@saasontools/strauss-kb 0.1.20 → 0.1.21

package/dist/cli-main.cjs

@@ -2348,6 +2348,38 @@ var KbSelfVerificationError = class extends BaseError {
   actor;
   generatedBy;
 };
+var KbInvalidActorError = class extends BaseError {
+  constructor(actor, reason) {
+    super({
+      message: `kb: actor ${JSON.stringify(actor)} ${reason} \u2014 set STRAUSS_KB_ACTOR, e.g. human:alice or agent:reviewer`,
+      errorType: "KbInvalidActor" /* KbInvalidActor */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { actor, reason, action: "refused" }
+    });
+    this.actor = actor;
+    this.reason = reason;
+  }
+  actor;
+  reason;
+};
+var KbFlagConflictError = class extends BaseError {
+  constructor(flags) {
+    super({
+      message: `kb: ${flags.join(" and ")} cannot be combined`,
+      errorType: "KbFlagConflict" /* KbFlagConflict */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { flags }
+    });
+    this.flags = flags;
+  }
+  flags;
+};
 var KbPackBudgetExceededError = class extends BaseError {
   constructor(recordCount, approxTokens2, budgetTokens, excluded) {
     super({
@@ -2891,19 +2923,11 @@ function argvPositional(argv, ...names) {
 }
 
 // src/commands/anchor-resolve.ts
-function resolverSummary(results) {
-  const names = [
-    ...new Set(
-      results.flatMap((entry) => entry.resolver ? [entry.resolver] : [])
-    )
-  ].sort();
-  return names.length ? `${names.join(" + ")} resolver` : "whole-file";
-}
 var anchorResolveCommand = define({
   name: "anchor-resolve",
   tool: "kb_anchor_resolve",
-  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp]",
-  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was. Exits non-zero on drift.",
+  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp] [--check]",
+  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. Never writes verified[]; a judgment is kb_verify. Exits non-zero on drift.",
   input: import_zod7.z.object({
     bundlePath,
     conceptId,
@@ -2916,6 +2940,9 @@ var anchorResolveCommand = define({
     ),
     restamp: import_zod7.z.boolean().optional().describe(
       "Refresh `resolved_at` on anchors that already match. Off by default, so a green run writes nothing."
+    ),
+    check: import_zod7.z.boolean().optional().describe(
+      "Resolve and report only: no hash, no `resolved_at`, no log entry."
     )
   }),
   fromArgv: (argv, path) => ({
@@ -2924,9 +2951,24 @@ var anchorResolveCommand = define({
     repoRoot: argvFlag(argv, "--repo-root"),
     offline: argv.includes("--offline"),
     rebaseline: argv.includes("--rebaseline"),
-    restamp: argv.includes("--restamp")
+    restamp: argv.includes("--restamp"),
+    check: argv.includes("--check")
   }),
-  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, offline, rebaseline, restamp }) => {
+  run: async ({ store, actor, now }, {
+    bundlePath: path,
+    conceptId: id,
+    repoRoot,
+    offline,
+    rebaseline,
+    restamp,
+    check
+  }) => {
+    if (check && (rebaseline || restamp)) {
+      throw new KbFlagConflictError([
+        "check",
+        rebaseline ? "rebaseline" : "restamp"
+      ]);
+    }
     const root = repoRoot ?? process.cwd();
     const record = await store.read(path, id);
     if (!record) throw new KbRecordNotFoundError(id);
@@ -2935,7 +2977,6 @@ var anchorResolveCommand = define({
       return {
         conceptId: id,
         results: [],
-        verified: false,
         note: "record has no anchors"
       };
     }
@@ -2993,7 +3034,7 @@ var anchorResolveCommand = define({
       if (!anchor.hash) {
         results.push({
           ...base2,
-          state: "stamped",
+          state: check ? "unstamped" : "stamped",
           currentHash: stampedHash,
           hashKind: stampedKind,
           ...producedBy ? { resolver: producedBy } : {}
@@ -3045,7 +3086,7 @@ var anchorResolveCommand = define({
       if (refresh) dirty = true;
     }
     let frozen = false;
-    if (dirty) {
+    if (dirty && !check) {
       try {
         await assertBaseNotFrozen(process.cwd(), path);
       } catch (error) {
@@ -3060,42 +3101,11 @@ var anchorResolveCommand = define({
     const unreachable = results.filter(
       (entry) => isUncheckedReason(entry.reason)
     ).length;
-    const checked = results.length - unreachable;
     const matches3 = results.filter((entry) => entry.state === "match").length;
-    const note = `${matches3}/${checked} anchors match${unreachable ? `, ${unreachable} unreachable` : ""}`;
-    const clean = checked > 0 && matches3 === checked && unreachable === 0;
-    if (clean) {
-      try {
-        await store.verify(
-          path,
-          id,
-          `anchor-resolve: ${note} (${resolverSummary(results)})`,
-          actor,
-          now()
-        );
-      } catch (error) {
-        if (!(error instanceof KbSelfVerificationError)) throw error;
-        return {
-          conceptId: id,
-          results,
-          verified: false,
-          verifyRefused: "self-verification",
-          ...frozenNote,
-          ...hintNote
-        };
-      }
-      return {
-        conceptId: id,
-        results,
-        verified: true,
-        ...frozenNote,
-        ...hintNote
-      };
-    }
+    const note = `${matches3}/${results.length - unreachable} anchors match, ${unreachable} unreachable`;
     return {
       conceptId: id,
       results,
-      verified: false,
       ...unreachable ? { note } : {},
       ...frozenNote,
       ...hintNote
@@ -7652,6 +7662,7 @@ var KbStore = class {
    * its contents.
    */
   async write(bundlePath2, input, actor = "unknown") {
+    assertActor(actor);
     if (!KB_SLUG_PATTERN.test(input.slug)) {
       throw new KbInvalidConceptIdError("slug must be kebab-case", {
         slug: input.slug
@@ -7753,6 +7764,7 @@ var KbStore = class {
    * timeouts.
    */
   async setStatus(bundlePath2, conceptId2, status, actor = "unknown") {
+    assertActor(actor);
     return this.mutate(
       bundlePath2,
       conceptId2,
@@ -7771,6 +7783,7 @@ var KbStore = class {
    * the frontmatter must not be published back out under an actor stamp.
    */
   async updateAnchors(bundlePath2, conceptId2, anchors, actor = "unknown") {
+    assertActor(actor);
     const checked = anchors.map((anchor) => kbAnchorWriteSchema.parse(anchor));
     return this.mutate(
       bundlePath2,
@@ -7791,6 +7804,7 @@ var KbStore = class {
    * logs what it publishes.
    */
   async verify(bundlePath2, conceptId2, note, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    assertActor(actor, { named: true });
     const event = kbVerifiedEventSchema.parse({ by: actor, at: at2, note });
     const existing = await this.read(bundlePath2, conceptId2);
     if (!existing) throw new KbRecordNotFoundError(conceptId2);
@@ -7821,6 +7835,7 @@ var KbStore = class {
    * in normal use, and validation drops to catching hand-edits.
    */
   async supersede(bundlePath2, conceptId2, replacementId, actor = "unknown") {
+    assertActor(actor);
     const replacement = await this.read(bundlePath2, replacementId);
     if (!replacement) throw new KbRecordNotFoundError(replacementId);
     const superseded = await this.markSuperseded(
@@ -7844,6 +7859,7 @@ var KbStore = class {
   }
   /** Resolves an open question, stamping who answered and when. */
   async answer(bundlePath2, conceptId2, answer, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    assertActor(actor);
     return this.mutate(
       bundlePath2,
       conceptId2,
@@ -7870,6 +7886,7 @@ ${answer}
    * terminal status since the caller listed it is reported, not removed.
    */
   async deleteRecord(bundlePath2, conceptId2, expected, actor = "unknown") {
+    assertActor(actor);
     const target = this.recordPath(bundlePath2, conceptId2);
     const witness = await this.read(bundlePath2, conceptId2);
     if (!witness) throw new KbRecordNotFoundError(conceptId2);
@@ -8173,6 +8190,7 @@ ${answer}
    * base too, where nothing was written.
    */
   async note(bundlePath2, entry) {
+    assertActor(entry.by);
     await this.record(this.root(bundlePath2), entry);
   }
   /**
@@ -8430,9 +8448,18 @@ function normalizeActor(id) {
   if (colon === -1) return id.toLowerCase();
   return id.slice(0, colon + 1).toLowerCase() + id.slice(colon + 1);
 }
+var KB_ACTOR_PATTERN = /^[A-Za-z][\w-]*(?::[\p{L}\p{M}\p{N}_.@+/-]+)?$/u;
+function assertActor(actor, { named = false } = {}) {
+  if (!KB_ACTOR_PATTERN.test(actor)) {
+    throw new KbInvalidActorError(actor, "is not kind or kind:name");
+  }
+  if (named && normalizeActor(actor) === "unknown") {
+    throw new KbInvalidActorError(actor, "cannot verify: name who checked");
+  }
+}
 
 // src/version.ts
-var VERSION = true ? "0.1.20" : "0.0.0-dev";
+var VERSION = true ? "0.1.21" : "0.0.0-dev";
 
 // src/cli.ts
 async function runKbCli(argv) {