@tiangong-lca/cli 0.0.33 → 0.1.0

package/dist/src/lib/dataset-maintenance-apply.js

@@ -1,15 +1,21 @@
-import { closeSync, existsSync, fchmodSync, fsyncSync, openSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, fchmodSync, fsyncSync, openSync, readFileSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { writeJsonArtifact } from './artifacts.js';
 import { collectRemoteReferences } from './dataset-remote-verify.js';
 import { CliError } from './errors.js';
 import { withStateFileLock } from './state-lock.js';
 import { buildAliasBatchRequest, buildAliasPlanRequest, loadMaintenanceDesiredPayload, orderedAliasBatches, } from './dataset-maintenance-alias-request.js';
-import { MAINTENANCE_SCAN_TABLES, appendStableJsonLine, isJsonObject, maintenanceRowKey, parseMaintenancePlan, readJsonFile, readJsonLinesIfPresent, sha256Json, snapshotRemoteRow, stableJsonText, writeImmutableJson, } from './dataset-maintenance-contract.js';
+import { MAINTENANCE_SCAN_TABLES, appendStableJsonLine, isJsonObject, maintenanceRowKey, parseMaintenancePlan, readJsonFile, readJsonLinesIfPresent, sha256Json, sha256Text, snapshotRemoteRow, stableJsonText, writeImmutableJson, } from './dataset-maintenance-contract.js';
 import { buildDerivativePlanRequest, derivativePlanAction, parseDerivativeSnapshotResponse, parseDerivativeSubmitResponse, } from './dataset-maintenance-derivatives.js';
 import { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';
 import { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';
-import { applyMaintenanceAliasPlan, applyMaintenanceDerivativeRebuild, deleteMaintenanceRow, fetchMaintenanceAccountRows, fetchMaintenanceDerivativeSnapshot, fetchMaintenanceExactRows, fetchMaintenanceVisibleTableRows, resolveMaintenanceRemoteContext, saveDraftMaintenanceRow, } from './dataset-maintenance-remote.js';
+import { applyMaintenanceDerivativeRebuild, deleteMaintenanceRow, fetchMaintenanceAccountRows, fetchMaintenanceDerivativeSnapshot, fetchMaintenanceExactRows, fetchMaintenanceVisibleTableRows, resolveMaintenanceRemoteContext, saveDraftMaintenanceRow, } from './dataset-maintenance-remote.js';
+// Process payloads can be large enough for the default 1,000-row page to exceed
+// the database statement timeout. Keep the destructive all-visible RLS fence,
+// but bound each SELECT-only page so admission can complete without weakening it.
+const PARALLEL_DELETE_VISIBLE_PROCESS_PAGE_SIZE = 250;
+const GLOBAL_INBOUND_PROOF_MAX_AGE_MS = 30 * 60 * 1_000;
+const SHA256_PATTERN = /^[0-9a-f]{64}$/u;
 const POSITIVE_INTEGER_TEXT = /^[1-9]\d*$/u;
 function clock(options) {
     return (options.now ?? new Date()).toISOString();
@@ -65,6 +71,159 @@ function assertParallelDeletePlan(plan) {
         targets.add(target);
     }
 }
+function parallelDeleteTargetBindingSha256(plan) {
+    return sha256Json(plan.actions.map((action, index) => ({
+        index,
+        ordinal: action.ordinal,
+        action_id: action.action_id,
+        table: action.table,
+        id: action.id,
+        version: action.version,
+        expected_user_id: action.expected_user_id,
+        expected_state_code: action.expected_state_code,
+        before_sha256: action.before?.row_sha256 ?? null,
+    })));
+}
+function invalidGlobalInboundProof(message, details) {
+    throw new CliError(message, {
+        code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_INVALID',
+        exitCode: 1,
+        details,
+    });
+}
+function assertGlobalInboundProofOptionShape(options) {
+    const hasPath = typeof options.proofPath === 'string' && options.proofPath.length > 0;
+    const hasApproval = typeof options.approveProof === 'string' && options.approveProof.length > 0;
+    if (hasPath !== hasApproval) {
+        throw new CliError('--global-inbound-proof and --approve-global-inbound-proof must be provided together.', {
+            code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_OPTIONS_INCOMPLETE',
+            exitCode: 2,
+        });
+    }
+    if ((hasPath || hasApproval) && !options.parallelDeleteMode) {
+        throw new CliError('A global inbound proof is allowed only with --max-parallel flow delete-only execution.', {
+            code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_MODE_INVALID',
+            exitCode: 2,
+        });
+    }
+    if (hasApproval && !SHA256_PATTERN.test(options.approveProof)) {
+        throw new CliError('--approve-global-inbound-proof must be a lowercase SHA-256.', {
+            code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_APPROVAL_INVALID',
+            exitCode: 2,
+        });
+    }
+}
+function validateParallelDeleteGlobalInboundProof(options) {
+    if (!options.proofPath || !options.approveProof)
+        return null;
+    if (!path.isAbsolute(options.proofPath)) {
+        invalidGlobalInboundProof('Global inbound proof path must be absolute.');
+    }
+    let proofText;
+    try {
+        proofText = readFileSync(options.proofPath, 'utf8');
+    }
+    catch (error) {
+        invalidGlobalInboundProof('Global inbound proof file could not be read.', errorMessage(error));
+    }
+    const proofSha256 = sha256Text(proofText);
+    if (proofSha256 !== options.approveProof) {
+        invalidGlobalInboundProof('Global inbound proof file SHA-256 does not match approval.', {
+            expected: options.approveProof,
+            actual: proofSha256,
+        });
+    }
+    let value;
+    try {
+        value = JSON.parse(proofText);
+    }
+    catch (error) {
+        invalidGlobalInboundProof('Global inbound proof is not valid JSON.', errorMessage(error));
+    }
+    if (!isJsonObject(value)) {
+        invalidGlobalInboundProof('Global inbound proof must be a JSON object.');
+    }
+    const expectedBinding = parallelDeleteTargetBindingSha256(options.plan);
+    const capturedAt = typeof value.captured_at_utc === 'string' ? Date.parse(value.captured_at_utc) : NaN;
+    const nowMs = options.now.getTime();
+    const capturedAgeMs = nowMs - capturedAt;
+    const safePositiveInteger = (candidate) => Number.isSafeInteger(candidate) && Number(candidate) > 0;
+    if (value.schema_version !== 'dataset-maintenance-global-inbound-proof.v1' ||
+        value.status !== 'PASS_GLOBAL_ALL_PROCESS_INBOUND_ZERO' ||
+        value.statement_kind !== 'SELECT' ||
+        value.source !== 'supabase_select_only_raw_sql' ||
+        value.process_scope !== 'all_process_rows_without_rls_restriction' ||
+        !Number.isFinite(capturedAt) ||
+        capturedAgeMs < -30_000 ||
+        capturedAgeMs > GLOBAL_INBOUND_PROOF_MAX_AGE_MS ||
+        value.project_ref !== options.context.project_ref ||
+        value.actor_user_id !== options.context.account.user_id ||
+        value.plan_sha256 !== options.plan.plan_sha256 ||
+        value.operation !== 'delete' ||
+        value.target_table !== 'flows' ||
+        value.target_count !== options.plan.actions.length ||
+        value.target_binding_sha256 !== expectedBinding ||
+        !safePositiveInteger(value.global_process_rows) ||
+        !safePositiveInteger(value.global_exchange_rows) ||
+        value.inbound_exchanges !== 0 ||
+        value.old_flow_identities_with_inbound !== 0 ||
+        value.process_identities_with_inbound !== 0 ||
+        value.p0 !== 0 ||
+        value.p1 !== 0 ||
+        !Array.isArray(value.chunks) ||
+        value.chunks.length === 0) {
+        invalidGlobalInboundProof('Global inbound proof metadata or zero-inbound result is invalid.', {
+            expected_project_ref: options.context.project_ref,
+            expected_actor_user_id: options.context.account.user_id,
+            expected_plan_sha256: options.plan.plan_sha256,
+            expected_target_count: options.plan.actions.length,
+            expected_target_binding_sha256: expectedBinding,
+        });
+    }
+    let expectedStart = 0;
+    for (const [index, rawChunk] of value.chunks.entries()) {
+        if (!isJsonObject(rawChunk)) {
+            invalidGlobalInboundProof('Global inbound proof contains a non-object chunk.', { index });
+        }
+        const chunkCapturedAt = typeof rawChunk.captured_at_utc === 'string' ? Date.parse(rawChunk.captured_at_utc) : NaN;
+        const chunkAgeMs = nowMs - chunkCapturedAt;
+        if (rawChunk.index !== index ||
+            rawChunk.start !== expectedStart ||
+            !Number.isSafeInteger(rawChunk.end_exclusive) ||
+            Number(rawChunk.end_exclusive) <= expectedStart ||
+            Number(rawChunk.end_exclusive) > options.plan.actions.length ||
+            rawChunk.target_count !== Number(rawChunk.end_exclusive) - expectedStart ||
+            !Number.isFinite(chunkCapturedAt) ||
+            chunkAgeMs < -30_000 ||
+            chunkAgeMs > GLOBAL_INBOUND_PROOF_MAX_AGE_MS ||
+            rawChunk.inbound_exchanges !== 0 ||
+            rawChunk.old_flow_identities_with_inbound !== 0 ||
+            rawChunk.process_identities_with_inbound !== 0 ||
+            rawChunk.owner_draft_inbound !== 0 ||
+            rawChunk.public_inbound !== 0 ||
+            rawChunk.foreign_private_inbound !== 0 ||
+            rawChunk.other_state_inbound !== 0 ||
+            typeof rawChunk.sql_sha256 !== 'string' ||
+            !SHA256_PATTERN.test(rawChunk.sql_sha256)) {
+            invalidGlobalInboundProof('Global inbound proof contains an invalid or incomplete chunk.', {
+                index,
+                expected_start: expectedStart,
+            });
+        }
+        expectedStart = Number(rawChunk.end_exclusive);
+    }
+    if (expectedStart !== options.plan.actions.length) {
+        invalidGlobalInboundProof('Global inbound proof chunks do not cover every delete target.', {
+            expected_end: options.plan.actions.length,
+            actual_end: expectedStart,
+        });
+    }
+    return {
+        ...value,
+        proof_path: options.proofPath,
+        proof_sha256: proofSha256,
+    };
+}
 function parseParallelDeleteExecutionLog(plan, executionLogPath) {
     const actions = new Map(plan.actions.map((action) => [action.action_id, action]));
     const entries = [];
@@ -881,39 +1040,6 @@ function validateAliasPlanRpcResult(value, plan) {
         raw: value,
     };
 }
-async function executeAliasPlan(options) {
-    const request = buildAliasPlanRequest(options);
-    const remoteResult = await applyMaintenanceAliasPlan({
-        context: options.context,
-        plan: request,
-    });
-    const rpc = validateAliasPlanRpcResult(remoteResult, options.plan);
-    const afterByAction = new Map();
-    for (const action of options.plan.actions) {
-        const exact = await fetchMaintenanceExactRows({
-            context: options.context,
-            table: action.table,
-            id: action.id,
-            version: action.version,
-        });
-        const row = exact.rows.length === 1 ? exact.rows[0] : null;
-        const snapshot = row ? snapshotRemoteRow(row) : null;
-        if (!row ||
-            row.user_id !== action.expected_user_id ||
-            row.state_code !== 0 ||
-            snapshot?.payload_sha256 !== action.desired_payload?.sha256 ||
-            row.model_id !== action.before?.model_id ||
-            row.rule_verification !== action.before?.rule_verification) {
-            throw new CliError(`Alias plan readback failed for action ${action.action_id}.`, {
-                code: 'DATASET_MAINTENANCE_ALIAS_READBACK_FAILED',
-                exitCode: 1,
-            });
-        }
-        afterByAction.set(action.action_id, snapshot.row_sha256);
-    }
-    await assertAliasSupportSnapshots({ plan: options.plan, context: options.context });
-    return { rpc, after_by_action: afterByAction };
-}
 function aliasExchangeProgressKey(value) {
     return `${value.batch_id}\u0000${value.action_id}\u0000${value.exchange_index}\u0000${value.data_set_internal_id}`;
 }
@@ -1619,8 +1745,7 @@ async function executeDerivativeAdmission(options) {
     }), { id: action.id, version: action.version, userId: action.expected_user_id });
     if (preflight.modified_at !== plannedSnapshot.modified_at ||
         preflight.json_sha256 !== plannedSnapshot.json_sha256 ||
-        preflight.json_ordered_sha256 !== plannedSnapshot.json_ordered_sha256 ||
-        preflight.extracted_text_sha256 !== plannedSnapshot.extracted_text_sha256) {
+        preflight.json_ordered_sha256 !== plannedSnapshot.json_ordered_sha256) {
         throw new CliError('Derivative action primary preconditions drifted after planning.', {
             code: 'DATASET_MAINTENANCE_DERIVATIVE_PRIMARY_DRIFT',
             exitCode: 1,
@@ -1689,6 +1814,11 @@ export async function runDatasetMaintenanceApply(options) {
     const plan = parseMaintenancePlan(readJsonFile(planPath, 'Maintenance plan'));
     const parallelDeleteMode = options.maxParallel !== undefined;
     const maxParallel = normalizeMaintenanceMaxParallel(options.maxParallel);
+    assertGlobalInboundProofOptionShape({
+        parallelDeleteMode,
+        proofPath: options.globalInboundProofPath,
+        approveProof: options.approveGlobalInboundProof,
+    });
     if (parallelDeleteMode) {
         assertParallelDeletePlan(plan);
     }
@@ -1742,6 +1872,15 @@ export async function runDatasetMaintenanceApply(options) {
                 exitCode: 2,
             });
         }
+        const globalInboundProof = parallelDeleteMode
+            ? validateParallelDeleteGlobalInboundProof({
+                proofPath: options.globalInboundProofPath,
+                approveProof: options.approveGlobalInboundProof,
+                plan,
+                context,
+                now: options.now ?? new Date(),
+            })
+            : null;
         const derivativeProgress = plan.operation === 'rebuild-derivatives'
             ? parseDerivativeSubmitProgress(plan, progressPath)
             : { entries: [], latest: null };
@@ -1758,8 +1897,12 @@ export async function runDatasetMaintenanceApply(options) {
                 context,
                 userId: plan.account.user_id,
             }),
-            parallelDeleteMode
-                ? fetchMaintenanceVisibleTableRows({ context, table: 'processes' })
+            parallelDeleteMode && !globalInboundProof
+                ? fetchMaintenanceVisibleTableRows({
+                    context,
+                    table: 'processes',
+                    pageSize: PARALLEL_DELETE_VISIBLE_PROCESS_PAGE_SIZE,
+                })
                 : Promise.resolve(null),
         ]);
         assertApplyPreconditions({
@@ -1771,10 +1914,16 @@ export async function runDatasetMaintenanceApply(options) {
             attemptedDeleteActionIds: parallelDeleteExecution.dispatched,
         });
         const inboundBarrierPath = nextParallelDeleteInboundBarrierPath(planDir);
-        const inboundBarrier = parallelDeleteMode && visibleProcesses
-            ? assertNoVisibleProcessInboundReferences({ plan, rows: visibleProcesses.rows })
-            : null;
-        if (inboundBarrier && visibleProcesses) {
+        const inboundBarrier = globalInboundProof
+            ? {
+                process_rows: globalInboundProof.global_process_rows,
+                process_references: globalInboundProof.global_exchange_rows,
+                snapshot_sha256: globalInboundProof.proof_sha256,
+            }
+            : parallelDeleteMode && visibleProcesses
+                ? assertNoVisibleProcessInboundReferences({ plan, rows: visibleProcesses.rows })
+                : null;
+        if (inboundBarrier && (visibleProcesses || globalInboundProof)) {
             writeImmutableJson(inboundBarrierPath, {
                 schema_version: 1,
                 generated_at_utc: clock(options),
@@ -1785,7 +1934,23 @@ export async function runDatasetMaintenanceApply(options) {
                 target_count: plan.actions.length,
                 inbound_reference_count: 0,
                 ...inboundBarrier,
-                completeness: visibleProcesses.completeness,
+                completeness: globalInboundProof
+                    ? {
+                        status: 'complete',
+                        complete: true,
+                        strategy: 'sha256_approved_global_select_only_all_processes',
+                        statement_kind: globalInboundProof.statement_kind,
+                        process_scope: globalInboundProof.process_scope,
+                        proof_path: globalInboundProof.proof_path,
+                        proof_sha256: globalInboundProof.proof_sha256,
+                        captured_at_utc: globalInboundProof.captured_at_utc,
+                        target_binding_sha256: globalInboundProof.target_binding_sha256,
+                        chunk_count: globalInboundProof.chunks.length,
+                        global_process_rows: globalInboundProof.global_process_rows,
+                        global_exchange_rows: globalInboundProof.global_exchange_rows,
+                        inbound_exchanges: globalInboundProof.inbound_exchanges,
+                    }
+                    : visibleProcesses.completeness,
             });
         }
         const approvalPath = path.join(planDir, 'approval-record.json');
@@ -2127,13 +2292,13 @@ export const __testInternals = {
     assertNoVisibleProcessInboundReferences,
     assertApplyPreconditions,
     assertAliasSupportSnapshots,
+    assertGlobalInboundProofOptionShape,
     assertParallelDeletePlan,
     buildAliasBatchRequest,
     buildAliasPlanRequest,
     clock,
     errorMessage,
     executeDerivativeAdmission,
-    executeAliasPlan,
     executeAction,
     executeParallelDeletePlan,
     finalProjectedRows,
@@ -2142,6 +2307,7 @@ export const __testInternals = {
     nextParallelDeleteInboundBarrierPath,
     normalizeMaintenanceMaxParallel,
     parallelDeleteDesiredSha256,
+    parallelDeleteTargetBindingSha256,
     parseDerivativeSubmitProgress,
     validateDerivativeAdmissionAttempt,
     parseAliasBatchProgress,
@@ -2152,5 +2318,6 @@ export const __testInternals = {
     validateAliasRpcResult,
     validateAliasPlanRpcResult,
     validateApprovalRecord,
+    validateParallelDeleteGlobalInboundProof,
 };
 //# sourceMappingURL=dataset-maintenance-apply.js.map