@rubytech/create-maxy-code 0.1.0

package/payload/platform/scripts/dedupe-userprofile-ghosts.sh

@@ -0,0 +1,388 @@
+#!/usr/bin/env bash
+# ============================================================
+# dedupe-userprofile-ghosts.sh — Task 792
+#
+# Purpose
+# -------
+# Remove ghost AdminUser + UserProfile rows whose userId does not appear
+# in users.json (carryover from the userId-minting bug fixed by Task 791),
+# and dedupe (accountId, userId) UserProfile collisions (would-be schema
+# violations once the new constraint is applied).
+#
+# Per loser:
+#   1. Reparent every outbound edge to the winner — except edges whose
+#      target is itself a loser, edges that would create a duplicate of
+#      an edge the winner already has, and self-loops.
+#   2. Reparent every inbound edge to the winner under the same rules.
+#   3. DETACH DELETE the loser node.
+#
+# All work is operator-invoked over SSH. The script is idempotent:
+# a second run logs `[dedupe-userprofile] nothing-to-dedupe brand=<n>`
+# and exits 0 with no writes.
+#
+# Usage
+# -----
+#   bash dedupe-userprofile-ghosts.sh [--brand=NAME] [--dry-run]
+#
+#   --brand=NAME   Brand name (e.g. "maxy", "realagent"). Auto-detected if
+#                  exactly one ~/.<brand>/.neo4j-password exists.
+#   --dry-run      Print plan without writes.
+#
+# Reads:
+#   ~/.<brand>/.neo4j-password   Neo4j password
+#   ~/.<brand>/.env              NEO4J_URI (override with env var)
+#   ~/.<brand>/users.json        live userIds
+#
+# Edge-reparent caveat
+# --------------------
+# Reparented edges keep their original properties. Properties on the
+# *other* node (e.g. a Preference's own `userId`) are not rewritten —
+# if a Preference's userId no longer matches its parent UserProfile's
+# userId after dedupe, it surfaces in subsequent `[graph-health]` ticks
+# and is the responsibility of a follow-up task. This script's contract
+# is "no UserProfile/AdminUser ghost nodes remain", not "every property
+# referencing a ghost userId is rewritten".
+# ============================================================
+
+set -euo pipefail
+
+BRAND=""
+DRY_RUN=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --brand=*) BRAND="${1#*=}"; shift ;;
+    --brand)   BRAND="${2:-}"; shift 2 ;;
+    --dry-run) DRY_RUN=1; shift ;;
+    -h|--help)
+      sed -n '2,/^# =\{20,\}/p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+# --- Brand detection ------------------------------------------------
+if [ -z "$BRAND" ]; then
+  candidates=()
+  for d in "$HOME"/.maxy "$HOME"/.realagent; do
+    if [ -f "$d/.neo4j-password" ]; then
+      candidates+=("$(basename "$d" | sed 's/^\.//')")
+    fi
+  done
+  if [ "${#candidates[@]}" -eq 1 ]; then
+    BRAND="${candidates[0]}"
+  elif [ "${#candidates[@]}" -gt 1 ]; then
+    echo "Error: multiple brand dirs (${candidates[*]}); pass --brand=NAME" >&2
+    exit 1
+  else
+    echo "Error: no brand dir with .neo4j-password under ~/.maxy or ~/.realagent" >&2
+    exit 1
+  fi
+fi
+
+BRAND_DIR="$HOME/.$BRAND"
+[ -d "$BRAND_DIR" ] || { echo "Error: $BRAND_DIR not found" >&2; exit 1; }
+
+PASSWORD_FILE="$BRAND_DIR/.neo4j-password"
+ENV_FILE="$BRAND_DIR/.env"
+USERS_FILE="$BRAND_DIR/users.json"
+
+[ -f "$PASSWORD_FILE" ] || { echo "Error: $PASSWORD_FILE missing" >&2; exit 1; }
+[ -f "$USERS_FILE" ]    || { echo "Error: $USERS_FILE missing" >&2; exit 1; }
+
+NEO4J_PASSWORD="$(cat "$PASSWORD_FILE")"
+NEO4J_USER="${NEO4J_USER:-neo4j}"
+NEO4J_URI="${NEO4J_URI:-}"
+if [ -z "$NEO4J_URI" ] && [ -f "$ENV_FILE" ]; then
+  # shellcheck disable=SC2002
+  NEO4J_URI="$(awk -F'=' '/^NEO4J_URI=/ {sub(/^NEO4J_URI=/,""); print; exit}' "$ENV_FILE")"
+fi
+[ -n "$NEO4J_URI" ] || { echo "Error: NEO4J_URI not in env or $ENV_FILE" >&2; exit 1; }
+
+if ! command -v cypher-shell >/dev/null 2>&1; then
+  echo "Error: cypher-shell not found in PATH" >&2
+  exit 1
+fi
+
+# --- Live userIds (from users.json) ---------------------------------
+# Build a Cypher list literal: ['uid1', 'uid2', ...]
+LIVE_USER_IDS_CYPHER="$(python3 -c '
+import json, sys
+with open(sys.argv[1]) as f:
+    ids = [u["userId"] for u in json.load(f) if u.get("userId")]
+print("[" + ",".join("'\''" + i.replace("'\''","''") + "'\''" for i in ids) + "]")
+' "$USERS_FILE")"
+
+if [ "$LIVE_USER_IDS_CYPHER" = "[]" ]; then
+  echo "Error: $USERS_FILE has no userId entries" >&2
+  exit 1
+fi
+
+# --- Cypher-shell helpers -------------------------------------------
+cs() {
+  cypher-shell -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" "$@"
+}
+
+now_ms() { python3 -c 'import time; print(int(time.time()*1000))'; }
+
+START_MS=$(now_ms)
+REPARENTED_TOTAL=0
+DELETED_TOTAL=0
+
+# --- Per-loser reparent + delete ------------------------------------
+# Args: $1=label (UserProfile|AdminUser) $2=loserEid $3=winnerEid $4=allLosersJson
+# (allLosersJson is a Cypher list literal of all loser eids — used to skip
+# edges between two ghosts that will both be deleted.)
+dedupe_one() {
+  local label="$1" loser_eid="$2" winner_eid="$3" all_losers_cypher="$4"
+
+  echo "[dedupe-userprofile] delete elementId=$loser_eid label=$label" >&2
+
+  if [ "$DRY_RUN" = "1" ]; then
+    DELETED_TOTAL=$((DELETED_TOTAL + 1))
+    return 0
+  fi
+
+  # Single transaction: reparent outbound, reparent inbound, delete loser.
+  # Skips:
+  #   - edges to/from other losers (they die together)
+  #   - edges that would duplicate an edge the winner already has
+  #   - self-loops on winner
+  local out
+  out="$(cs --format plain <<CYPHER
+CYPHER 5
+MATCH (loser) WHERE elementId(loser) = '$loser_eid'
+MATCH (winner) WHERE elementId(winner) = '$winner_eid'
+CALL {
+  WITH loser, winner
+  MATCH (loser)-[r]->(o)
+  WHERE elementId(o) <> elementId(winner)
+    AND NOT elementId(o) IN $all_losers_cypher
+    AND NOT EXISTS { MATCH (winner)-[r2]->(o) WHERE type(r2) = type(r) }
+  WITH winner, o, type(r) AS t, properties(r) AS p, r
+  CREATE (winner)-[nr:\$(t)]->(o)
+  SET nr = p
+  RETURN count(*) AS outMoved
+}
+CALL {
+  WITH loser, winner
+  MATCH (i)-[r]->(loser)
+  WHERE elementId(i) <> elementId(winner)
+    AND NOT elementId(i) IN $all_losers_cypher
+    AND NOT EXISTS { MATCH (i)-[r2]->(winner) WHERE type(r2) = type(r) }
+  WITH winner, i, type(r) AS t, properties(r) AS p, r
+  CREATE (i)-[nr:\$(t)]->(winner)
+  SET nr = p
+  RETURN count(*) AS inMoved
+}
+WITH loser, outMoved, inMoved
+DETACH DELETE loser
+RETURN outMoved + inMoved AS reparented;
+CYPHER
+)"
+
+  # Parse result (last numeric token)
+  local moved
+  moved="$(printf '%s\n' "$out" | awk '/^[0-9]+$/ {n=$0} END {print (n+0)}')"
+  REPARENTED_TOTAL=$((REPARENTED_TOTAL + moved))
+  DELETED_TOTAL=$((DELETED_TOTAL + 1))
+  if [ "$moved" -gt 0 ]; then
+    echo "[dedupe-userprofile] reparent edges=$moved from=$loser_eid to=$winner_eid" >&2
+  fi
+}
+
+# --- Plan both phases up front --------------------------------------
+# So that `start` / `nothing-to-dedupe` / `DRY-RUN` lines fire BEFORE
+# any bucket/delete events. Pre-count ghosts per phase = total rows in
+# the plan minus distinct accountIds (one keeper per account; solo-tier).
+
+plan_admin="$(cs --format plain <<CYPHER
+MATCH (au:AdminUser)-[:ADMIN_OF]->(b:LocalBusiness)
+WITH b.accountId AS accountId, au
+WITH accountId, collect({eid: elementId(au), userId: coalesce(au.userId, '')}) AS rows, count(au) AS n
+WHERE n > 1
+UNWIND rows AS row
+RETURN accountId + '|' + row.eid + '|' + row.userId + '|' + toString(row.userId IN $LIVE_USER_IDS_CYPHER) AS line
+ORDER BY accountId, line;
+CYPHER
+)"
+
+plan_up="$(cs --format plain <<CYPHER
+MATCH (up:UserProfile)
+WITH up.accountId AS accountId, up
+WITH accountId, collect({eid: elementId(up), userId: coalesce(up.userId, ''), updatedAt: coalesce(up.updatedAt, '')}) AS rows, count(up) AS n
+WHERE n > 1
+UNWIND rows AS row
+RETURN accountId + '|' + row.eid + '|' + row.userId + '|' + toString(row.userId IN $LIVE_USER_IDS_CYPHER) + '|' + row.updatedAt AS line
+ORDER BY accountId, line;
+CYPHER
+)"
+
+admin_lines="$(printf '%s\n' "$plan_admin" | tail -n +2 | sed -e 's/^"//' -e 's/"$//' | grep -v '^$' || true)"
+up_lines="$(printf '%s\n'    "$plan_up"    | tail -n +2 | sed -e 's/^"//' -e 's/"$//' | grep -v '^$' || true)"
+
+count_ghosts() {
+  # ghosts = total_rows - distinct_accountIds (first |-field). 0 on empty.
+  local lines="$1"
+  [ -z "$lines" ] && { echo 0; return; }
+  local total distinct
+  total=$(printf '%s\n' "$lines" | wc -l | awk '{print $1}')
+  distinct=$(printf '%s\n' "$lines" | awk -F'|' '{print $1}' | sort -u | wc -l | awk '{print $1}')
+  echo $((total - distinct))
+}
+admin_pre_ghosts=$(count_ghosts "$admin_lines")
+up_pre_ghosts=$(count_ghosts "$up_lines")
+total_pre_ghosts=$((admin_pre_ghosts + up_pre_ghosts))
+
+if [ "$total_pre_ghosts" -eq 0 ]; then
+  echo "[dedupe-userprofile] nothing-to-dedupe brand=$BRAND" >&2
+  exit 0
+fi
+
+if [ "$DRY_RUN" = "1" ]; then
+  echo "[dedupe-userprofile] DRY-RUN brand=$BRAND admin-ghosts=$admin_pre_ghosts userprofile-ghosts=$up_pre_ghosts (no writes)" >&2
+fi
+
+# Pre-count distinct accountIds with ghosts (across both phases) so the
+# `start` line carries the same total as the success criterion query.
+distinct_admin_accts=$([ -n "$admin_lines" ] && printf '%s\n' "$admin_lines" | awk -F'|' '{print $1}' | sort -u | wc -l | awk '{print $1}' || echo 0)
+distinct_up_accts=$([ -n "$up_lines" ]    && printf '%s\n' "$up_lines"    | awk -F'|' '{print $1}' | sort -u | wc -l | awk '{print $1}' || echo 0)
+distinct_total_accts=$((distinct_admin_accts + distinct_up_accts))
+
+if [ "$DRY_RUN" != "1" ]; then
+  echo "[dedupe-userprofile] start brand=$BRAND accounts-with-ghosts=$distinct_total_accts total-ghosts=$total_pre_ghosts" >&2
+fi
+
+# --- Phase A: AdminUser cleanup -------------------------------------
+admin_accounts_with_ghosts=0
+admin_total_ghosts=0
+
+if [ -n "$admin_lines" ]; then
+  # Group by accountId
+  current_account=""
+  winner_eid=""
+  losers_for_account=()
+
+  process_account() {
+    local acct="$1"
+    [ -z "$acct" ] && return 0
+    if [ -z "$winner_eid" ]; then
+      echo "[dedupe-userprofile] WARN no live AdminUser for account=${acct:0:8} — skipping" >&2
+      return 0
+    fi
+    if [ "${#losers_for_account[@]}" -eq 0 ]; then
+      return 0
+    fi
+    admin_accounts_with_ghosts=$((admin_accounts_with_ghosts + 1))
+    admin_total_ghosts=$((admin_total_ghosts + ${#losers_for_account[@]}))
+
+    # Build Cypher list literal of all loser eids (for the inter-loser skip)
+    local all_losers="["
+    local first=1
+    for e in "${losers_for_account[@]}"; do
+      [ $first -eq 0 ] && all_losers="$all_losers,"
+      all_losers="$all_losers'$e'"
+      first=0
+    done
+    all_losers="$all_losers]"
+
+    echo "[dedupe-userprofile] bucket label=AdminUser account=${acct:0:8} winner=$winner_eid losers=${#losers_for_account[@]}" >&2
+    for loser in "${losers_for_account[@]}"; do
+      dedupe_one "AdminUser" "$loser" "$winner_eid" "$all_losers"
+    done
+  }
+
+  # iterate
+  while IFS='|' read -r acct eid uid is_live; do
+    [ -z "$acct" ] && continue
+    if [ "$acct" != "$current_account" ]; then
+      process_account "$current_account"
+      current_account="$acct"
+      winner_eid=""
+      losers_for_account=()
+    fi
+    if [ "$is_live" = "true" ] && [ -z "$winner_eid" ]; then
+      winner_eid="$eid"
+    else
+      losers_for_account+=("$eid")
+    fi
+  done <<< "$admin_lines"
+  process_account "$current_account"
+fi
+
+# --- Phase B: UserProfile cleanup -----------------------------------
+up_accounts_with_ghosts=0
+up_total_ghosts=0
+
+if [ -n "$up_lines" ]; then
+  current_account=""
+  winner_eid=""
+  winner_updated=""
+  losers_for_account=()
+
+  process_up_account() {
+    local acct="$1"
+    [ -z "$acct" ] && return 0
+    if [ -z "$winner_eid" ]; then
+      echo "[dedupe-userprofile] WARN no live UserProfile for account=${acct:0:8} — skipping" >&2
+      return 0
+    fi
+    if [ "${#losers_for_account[@]}" -eq 0 ]; then
+      return 0
+    fi
+    up_accounts_with_ghosts=$((up_accounts_with_ghosts + 1))
+    up_total_ghosts=$((up_total_ghosts + ${#losers_for_account[@]}))
+
+    local all_losers="["
+    local first=1
+    for e in "${losers_for_account[@]}"; do
+      [ $first -eq 0 ] && all_losers="$all_losers,"
+      all_losers="$all_losers'$e'"
+      first=0
+    done
+    all_losers="$all_losers]"
+
+    echo "[dedupe-userprofile] bucket label=UserProfile account=${acct:0:8} winner=$winner_eid losers=${#losers_for_account[@]}" >&2
+    for loser in "${losers_for_account[@]}"; do
+      dedupe_one "UserProfile" "$loser" "$winner_eid" "$all_losers"
+    done
+  }
+
+  while IFS='|' read -r acct eid uid is_live updated; do
+    [ -z "$acct" ] && continue
+    if [ "$acct" != "$current_account" ]; then
+      process_up_account "$current_account"
+      current_account="$acct"
+      winner_eid=""
+      winner_updated=""
+      losers_for_account=()
+    fi
+    # Winner = first live row with most-recent updatedAt; ties broken by first-seen.
+    if [ "$is_live" = "true" ]; then
+      if [ -z "$winner_eid" ] || [[ "$updated" > "$winner_updated" ]]; then
+        # demote previous winner (if any) to loser
+        if [ -n "$winner_eid" ]; then
+          losers_for_account+=("$winner_eid")
+        fi
+        winner_eid="$eid"
+        winner_updated="$updated"
+      else
+        losers_for_account+=("$eid")
+      fi
+    else
+      losers_for_account+=("$eid")
+    fi
+  done <<< "$up_lines"
+  process_up_account "$current_account"
+fi
+
+# --- Summary --------------------------------------------------------
+END_MS=$(now_ms)
+DURATION_MS=$((END_MS - START_MS))
+
+if [ "$DRY_RUN" = "1" ]; then
+  exit 0
+fi
+
+echo "[dedupe-userprofile] done brand=$BRAND reparented=$REPARENTED_TOTAL deleted=$DELETED_TOTAL duration-ms=$DURATION_MS" >&2

package/payload/platform/scripts/generate-entitlement-fixture.mjs

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+/**
+ * One-shot Rubytech-side entitlement fixture generator.
+ *
+ * RUN BY FOUNDER ONCE; NEVER ON CUSTOMER DEVICES.
+ *
+ * Produces:
+ *   - platform/lib/entitlement/rubytech-pubkey.pem      (vendored, committed)
+ *   - platform/lib/entitlement/PUBKEY-HASH.txt          (sha256 of pubkey, committed)
+ *   - .secrets/rubytech-private-key.pem                  (LOCAL ONLY — never commit)
+ *   - <out-dir>/entitlement.json                         (signed payload fixture)
+ *
+ * Usage:
+ *   node platform/scripts/generate-entitlement-fixture.mjs init
+ *     → generates a fresh keypair + writes the pubkey + hash
+ *
+ *   node platform/scripts/generate-entitlement-fixture.mjs sign \
+ *        --account-id <id> --email <email> --tier <solo|family|pro> \
+ *        --plugins <comma-list> --days <n> --out <path>
+ *     → signs a payload using the existing private key
+ *
+ * The verifier at platform/lib/entitlement/src/index.ts has PUBKEY_SHA256
+ * baked into source. After running `init` the script prints the new hash —
+ * paste it into the verifier and rebuild.
+ *
+ * For Task 832 (Rubytech-side issuance endpoint), this script will be
+ * replaced by a server-side equivalent. Until then, it stands in.
+ */
+
+import {
+  generateKeyPairSync,
+  createPublicKey,
+  createPrivateKey,
+  createHash,
+  sign as cryptoSign,
+} from "node:crypto";
+import { writeFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const PLATFORM_ROOT = resolve(__dirname, "..");
+const REPO_ROOT = resolve(PLATFORM_ROOT, "..");
+const PUBKEY_PATH = resolve(PLATFORM_ROOT, "lib", "entitlement", "rubytech-pubkey.pem");
+const HASH_PATH = resolve(PLATFORM_ROOT, "lib", "entitlement", "PUBKEY-HASH.txt");
+const SECRET_DIR = resolve(REPO_ROOT, ".secrets");
+const PRIVKEY_PATH = resolve(SECRET_DIR, "rubytech-private-key.pem");
+
+function canonicalize(value) {
+  if (value === null) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("non-finite number");
+    if (Object.is(value, -0)) throw new Error("negative zero");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return "[" + value.map(canonicalize).join(",") + "]";
+  if (typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalize(value[k])).join(",") + "}";
+  }
+  throw new Error(`unsupported value type ${typeof value}`);
+}
+
+function init() {
+  if (existsSync(PRIVKEY_PATH)) {
+    console.error(`ABORT: private key already exists at ${PRIVKEY_PATH}.`);
+    console.error("Delete it manually if you really want to regenerate (ALL EXISTING SIGNED PAYLOADS WILL BREAK).");
+    process.exit(1);
+  }
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const pubPem = publicKey.export({ type: "spki", format: "pem" });
+  const privPem = privateKey.export({ type: "pkcs8", format: "pem" });
+
+  if (!existsSync(SECRET_DIR)) mkdirSync(SECRET_DIR, { recursive: true });
+  writeFileSync(PRIVKEY_PATH, privPem, { mode: 0o600 });
+  writeFileSync(PUBKEY_PATH, pubPem, "utf-8");
+
+  const hash = createHash("sha256").update(pubPem).digest("hex");
+  writeFileSync(HASH_PATH, hash + "\n", "utf-8");
+
+  console.log(`Generated keypair.`);
+  console.log(`  Public key  : ${PUBKEY_PATH}`);
+  console.log(`  Hash file   : ${HASH_PATH}  (${hash})`);
+  console.log(`  Private key : ${PRIVKEY_PATH}  (DO NOT COMMIT — verify .gitignore)`);
+  console.log("");
+  console.log(`NEXT: paste the hash into platform/lib/entitlement/src/index.ts:`);
+  console.log(`  export const PUBKEY_SHA256 = "${hash}";`);
+  console.log(`Then run npm --prefix platform run build:lib`);
+}
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    const key = argv[i].replace(/^--/, "");
+    out[key] = argv[i + 1];
+  }
+  return out;
+}
+
+function sign(args) {
+  const required = ["account-id", "email", "tier", "out"];
+  for (const k of required) {
+    if (!args[k]) {
+      console.error(`Missing --${k}`);
+      process.exit(1);
+    }
+  }
+  if (!existsSync(PRIVKEY_PATH)) {
+    console.error(`Private key missing at ${PRIVKEY_PATH}. Run 'init' first.`);
+    process.exit(1);
+  }
+  const days = Number(args.days ?? "365");
+  const plugins = (args.plugins ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  const now = Date.now();
+  const issued = new Date(now).toISOString();
+  const expires = new Date(now + days * 86400 * 1000).toISOString();
+
+  const payload = {
+    accountId: args["account-id"],
+    customerEmail: args.email,
+    tier: args.tier,
+    purchasedPlugins: plugins,
+    issued,
+    expires,
+  };
+  const canonical = canonicalize(payload);
+  const privKey = createPrivateKey(readFileSync(PRIVKEY_PATH, "utf-8"));
+  const sigBuf = cryptoSign(null, Buffer.from(canonical, "utf-8"), privKey);
+  const envelope = { payload, signature: sigBuf.toString("base64") };
+  writeFileSync(args.out, JSON.stringify(envelope, null, 2) + "\n", "utf-8");
+  console.log(`Signed payload written to ${args.out}`);
+  console.log(`  tier=${payload.tier} plugins=${plugins.length} expires=${expires}`);
+}
+
+const cmd = process.argv[2];
+if (cmd === "init") {
+  init();
+} else if (cmd === "sign") {
+  sign(parseArgs(process.argv.slice(3)));
+} else {
+  console.error("Usage:");
+  console.error("  generate-entitlement-fixture.mjs init");
+  console.error("  generate-entitlement-fixture.mjs sign --account-id <id> --email <e> --tier <t> [--plugins a,b] [--days N] --out <path>");
+  process.exit(1);
+}