neocortex] architecture-policy read failed (${r}): ${l}`);return}const t=o.replace(/^/,"").replace(/\r\n/g,`
+`);let e;try{e=JSON.parse(t)}catch(s){const a=s.message??String(s);console.warn(`[Neocortex] architecture-policy malformed JSON (${r}): ${a}. Proceeding without policy.`);return}const c=v(e);if(!c.valid){console.warn(`[Neocortex] architecture-policy schema invalid (${r}): ${c.errors.join("; ")}. Proceeding without policy.`);return}return e}function i(n,r,o,t){const e=n[r];e!=null&&(typeof e!="string"||!o.includes(e))&&t.push(`defaults.${r} must be one of [${o.join(", ")}] or null, got ${JSON.stringify(e)}`)}export{p as POLICY_FILE_PATH,A as readArchitecturePolicy,v as validatePolicy};

package/packages/client/dist/policy/index.js

@@ -1,7 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * Barrel export for Epic P107.02 policy reader module.
- */
-export { readArchitecturePolicy, validatePolicy, POLICY_FILE_PATH, } from './architecture-policy.js';
+import{readArchitecturePolicy as c,validatePolicy as i,POLICY_FILE_PATH as o}from"./architecture-policy.js";export{o as POLICY_FILE_PATH,c as readArchitecturePolicy,i as validatePolicy};

package/packages/client/dist/policy/shared-policy-types.js

@@ -1,38 +0,0 @@
-/**
- * P119.02: Inlined byte-identical types from
- * `@neocortex/shared/types/architecture-policy`.
- *
- * SSoT-Shadow pattern (P92.01 server precedent extended by P117.01 to client
- * checkpoint dist + P117.07 to client yoloop dist). Client tarball is published
- * standalone via `@ornexus/neocortex` and does NOT include `@neocortex/shared`
- * as a runtime dependency (workspace package, excluded from tarball per
- * `.npmignore` + `tsconfig.build.json`). Any non-erased import of
- * `@neocortex/shared` in `packages/client/dist/**` causes runtime
- * `ERR_MODULE_NOT_FOUND` on globally installed `@ornexus/neocortex`.
- *
- * Pre-P119.02, three files leaked `import type` statements from
- * `@neocortex/shared` in the published v4.19.1 tarball:
- *   - dist/policy/architecture-policy.d.ts
- *   - dist/policy/index.d.ts
- *   - dist/commands/invoke.d.ts (imported `YoloopPersistedState`)
- *
- * Type-only `import type` is erased at runtime (no module resolution attempt),
- * but produces TS2307 in consumer projects that try to use the types via
- * globally-installed CLI (`npm install -g @ornexus/neocortex`).
- *
- * Sync responsibility: `policy-shared-sync.test.ts` (client-side drift test,
- * mirror of `checkpoint-shared-sync.test.ts` P117.01). Drift test fails CI
- * if these diverge from SSoT canonical at
- * `packages/shared/src/types/architecture-policy.ts`.
- *
- * Defense-in-depth: `validate-pre-publish.js` ships
- * `validateClientNoSharedImport()` (P117.01) scanning client dist for
- * `@neocortex/shared` runtime references. P119.02 expands its scope to also
- * walk `dist/policy/` and `dist/commands/` (in addition to checkpoint + yoloop
- * coverage from P117).
- *
- * DO NOT EDIT WITHOUT also editing
- * `packages/shared/src/types/architecture-policy.ts`.
- */
-export {};
-// === END P119.02 ===