@wairon/cli 5.0.2-dev.15 → 5.0.2-dev.16

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.0.2-dev.15";
+    WAIRON_VERSION = "5.0.2-dev.16";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -8012,11 +8012,15 @@ function projectSubsystemSurface(subsystemId) {
   const interfaces = loadInterfaceSpecs();
   const types = loadTypeSpecs();
   const entries = [];
+  const unprojectable = [];
   for (const pub of target.publicInterfaces ?? []) {
     if (!pub.component) continue;
     const comp = components.find((c) => c.id === pub.component || c.id === `${subsystemId}::${pub.component}`);
     if (!comp) continue;
-    if (comp.componentType !== "Portal") continue;
+    if (!CROSS_BOUNDARY_TARGETS.has(comp.componentType)) {
+      unprojectable.push({ component: pub.component, componentType: comp.componentType });
+      continue;
+    }
     const compInterfaces = interfaces.filter((i) => i.component === comp.id && (!pub.interface || i.id === pub.interface || i.id === `${subsystemId}::${pub.interface}`));
     const methods = compInterfaces.flatMap((i) => i.methods);
     entries.push({
@@ -8030,13 +8034,18 @@ function projectSubsystemSurface(subsystemId) {
       component: localName(comp.id),
       methods,
       ...comp.dispatch && comp.dispatch.length ? { dispatch: comp.dispatch } : {},
-      // Project the backing Portal's auth + basePath so the codec can emit
+      // Project the backing component's auth + basePath so the codec can emit
       // OpenAPI security + per-portal servers self-contained from the snapshot.
       ...comp.auth && comp.auth.scheme !== "none" ? { auth: comp.auth } : {},
       ...comp.basePath ? { basePath: comp.basePath } : {},
       details: pub.details ?? ""
     });
   }
+  for (const skipped of unprojectable) {
+    console.error(
+      `[surfaces] skipped "${subsystemId}::${skipped.component}": a published ${skipped.componentType} can never serve a cross-boundary caller, so it stays out of every chained child's sibling surface \u2014 publish this surface through a Portal, a Gateway, or an Observer (for events).`
+    );
+  }
   return SurfaceSnapshotSchema.parse({
     projectName: `${system.name}::${subsystemId}`,
     origin: "generated",
@@ -8215,7 +8224,7 @@ function checkChildSurfaceFreshness(rootDir = getProjectRoot()) {
   }
   return issues;
 }
-var fs9, path10, SURFACES_DIRNAME;
+var fs9, path10, SURFACES_DIRNAME, CROSS_BOUNDARY_TARGETS;
 var init_surfaces = __esm({
   "src/core/surfaces.ts"() {
     "use strict";
@@ -8230,6 +8239,7 @@ var init_surfaces = __esm({
     init_type_analysis();
     init_openapi();
     SURFACES_DIRNAME = "surfaces";
+    CROSS_BOUNDARY_TARGETS = /* @__PURE__ */ new Set(["Portal", "Gateway", "Observer"]);
   }
 });
 
@@ -27490,9 +27500,14 @@ function lockProject(cfg, credential, project2) {
   }
   return executeApprovedLock(cfg, project2);
 }
-function executeApprovedLock(cfg, projectId) {
+function boundLifecycleRoot(cfg, projectId, subproject) {
   const root = existingProjectRoot(cfg.dataDir, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
+  if (!subproject) return root;
+  return resolveSubprojectMounts(projectId, root, subproject.split(SUBPROJECT_SEPARATOR));
+}
+function executeApprovedLock(cfg, projectId, subproject) {
+  const root = boundLifecycleRoot(cfg, projectId, subproject);
   return runWithProjectRoot(root, () => {
     hostGit.sync();
     const result = validateProjectAsComplete();
@@ -27664,9 +27679,8 @@ function promoteProject(cfg, credential, project2) {
   }
   return executeApprovedPromote(cfg, project2);
 }
-function executeApprovedPromote(cfg, projectId) {
-  const root = existingProjectRoot(cfg.dataDir, projectId);
-  if (!root) throw new Error(`Unknown project "${projectId}".`);
+function executeApprovedPromote(cfg, projectId, subproject) {
+  const root = boundLifecycleRoot(cfg, projectId, subproject);
   return runWithProjectRoot(root, () => {
     const lock = hostCore.readLockRecord();
     if (!lock) {
@@ -31551,38 +31565,58 @@ function initializeProject(cfg, credential, request) {
     }
   }
 }
-function lockProject2(cfg, credential, projectId) {
+function lockProject2(cfg, credential, projectId, subproject) {
   return lifecycleAction(cfg, credential, projectId, {
     action: "project:lock",
     verb: "Lock",
     noun: "lock",
+    subproject,
     execute: () => {
-      const lock = executeApprovedLock(cfg, projectId);
+      const lock = executeApprovedLock(cfg, projectId, subproject);
       return {
         status: "completed",
         action: "project:lock",
-        summary: `Locked project "${projectId}" (status: ${lock.status}).`,
+        summary: `Locked project "${projectId}"${subprojectSuffix(subproject)} (status: ${lock.status}).`,
         lock
       };
     }
   });
 }
-function promoteProject2(cfg, credential, projectId) {
+function promoteProject2(cfg, credential, projectId, subproject) {
   return lifecycleAction(cfg, credential, projectId, {
     action: "project:promote",
     verb: "Promote",
     noun: "promotion",
+    subproject,
     execute: () => {
-      const promo = executeApprovedPromote(cfg, projectId);
+      const promo = executeApprovedPromote(cfg, projectId, subproject);
       return {
         status: "completed",
         action: "project:promote",
-        summary: `Promotion of project "${projectId}": ${promo.status} \u2014 ${promo.message}`,
+        summary: `Promotion of project "${projectId}"${subprojectSuffix(subproject)}: ${promo.status} \u2014 ${promo.message}`,
         promote: promo
       };
     }
   });
 }
+function subprojectSuffix(subproject) {
+  return subproject ? ` subproject "${subproject}"` : "";
+}
+var SUBPROJECT_SCOPE_PAYLOAD = "SubprojectScope";
+function subprojectScopePayload(subproject) {
+  if (!subproject) return {};
+  return { payloadType: SUBPROJECT_SCOPE_PAYLOAD, payload: JSON.stringify({ subproject }) };
+}
+function readSubprojectScope(req) {
+  if (req.payloadType !== SUBPROJECT_SCOPE_PAYLOAD || !req.payload) return void 0;
+  const parsed = JSON.parse(req.payload);
+  if (typeof parsed.subproject !== "string" || !parsed.subproject) {
+    throw new Error(
+      `Approved ${req.kind} request "${req.id}" carries a ${SUBPROJECT_SCOPE_PAYLOAD} payload with no usable subproject qualifier \u2014 refusing to execute, because falling back to the whole project would widen the scope the requester was confined to.`
+    );
+  }
+  return parsed.subproject;
+}
 function lifecycleAction(cfg, credential, projectId, opts) {
   const principal = requirePrincipal7(cfg, credential);
   const effective = authorize(cfg.dataDir, principal, PROJECT_WRITE_CAPABILITY4, "project", projectId);
@@ -31608,8 +31642,9 @@ function lifecycleAction(cfg, credential, projectId, opts) {
       const pending = buildPendingRequest(
         principal,
         opts.action,
-        `${opts.verb} project ${projectId}`,
-        projectId
+        `${opts.verb} project ${projectId}${subprojectSuffix(opts.subproject)}`,
+        projectId,
+        subprojectScopePayload(opts.subproject)
       );
       return createPendingOutcome(cfg, principal, pending, opts.action);
     }
@@ -31683,12 +31718,14 @@ function executeApproved(cfg, req) {
       return `Initialized project "${rec.id}" under the active pack policy.`;
     }
     case "project:lock": {
-      const lock = executeApprovedLock(cfg, req.projectId ?? "");
-      return `Locked project "${req.projectId}" (status: ${lock.status}).`;
+      const scope = readSubprojectScope(req);
+      const lock = executeApprovedLock(cfg, req.projectId ?? "", scope);
+      return `Locked project "${req.projectId}"${subprojectSuffix(scope)} (status: ${lock.status}).`;
     }
     case "project:promote": {
-      const promo = executeApprovedPromote(cfg, req.projectId ?? "");
-      return `Promotion of project "${req.projectId}": ${promo.status} \u2014 ${promo.message}`;
+      const scope = readSubprojectScope(req);
+      const promo = executeApprovedPromote(cfg, req.projectId ?? "", scope);
+      return `Promotion of project "${req.projectId}"${subprojectSuffix(scope)}: ${promo.status} \u2014 ${promo.message}`;
     }
     default:
       throw new Error(`Unsupported approval kind "${req.kind}".`);
@@ -36421,6 +36458,12 @@ var PROJECT_OPS_TOOLS = /* @__PURE__ */ new Set([
   "sdd_host_produce",
   "sdd_host_commit_project"
 ]);
+var PROJECT_RECORD_TOOLS = /* @__PURE__ */ new Set([
+  "sdd_host_initialize_project",
+  "sdd_host_get_approval_status",
+  "sdd_host_await_approval",
+  ...PROJECT_OPS_TOOLS
+]);
 function jsonRpcRequests(body) {
   const arr = Array.isArray(body) ? body : [body];
   return arr.filter((m) => !!m && typeof m === "object" && "method" in m);
@@ -36486,7 +36529,27 @@ function dataPlanePermissionError(cfg, principal, projectId, body) {
     }
   };
 }
-async function dispatchProjectLifecycleTool(cfg, credential, projectId, body) {
+function subprojectConfinementError(projectId, subproject, body) {
+  if (!subproject) return void 0;
+  const msg = jsonRpcRequest(body);
+  if (!msg || msg.method !== "tools/call") return void 0;
+  const name = msg.params?.name;
+  if (typeof name !== "string" || !PROJECT_RECORD_TOOLS.has(name)) return void 0;
+  return {
+    jsonrpc: "2.0",
+    id: msg.id ?? null,
+    result: {
+      content: [
+        {
+          type: "text",
+          text: `Refused \u2014 ${name} acts on the whole project "${projectId}", but this credential is bound to subproject "${projectId}${SUBPROJECT_SEPARATOR}${subproject}". An unqualified credential for "${projectId}" is required to call ${name}.`
+        }
+      ],
+      isError: true
+    }
+  };
+}
+async function dispatchProjectLifecycleTool(cfg, credential, projectId, body, subproject) {
   const msg = jsonRpcRequest(body);
   if (!msg || msg.method !== "tools/call") return void 0;
   const name = msg.params?.name;
@@ -36503,10 +36566,10 @@ async function dispatchProjectLifecycleTool(cfg, credential, projectId, body) {
         value = initializeProject(cfg, credential, args);
         break;
       case "sdd_host_lock_project":
-        value = lockProject2(cfg, credential, projectId);
+        value = lockProject2(cfg, credential, projectId, subproject);
         break;
       case "sdd_host_promote_project":
-        value = promoteProject2(cfg, credential, projectId);
+        value = promoteProject2(cfg, credential, projectId, subproject);
         break;
       case "sdd_host_await_approval":
         value = await awaitApproval(
@@ -36613,7 +36676,13 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
   await runWithProjectRoot(binding.rootPath, async () => {
     const projectId = binding.projectId;
     const subproject = binding.subproject;
-    const dispatchedResponse = await dispatchProjectLifecycleTool(cfg, cred, projectId, body);
+    const confinementError = subprojectConfinementError(projectId, subproject, body);
+    if (confinementError !== void 0) {
+      sendJson(res, 200, confinementError);
+      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(confinementError), subproject);
+      return;
+    }
+    const dispatchedResponse = await dispatchProjectLifecycleTool(cfg, cred, projectId, body, subproject);
     if (dispatchedResponse !== void 0) {
       sendJson(res, 200, dispatchedResponse);
       auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(dispatchedResponse), subproject);