@saasontools/strauss-kb 0.1.20 → 0.1.21

package/README.md

@@ -222,11 +222,12 @@ end of it. Six optional fields extend it:
 them; `repo` and `ref` are **author-owned identity** and a resolution pass
 never writes them.
 
-`anchor-resolve <concept-id>` (`kb_anchor_resolve`) is `verify`'s mechanical
-counterpart: it checks the anchored code against the working tree
-(`--repo-root` when the base is not inside it). Per anchor:
+`anchor-resolve <concept-id>` (`kb_anchor_resolve`) checks the anchored code
+against the working tree (`--repo-root` when the base is not inside it) and
+never writes `verified[]`; `--check` writes nothing at all. Per anchor:
 
-- **stamped** — no hash yet; hash, line count, and timestamp are written.
+- **stamped** — no hash yet; hash, line count, and timestamp are written
+  (`unstamped` under `--check`, which writes none).
 - **match** — unchanged; nothing written. `--restamp` re-dates on purpose.
 - **drifted** — hash changed. Baseline kept unless `--rebaseline`.
 - **unresolved** — not comparable, with a reason. A finding, not an error.
@@ -245,9 +246,6 @@ and again on the real path after symlinks.
 Exit code is non-zero on **drifted**, or on **unresolved** for an anchor that
 carries a hash; unstamped anchors and unreachable remotes never fail.
 
-A fully clean run — every anchor checked and `match`, none stamped this run —
-appends a `verified[]` event.
-
 Symbols resolve tree-sitter first — the 20 language packs that have both a
 grammar and a definitions query, pinned together by `pnpm grammars pin` from
 `grammars/packs.json` and proved at pin time — then the regex heuristic for

package/dist/{chunk-XDH6J6CH.js → chunk-VXWN62HT.js}

@@ -4,7 +4,7 @@ import {
   KB_DIR,
   KbStore,
   VERSION
-} from "./chunk-QQLPJO4R.js";
+} from "./chunk-XBZ7G5R5.js";
 
 // src/cli.ts
 import { join } from "path";
@@ -121,4 +121,4 @@ function usage() {
 export {
   runKbCli
 };
-//# sourceMappingURL=chunk-XDH6J6CH.js.map
+//# sourceMappingURL=chunk-VXWN62HT.js.map

package/dist/{chunk-EXZQZJU2.js → chunk-WVJULVGY.js}

@@ -2,7 +2,7 @@ import {
   KB_COMMANDS,
   KbStore,
   VERSION
-} from "./chunk-QQLPJO4R.js";
+} from "./chunk-XBZ7G5R5.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -46,4 +46,4 @@ export {
   createKbMcpServer,
   runKbMcpServer
 };
-//# sourceMappingURL=chunk-EXZQZJU2.js.map
+//# sourceMappingURL=chunk-WVJULVGY.js.map

package/dist/{chunk-QQLPJO4R.js → chunk-XBZ7G5R5.js}

@@ -2235,6 +2235,8 @@ var Fault = /* @__PURE__ */ ((Fault2) => {
 var ErrorTypes = /* @__PURE__ */ ((ErrorTypes2) => {
   ErrorTypes2["KbRecordAlreadyExists"] = "KbRecordAlreadyExists";
   ErrorTypes2["KbClassifyInput"] = "KbClassifyInput";
+  ErrorTypes2["KbFlagConflict"] = "KbFlagConflict";
+  ErrorTypes2["KbInvalidActor"] = "KbInvalidActor";
   ErrorTypes2["KbInvalidConceptId"] = "KbInvalidConceptId";
   ErrorTypes2["KbMatchInput"] = "KbMatchInput";
   ErrorTypes2["KbMissingFlagValue"] = "KbMissingFlagValue";
@@ -2335,6 +2337,38 @@ var KbSelfVerificationError = class extends BaseError {
   actor;
   generatedBy;
 };
+var KbInvalidActorError = class extends BaseError {
+  constructor(actor, reason) {
+    super({
+      message: `kb: actor ${JSON.stringify(actor)} ${reason} \u2014 set STRAUSS_KB_ACTOR, e.g. human:alice or agent:reviewer`,
+      errorType: "KbInvalidActor" /* KbInvalidActor */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { actor, reason, action: "refused" }
+    });
+    this.actor = actor;
+    this.reason = reason;
+  }
+  actor;
+  reason;
+};
+var KbFlagConflictError = class extends BaseError {
+  constructor(flags) {
+    super({
+      message: `kb: ${flags.join(" and ")} cannot be combined`,
+      errorType: "KbFlagConflict" /* KbFlagConflict */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { flags }
+    });
+    this.flags = flags;
+  }
+  flags;
+};
 var KbPackBudgetExceededError = class extends BaseError {
   constructor(recordCount, approxTokens2, budgetTokens, excluded) {
     super({
@@ -4978,19 +5012,11 @@ function byGeneratedAt(left, right) {
 
 // src/commands/anchor-resolve.ts
 import { z as z10 } from "zod";
-function resolverSummary(results) {
-  const names = [
-    ...new Set(
-      results.flatMap((entry) => entry.resolver ? [entry.resolver] : [])
-    )
-  ].sort();
-  return names.length ? `${names.join(" + ")} resolver` : "whole-file";
-}
 var anchorResolveCommand = define({
   name: "anchor-resolve",
   tool: "kb_anchor_resolve",
-  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp]",
-  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was. Exits non-zero on drift.",
+  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp] [--check]",
+  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. Never writes verified[]; a judgment is kb_verify. Exits non-zero on drift.",
   input: z10.object({
     bundlePath,
     conceptId,
@@ -5003,6 +5029,9 @@ var anchorResolveCommand = define({
     ),
     restamp: z10.boolean().optional().describe(
       "Refresh `resolved_at` on anchors that already match. Off by default, so a green run writes nothing."
+    ),
+    check: z10.boolean().optional().describe(
+      "Resolve and report only: no hash, no `resolved_at`, no log entry."
     )
   }),
   fromArgv: (argv, path) => ({
@@ -5011,9 +5040,24 @@ var anchorResolveCommand = define({
     repoRoot: argvFlag(argv, "--repo-root"),
     offline: argv.includes("--offline"),
     rebaseline: argv.includes("--rebaseline"),
-    restamp: argv.includes("--restamp")
+    restamp: argv.includes("--restamp"),
+    check: argv.includes("--check")
   }),
-  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, offline, rebaseline, restamp }) => {
+  run: async ({ store, actor, now }, {
+    bundlePath: path,
+    conceptId: id,
+    repoRoot,
+    offline,
+    rebaseline,
+    restamp,
+    check
+  }) => {
+    if (check && (rebaseline || restamp)) {
+      throw new KbFlagConflictError([
+        "check",
+        rebaseline ? "rebaseline" : "restamp"
+      ]);
+    }
     const root = repoRoot ?? process.cwd();
     const record = await store.read(path, id);
     if (!record) throw new KbRecordNotFoundError(id);
@@ -5022,7 +5066,6 @@ var anchorResolveCommand = define({
       return {
         conceptId: id,
         results: [],
-        verified: false,
         note: "record has no anchors"
       };
     }
@@ -5080,7 +5123,7 @@ var anchorResolveCommand = define({
       if (!anchor.hash) {
         results.push({
           ...base2,
-          state: "stamped",
+          state: check ? "unstamped" : "stamped",
           currentHash: stampedHash,
           hashKind: stampedKind,
           ...producedBy ? { resolver: producedBy } : {}
@@ -5132,7 +5175,7 @@ var anchorResolveCommand = define({
       if (refresh) dirty = true;
     }
     let frozen = false;
-    if (dirty) {
+    if (dirty && !check) {
       try {
         await assertBaseNotFrozen(process.cwd(), path);
       } catch (error) {
@@ -5147,42 +5190,11 @@ var anchorResolveCommand = define({
     const unreachable = results.filter(
       (entry) => isUncheckedReason(entry.reason)
     ).length;
-    const checked = results.length - unreachable;
     const matches3 = results.filter((entry) => entry.state === "match").length;
-    const note = `${matches3}/${checked} anchors match${unreachable ? `, ${unreachable} unreachable` : ""}`;
-    const clean = checked > 0 && matches3 === checked && unreachable === 0;
-    if (clean) {
-      try {
-        await store.verify(
-          path,
-          id,
-          `anchor-resolve: ${note} (${resolverSummary(results)})`,
-          actor,
-          now()
-        );
-      } catch (error) {
-        if (!(error instanceof KbSelfVerificationError)) throw error;
-        return {
-          conceptId: id,
-          results,
-          verified: false,
-          verifyRefused: "self-verification",
-          ...frozenNote,
-          ...hintNote
-        };
-      }
-      return {
-        conceptId: id,
-        results,
-        verified: true,
-        ...frozenNote,
-        ...hintNote
-      };
-    }
+    const note = `${matches3}/${results.length - unreachable} anchors match, ${unreachable} unreachable`;
     return {
       conceptId: id,
       results,
-      verified: false,
       ...unreachable ? { note } : {},
       ...frozenNote,
       ...hintNote
@@ -7581,6 +7593,7 @@ var KbStore = class {
    * its contents.
    */
   async write(bundlePath2, input, actor = "unknown") {
+    assertActor(actor);
     if (!KB_SLUG_PATTERN.test(input.slug)) {
       throw new KbInvalidConceptIdError("slug must be kebab-case", {
         slug: input.slug
@@ -7682,6 +7695,7 @@ var KbStore = class {
    * timeouts.
    */
   async setStatus(bundlePath2, conceptId2, status, actor = "unknown") {
+    assertActor(actor);
     return this.mutate(
       bundlePath2,
       conceptId2,
@@ -7700,6 +7714,7 @@ var KbStore = class {
    * the frontmatter must not be published back out under an actor stamp.
    */
   async updateAnchors(bundlePath2, conceptId2, anchors, actor = "unknown") {
+    assertActor(actor);
     const checked = anchors.map((anchor) => kbAnchorWriteSchema.parse(anchor));
     return this.mutate(
       bundlePath2,
@@ -7720,6 +7735,7 @@ var KbStore = class {
    * logs what it publishes.
    */
   async verify(bundlePath2, conceptId2, note, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    assertActor(actor, { named: true });
     const event = kbVerifiedEventSchema.parse({ by: actor, at: at2, note });
     const existing = await this.read(bundlePath2, conceptId2);
     if (!existing) throw new KbRecordNotFoundError(conceptId2);
@@ -7750,6 +7766,7 @@ var KbStore = class {
    * in normal use, and validation drops to catching hand-edits.
    */
   async supersede(bundlePath2, conceptId2, replacementId, actor = "unknown") {
+    assertActor(actor);
     const replacement = await this.read(bundlePath2, replacementId);
     if (!replacement) throw new KbRecordNotFoundError(replacementId);
     const superseded = await this.markSuperseded(
@@ -7773,6 +7790,7 @@ var KbStore = class {
   }
   /** Resolves an open question, stamping who answered and when. */
   async answer(bundlePath2, conceptId2, answer, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    assertActor(actor);
     return this.mutate(
       bundlePath2,
       conceptId2,
@@ -7799,6 +7817,7 @@ ${answer}
    * terminal status since the caller listed it is reported, not removed.
    */
   async deleteRecord(bundlePath2, conceptId2, expected, actor = "unknown") {
+    assertActor(actor);
     const target = this.recordPath(bundlePath2, conceptId2);
     const witness = await this.read(bundlePath2, conceptId2);
     if (!witness) throw new KbRecordNotFoundError(conceptId2);
@@ -8102,6 +8121,7 @@ ${answer}
    * base too, where nothing was written.
    */
   async note(bundlePath2, entry) {
+    assertActor(entry.by);
     await this.record(this.root(bundlePath2), entry);
   }
   /**
@@ -8359,6 +8379,15 @@ function normalizeActor(id) {
   if (colon === -1) return id.toLowerCase();
   return id.slice(0, colon + 1).toLowerCase() + id.slice(colon + 1);
 }
+var KB_ACTOR_PATTERN = /^[A-Za-z][\w-]*(?::[\p{L}\p{M}\p{N}_.@+/-]+)?$/u;
+function assertActor(actor, { named = false } = {}) {
+  if (!KB_ACTOR_PATTERN.test(actor)) {
+    throw new KbInvalidActorError(actor, "is not kind or kind:name");
+  }
+  if (named && normalizeActor(actor) === "unknown") {
+    throw new KbInvalidActorError(actor, "cannot verify: name who checked");
+  }
+}
 
 // src/pack.ts
 var DEFAULT_PACK_HOPS = 2;
@@ -8445,7 +8474,7 @@ function typeRank(record) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.20" : "0.0.0-dev";
+var VERSION = true ? "0.1.21" : "0.0.0-dev";
 
 export {
   kbSourceSchema,
@@ -8593,4 +8622,4 @@ export {
   KbStore,
   VERSION
 };
-//# sourceMappingURL=chunk-QQLPJO4R.js.map
+//# sourceMappingURL=chunk-XBZ7G5R5.js.map