draftgo-cli 4.0.24 → 4.0.26

package/src/commands/grant.js

@@ -1,29 +0,0 @@
-'use strict';
-
-const log = require('../logger');
-const { callOperation } = require('./api');
-
-const OPERATIONS = Object.freeze({
-  list: 'listAccessGrants',
-  create: 'createAccessGrant',
-  get: 'getAccessGrant',
-  revoke: 'revokeAccessGrant',
-});
-
-function operationKey(value) {
-  const action = String(value || 'list').trim().toLowerCase();
-  return OPERATIONS[action] ? action : '';
-}
-
-async function grantCommand(projectDir, positional, flags = {}) {
-  const action = operationKey(positional[0]);
-  if (!action) {
-    log.err('Usage: draftgo grant list|create|get|revoke [--input <json-file>]');
-    return 1;
-  }
-  return callOperation(projectDir, OPERATIONS[action], flags);
-}
-
-module.exports = grantCommand;
-module.exports.OPERATIONS = OPERATIONS;
-module.exports.operationKey = operationKey;

package/src/commands/space.js

@@ -1,41 +0,0 @@
-'use strict';
-
-const log = require('../logger');
-const { callOperation } = require('./api');
-
-const OPERATIONS = Object.freeze({
-  list: 'listSpaces',
-  create: 'createSpace',
-  get: 'getSpace',
-  update: 'updateSpace',
-  replace: 'replaceSpace',
-  disable: 'deleteSpace',
-  'members.list': 'listWorkspaceMembers',
-  'members.add': 'addWorkspaceMember',
-  'members.get': 'getWorkspaceMember',
-  'members.update': 'updateWorkspaceMember',
-  'members.replace': 'replaceWorkspaceMember',
-  'members.remove': 'removeWorkspaceMember',
-});
-
-function operationKey(parts) {
-  const values = parts.map((part) => String(part || '').trim().toLowerCase()).filter(Boolean);
-  if (values.length === 1) return values[0] === 'delete' ? 'disable' : values[0];
-  if (values.length === 2 && ['member', 'members'].includes(values[0])) {
-    return `members.${values[1] === 'delete' ? 'remove' : values[1]}`;
-  }
-  return '';
-}
-
-async function spaceCommand(projectDir, positional, flags = {}) {
-  const key = operationKey(positional);
-  if (!OPERATIONS[key]) {
-    log.err('Usage: draftgo space list|create|get|update|replace|disable | members list|add|get|update|replace|remove [--input <json-file>]');
-    return 1;
-  }
-  return callOperation(projectDir, OPERATIONS[key], flags);
-}
-
-module.exports = spaceCommand;
-module.exports.OPERATIONS = OPERATIONS;
-module.exports.operationKey = operationKey;

package/src/customServices.js

@@ -1,484 +0,0 @@
-'use strict';
-
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('child_process');
-const AdmZip = require('adm-zip');
-const { loadProjectConfig } = require('./projectConfig');
-const { WorktreeError } = require('./worktree/errors');
-
-const FILES = ['service.go', 'service.json'];
-const MANAGED_MODULE_FILES = ['go.mod', 'go.sum', 'draftgo_local_main.go', '.draftgo-managed.json'];
-const MANAGED_SDK_DIRECTORY = '.draftgo-sdk';
-const SDK_BUNDLE_ROOT = path.resolve(__dirname, '..', 'resources', 'custom-service-sdk');
-const dependencyDirectivePattern = /^\s*\/\/\s*draftgo:require\s+([^\s@]+)@([^\s]+)\s*$/gm;
-function root(projectDir) { return path.join(projectDir, '.draftgo', 'worktree', 'custom-services'); }
-function baseRoot(projectDir) { return path.join(projectDir, '.draftgo', 'worktree', '.base', 'custom-services'); }
-function conflictRoot(projectDir, id) { return path.join(projectDir, '.draftgo', 'conflicts', 'custom-services', safe(id)); }
-function manifestPath(projectDir) { return path.join(root(projectDir), 'manifest.json'); }
-function safe(value) { return String(value).replace(/[^A-Za-z0-9._-]+/g, '_').replace(/^\.+/, '').slice(0, 80) || 'service'; }
-function sha256(value) { return crypto.createHash('sha256').update(value).digest('hex'); }
-function relative(projectDir, file) { return path.relative(projectDir, file).replace(/\\/g, '/'); }
-function loadManifest(projectDir) {
-  const file = manifestPath(projectDir);
-  if (!fs.existsSync(file)) return { schema_version: 2, entries: {} };
-  const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-  if (value && value.schema_version === 1) throw new WorktreeError('WORKTREE_SCHEMA_UNSUPPORTED', 'Custom-service worktree schema v1 is obsolete; create a new checkout with this CLI.');
-  if (!value || value.schema_version !== 2 || !value.entries || Array.isArray(value.entries)) throw new WorktreeError('INVALID_WORKTREE_MANIFEST', 'Invalid custom-service manifest.');
-  return value;
-}
-function atomicWrite(file, value) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const temporary = `${file}.tmp-${process.pid}-${Date.now()}-${crypto.randomBytes(8).toString('hex')}`;
-  fs.writeFileSync(temporary, value); fs.renameSync(temporary, file);
-}
-function saveManifest(projectDir, value) { value.updated_at = new Date().toISOString(); atomicWrite(manifestPath(projectDir), `${JSON.stringify(value, null, 2)}\n`); }
-function entryKey(id) { return String(id); }
-function uniqueIDs(ids) { return [...new Set(ids.map(String).map((id) => id.trim()).filter(Boolean))]; }
-function serviceDir(projectDir, id, slug) { return path.join(root(projectDir), `${safe(slug || id)}-${safe(id)}`); }
-function serviceBaseDir(projectDir, id) { return path.join(baseRoot(projectDir), safe(id)); }
-function parseEnvelope(text, response) {
-  let payload = {};
-  try { payload = text ? JSON.parse(text) : {}; } catch { payload = { message: text }; }
-  if (!response.ok || (payload.code && Number(payload.code) >= 400)) {
-    const details = payload.error?.details || payload.details || payload;
-    const error = new WorktreeError(payload.error?.code || payload.code || `HTTP_${response.status}`, payload.error?.message || payload.message || `DraftGo HTTP ${response.status}`, details);
-    error.status = response.status; throw error;
-  }
-  return payload.data === undefined ? payload : payload.data;
-}
-async function jsonRequest(config, method, endpoint, body, options = {}) {
-  const response = await (options.fetch || fetch)(`${config.server.replace(/\/+$/, '')}/api/${endpoint.replace(/^\/+/, '')}`, {
-    method, headers: { Authorization: `Bearer ${config.token || config.sat}`, ...(body === undefined ? {} : { 'Content-Type': 'application/json' }) },
-    body: body === undefined ? undefined : JSON.stringify(body), signal: options.signal,
-  });
-  return parseEnvelope(await response.text(), response);
-}
-async function metadata(config, id, options = {}) { return jsonRequest(config, 'GET', `content/custom-services/${encodeURIComponent(id)}/checkout`, undefined, options); }
-async function download(config, metadataValue, options = {}) {
-  const url = new URL(metadataValue.download_url, `${config.server.replace(/\/+$/, '')}/`).toString();
-  const response = await (options.fetch || fetch)(url, { headers: { Authorization: `Bearer ${config.token || config.sat}` }, signal: options.signal });
-  if (!response.ok) parseEnvelope(await response.text(), response);
-  const archive = Buffer.from(await response.arrayBuffer());
-  if (sha256(archive) !== metadataValue.content_hash) throw new WorktreeError('HASH_MISMATCH', 'Downloaded custom-service archive hash mismatch.');
-  return archive;
-}
-function archiveFiles(archive) {
-  const zip = new AdmZip(archive); const result = {};
-  for (const filename of FILES) {
-    const entry = zip.getEntry(filename);
-    if (!entry || entry.isDirectory) throw new WorktreeError('INVALID_SERVICE_ARCHIVE', `Custom-service archive is missing ${filename}.`);
-    result[filename] = entry.getData();
-  }
-  const unexpected = zip.getEntries().filter((entry) => !entry.isDirectory && !FILES.includes(entry.entryName));
-  if (unexpected.length) throw new WorktreeError('INVALID_SERVICE_ARCHIVE', `Unexpected archive entry ${unexpected[0].entryName}.`);
-  JSON.parse(result['service.json'].toString('utf8'));
-  return result;
-}
-function writeFiles(directory, files) { fs.mkdirSync(directory, { recursive: true }); for (const filename of FILES) atomicWrite(path.join(directory, filename), files[filename]); }
-function readFiles(directory) {
-  const result = {};
-  for (const filename of FILES) {
-    const file = path.join(directory, filename);
-    if (!fs.existsSync(file)) throw new WorktreeError('SERVICE_FILE_MISSING', `Custom-service worktree is missing ${filename}.`);
-    result[filename] = fs.readFileSync(file);
-  }
-  try { JSON.parse(result['service.json'].toString('utf8')); } catch (error) { throw new WorktreeError('INVALID_SERVICE_METADATA', `service.json is invalid: ${error.message}`); }
-  return result;
-}
-function createArchive(files) {
-  const zip = new AdmZip();
-  // Archive hashes are part of the checkout/commit concurrency contract. Keep
-  // ZIP metadata deterministic so the same two user files always produce the
-  // same content hash, independent of wall-clock time.
-  for (const filename of FILES) {
-    zip.addFile(filename, files[filename]);
-    const entry = zip.getEntry(filename);
-    if (entry?.header) entry.header.time = new Date(0);
-  }
-  return zip.toBuffer();
-}
-function fileHashes(files) { return Object.fromEntries(FILES.map((filename) => [filename, sha256(files[filename])])); }
-function checkoutHash(files) { return sha256(createArchive(files)); }
-
-function sdkFingerprint(files) {
-  const hash = crypto.createHash('sha256');
-  for (const filename of ['go.mod', 'go.sum']) { hash.update(filename); if (files[filename]) hash.update(files[filename]); }
-  for (const filename of Object.keys(files).filter((item) => item.endsWith('.go')).sort()) { hash.update(filename); hash.update(files[filename]); }
-  return hash.digest('hex');
-}
-
-function loadSDKBundle() {
-  const manifestFile = path.join(SDK_BUNDLE_ROOT, 'manifest.json');
-  if (!fs.existsSync(manifestFile)) throw new WorktreeError('LOCAL_SDK_MISSING', 'draftgo-cli is missing its managed custom-service SDK; reinstall or upgrade the CLI.');
-  const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
-  if (!manifest || manifest.schema_version !== 1 || !/^[a-f0-9]{64}$/.test(String(manifest.fingerprint || '')) || !Array.isArray(manifest.files)) {
-    throw new WorktreeError('LOCAL_SDK_INVALID', 'draftgo-cli contains an invalid managed custom-service SDK manifest.');
-  }
-  const files = {};
-  for (const item of manifest.files) {
-    const filename = String(item?.path || '');
-    if (!/^(?:(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\.go|go\.mod|go\.sum)$/.test(filename) || filename.includes('..')) {
-      throw new WorktreeError('LOCAL_SDK_INVALID', `Managed custom-service SDK contains an invalid path: ${filename || '<empty>'}.`);
-    }
-    const content = fs.readFileSync(path.join(SDK_BUNDLE_ROOT, filename));
-    if (sha256(content) !== item.sha256) throw new WorktreeError('LOCAL_SDK_INVALID', `Managed custom-service SDK hash mismatch: ${filename}.`);
-    files[filename] = content;
-  }
-  if (!files['go.mod'] || !Object.keys(files).some((filename) => filename.endsWith('.go'))) {
-    throw new WorktreeError('LOCAL_SDK_INVALID', 'Managed custom-service SDK is incomplete.');
-  }
-  if (sdkFingerprint(files) !== manifest.fingerprint) throw new WorktreeError('LOCAL_SDK_INVALID', 'Managed custom-service SDK fingerprint mismatch.');
-  return { manifest, files };
-}
-
-function dependencyRequirements(source) {
-  const byModule = new Map();
-  for (const match of String(source).matchAll(dependencyDirectivePattern)) {
-    const moduleName = match[1].trim(); const version = match[2].trim();
-    if (byModule.has(moduleName) && byModule.get(moduleName) !== version) {
-      throw new WorktreeError('INVALID_SERVICE_DEPENDENCY', `Dependency ${moduleName} declares conflicting versions.`);
-    }
-    byModule.set(moduleName, version);
-  }
-  return [...byModule.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([module, version]) => ({ module, version }));
-}
-
-function sdkGoVersion(bundle) {
-  const match = bundle.files['go.mod'].toString('utf8').match(/^go\s+([^\s]+)\s*$/m);
-  if (!match) throw new WorktreeError('LOCAL_SDK_INVALID', 'Managed custom-service SDK go.mod has no Go version.');
-  return match[1];
-}
-
-function managedModule(source, bundle) {
-  const requirements = dependencyRequirements(source);
-  const lines = [
-    '// Code generated by draftgo-cli. DO NOT EDIT.',
-    '// Local development only; DraftGo uploads only service.go and service.json.',
-    'module draftgo.local/customservice', '', `go ${sdkGoVersion(bundle)}`, '', 'require (', '\tdraftgo/sdk v0.0.0',
-    ...requirements.map((item) => `\t${item.module} ${item.version}`),
-    ')', '', `replace draftgo/sdk => ./${MANAGED_SDK_DIRECTORY}`, '',
-  ];
-  return { content: `${lines.join('\n')}`, requirements };
-}
-
-function syncManagedDevelopmentFiles(directory) {
-  const bundle = loadSDKBundle();
-  const source = fs.readFileSync(path.join(directory, 'service.go'), 'utf8');
-  const moduleValue = managedModule(source, bundle); const moduleHash = sha256(moduleValue.content);
-  const markerFile = path.join(directory, '.draftgo-managed.json');
-  let prior = null;
-  try { prior = JSON.parse(fs.readFileSync(markerFile, 'utf8')); } catch { /* generated state is disposable */ }
-  const preserveGoSum = prior?.schema_version === 1 && prior.module_hash === moduleHash && fs.existsSync(path.join(directory, 'go.sum'));
-
-  const sdkDirectory = path.join(directory, MANAGED_SDK_DIRECTORY);
-  fs.rmSync(sdkDirectory, { recursive: true, force: true }); fs.mkdirSync(sdkDirectory, { recursive: true });
-  for (const [filename, content] of Object.entries(bundle.files)) atomicWrite(path.join(sdkDirectory, filename), content);
-  atomicWrite(path.join(directory, 'go.mod'), moduleValue.content);
-  if (!preserveGoSum) atomicWrite(path.join(directory, 'go.sum'), '');
-  atomicWrite(path.join(directory, 'draftgo_local_main.go'), `// Code generated by draftgo-cli. DO NOT EDIT.\n// Local compile entrypoint; DraftGo never uploads this file.\npackage main\n\nimport "draftgo/sdk"\n\nfunc main() {\n\tapp := sdk.NewApp()\n\tRegister(app)\n}\n`);
-  atomicWrite(markerFile, `${JSON.stringify({
-    schema_version: 1, owner: 'draftgo-cli', notice: 'Generated local-development files; do not edit or commit.',
-    sdk_fingerprint: bundle.manifest.fingerprint, module_hash: moduleHash, requirements: moduleValue.requirements,
-  }, null, 2)}\n`);
-  return { sdk_fingerprint: bundle.manifest.fingerprint, module_hash: moduleHash, requirements: moduleValue.requirements };
-}
-function remoteFileHashes(remote) {
-  if (remote.checkout_schema_version != null && Number(remote.checkout_schema_version) !== 2) throw new WorktreeError('WORKTREE_SCHEMA_UNSUPPORTED', 'DraftGo custom-service checkout schema is not supported; upgrade DraftGo and create a new checkout.');
-  return { 'service.go': remote.source_hash, 'service.json': remote.metadata_hash };
-}
-function filesMatchRemote(files, remote) {
-  const local = fileHashes(files); const expected = remoteFileHashes(remote);
-  return FILES.every((filename) => expected[filename] && local[filename] === expected[filename]);
-}
-function canonicalFiles(files, remote) {
-  if (!remote || typeof remote.service_metadata_json !== 'string') {
-    throw new WorktreeError('INCOMPLETE_CHECKOUT_METADATA', 'DraftGo did not return canonical custom-service metadata.');
-  }
-  const canonical = { ...files, 'service.json': Buffer.from(remote.service_metadata_json, 'utf8') };
-  JSON.parse(canonical['service.json'].toString('utf8'));
-  const actual = fileHashes(canonical); const expected = remoteFileHashes(remote);
-  for (const filename of FILES) {
-    if (!/^[a-f0-9]{64}$/i.test(String(expected[filename] || '')) || actual[filename] !== expected[filename]) {
-      throw new WorktreeError('HASH_MISMATCH', `Canonical custom-service ${filename} does not match checkout metadata.`, {
-        filename, expected_hash: expected[filename] || null, actual_hash: actual[filename],
-      });
-    }
-  }
-  return canonical;
-}
-function applyRemoteEntry(entry, remote, files) {
-  const canonical = canonicalFiles(files, remote);
-  writeFiles(entry.local_dir, canonical); writeFiles(entry.base_dir, canonical);
-  entry.title = remote.title; entry.slug = JSON.parse(canonical['service.json'].toString('utf8')).slug;
-  entry.file_hashes = fileHashes(canonical); entry.base_hash = remote.content_hash;
-  entry.base_revision = remote.base_revision; entry.base_etag = remote.etag;
-  entry.checkout_source = remote.checkout_source; entry.updated_at = remote.updated_at;
-  entry.updated_by = remote.updated_by; entry.committed_at = new Date().toISOString();
-  return canonical;
-}
-function localState(entry) {
-  const local = readFiles(entry.local_dir); const base = readFiles(entry.base_dir);
-  const localHashes = fileHashes(local); const baseHashes = fileHashes(base);
-  const baseValid = FILES.every((filename) => baseHashes[filename] === entry.file_hashes[filename]);
-  return { local, base, local_hashes: localHashes, base_hashes: baseHashes, base_valid: baseValid,
-    modified: FILES.some((filename) => localHashes[filename] !== baseHashes[filename]) };
-}
-
-async function checkout(projectDir, ids, options = {}) {
-  const config = options.config || loadProjectConfig(projectDir); const manifest = loadManifest(projectDir);
-  const targets = uniqueIDs(ids);
-  const settled = await Promise.allSettled(targets.map(async (id) => {
-    const remote = await metadata(config, id, options); const key = entryKey(id); const old = manifest.entries[key];
-    if (old && fs.existsSync(old.local_dir) && !options.force && localState(old).modified) {
-      throw new WorktreeError('LOCAL_CHANGES_PRESENT', `Refusing to replace locally modified custom service ${id}; commit it or use checkout --force.`);
-    }
-    const archive = await download(config, remote, options); const files = archiveFiles(archive);
-    const service = JSON.parse(files['service.json'].toString('utf8')); const localDir = old?.local_dir || serviceDir(projectDir, id, service.slug); const baseDir = serviceBaseDir(projectDir, id);
-    writeFiles(localDir, files); writeFiles(baseDir, files);
-    syncManagedDevelopmentFiles(localDir);
-    const entry = { server: config.server, resource_type: 'custom_services', resource_id: String(id), title: remote.title,
-      slug: service.slug, local_dir: localDir, base_dir: baseDir, local_path: relative(projectDir, localDir), base_path: relative(projectDir, baseDir),
-      content_type: remote.content_type, base_revision: remote.base_revision, base_etag: remote.etag,
-      base_hash: remote.content_hash, file_hashes: fileHashes(files), checkout_source: remote.checkout_source,
-      checked_out_at: new Date().toISOString(), updated_at: remote.updated_at, updated_by: remote.updated_by };
-    return entry;
-  }));
-  const results = settled.filter((item) => item.status === 'fulfilled').map((item) => item.value);
-  for (const entry of results) manifest.entries[entryKey(entry.resource_id)] = entry;
-  if (results.length) saveManifest(projectDir, manifest);
-  const failures = settled.map((item, index) => ({ item, id: targets[index] })).filter(({ item }) => item.status === 'rejected');
-  if (failures.length) {
-    const error = failures[0].item.reason;
-    error.details = { ...(error.details || {}), batch: {
-      completed: results.map((entry) => ({ resource_id: entry.resource_id, status: 'checked_out' })),
-      failed: failures.map(({ item, id }) => ({ resource_id: id, status: 'failed', code: item.reason.code || 'CHECKOUT_FAILED', message: item.reason.message })),
-      not_started: [],
-    } };
-    throw error;
-  }
-  return results;
-}
-function getEntry(projectDir, id) { return loadManifest(projectDir).entries[entryKey(id)] || null; }
-function diffFile(baseFile, localFile, filename) {
-  if (fs.readFileSync(baseFile).equals(fs.readFileSync(localFile))) return '';
-  const result = spawnSync('git', ['diff', '--no-index', '--', baseFile, localFile], { encoding: 'utf8', windowsHide: true });
-  if (result.error || ![0, 1].includes(result.status)) return `${filename}: changed\n`;
-  return String(result.stdout || '').replaceAll(baseFile, `a/${filename}`).replaceAll(localFile, `b/${filename}`);
-}
-function diff(projectDir, id) {
-  const entry = getEntry(projectDir, id); if (!entry) throw new WorktreeError('RESOURCE_NOT_CHECKED_OUT', `Custom service ${id} is not checked out.`);
-  const state = localState(entry);
-  const files = FILES.map((filename) => {
-    const output = diffFile(path.join(entry.base_dir, filename), path.join(entry.local_dir, filename), filename);
-    return { filename, changed: state.local_hashes[filename] !== state.base_hashes[filename], output };
-  });
-  const result = { changed: files.some((file) => file.changed), entry,
-    files: files.map(({ filename, changed }) => ({ filename, changed })), output: files.map((file) => file.output).filter(Boolean).join('\n') };
-  Object.defineProperty(result, 'file_outputs', { value: files, enumerable: false });
-  return result;
-}
-async function writeConflict(projectDir, entry, remote, archive) {
-  const directory = conflictRoot(projectDir, entry.resource_id); const baseDir = path.join(directory, 'base'); const localDir = path.join(directory, 'local'); const remoteDir = path.join(directory, 'remote');
-  writeFiles(baseDir, readFiles(entry.base_dir)); writeFiles(localDir, readFiles(entry.local_dir)); writeFiles(remoteDir, archiveFiles(archive));
-  const record = { schema_version: 2, status: 'unresolved', code: 'RESOURCE_VERSION_CONFLICT', resource_type: 'custom_services', resource_id: entry.resource_id,
-    base_path: relative(projectDir, baseDir), local_path: relative(projectDir, localDir), remote_path: relative(projectDir, remoteDir), worktree_local_path: entry.local_path,
-    expected_revision: entry.base_revision, actual_revision: remote.base_revision, expected_hash: entry.base_hash, actual_hash: remote.content_hash,
-    actual_etag: remote.etag, actual_updated_at: remote.updated_at, created_at: new Date().toISOString() };
-  atomicWrite(path.join(directory, 'conflict.json'), `${JSON.stringify(record, null, 2)}\n`); return record;
-}
-function serviceConflicts(projectDir, options = {}) {
-  const directory = path.join(projectDir, '.draftgo', 'conflicts', 'custom-services'); if (!fs.existsSync(directory)) return [];
-  return fs.readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).flatMap((entry) => {
-    const file = path.join(directory, entry.name, 'conflict.json'); if (!fs.existsSync(file)) return [];
-    const record = JSON.parse(fs.readFileSync(file, 'utf8')); return options.all || record.status === 'unresolved' ? [{ ...record, manifest_path: relative(projectDir, file) }] : [];
-  });
-}
-function showConflict(projectDir, id) {
-  const record = serviceConflicts(projectDir, { all: true }).find((entry) => String(entry.resource_id) === String(id));
-  if (!record) throw new WorktreeError('CONFLICT_NOT_FOUND', `No custom-service conflict found for ${id}.`); return record;
-}
-function resolveConflict(projectDir, id) {
-  const record = showConflict(projectDir, id); if (record.status !== 'unresolved') throw new WorktreeError('CONFLICT_ALREADY_RESOLVED', `Custom-service conflict ${id} is already resolved.`);
-  const manifest = loadManifest(projectDir); const entry = manifest.entries[entryKey(id)]; if (!entry) throw new WorktreeError('RESOURCE_NOT_CHECKED_OUT', `Custom service ${id} is not checked out.`);
-  const remoteDir = path.resolve(projectDir, record.remote_path); const remoteFiles = readFiles(remoteDir); writeFiles(entry.base_dir, remoteFiles);
-  entry.file_hashes = fileHashes(remoteFiles); entry.base_hash = record.actual_hash; entry.base_revision = record.actual_revision; entry.base_etag = record.actual_etag; entry.updated_at = record.actual_updated_at; entry.conflict_resolved_at = new Date().toISOString();
-  manifest.entries[entryKey(id)] = entry; saveManifest(projectDir, manifest);
-  const resolved = { ...record, status: 'resolved', resolved_at: new Date().toISOString() }; delete resolved.manifest_path;
-  atomicWrite(path.resolve(projectDir, record.manifest_path), `${JSON.stringify(resolved, null, 2)}\n`); return { ...resolved, manifest_path: record.manifest_path };
-}
-async function commit(projectDir, ids, options = {}) {
-  const config = options.config || loadProjectConfig(projectDir); const manifest = loadManifest(projectDir);
-  const targets = uniqueIDs(ids);
-  const preflight = await Promise.allSettled(targets.map(async (id) => {
-    const entry = manifest.entries[entryKey(id)]; if (!entry) throw new WorktreeError('RESOURCE_NOT_CHECKED_OUT', `Custom service ${id} is not checked out.`);
-    if (entry.server !== config.server) throw new WorktreeError('CHECKOUT_SERVER_MISMATCH', 'Checkout belongs to a different DraftGo server.');
-    syncManagedDevelopmentFiles(entry.local_dir);
-    const state = localState(entry); if (!state.base_valid) throw new WorktreeError('BASE_HASH_MISMATCH', `Custom service ${id} base does not match its manifest.`);
-    const createDraft = Boolean(options.ensureDraft) && entry.checkout_source === 'live';
-    if (!state.modified && !createDraft) return { id, entry, state, unchanged: true };
-    const current = await metadata(config, id, options);
-    if (current.content_hash !== entry.base_hash || String(current.base_revision) !== String(entry.base_revision)) {
-      const remoteArchive = await download(config, current, options); const conflict = await writeConflict(projectDir, entry, current, remoteArchive);
-      throw new WorktreeError('RESOURCE_VERSION_CONFLICT', `Custom service ${id} changed remotely; conflict materials were preserved.`, conflict);
-    }
-    return { id, entry, state, current, archive: createArchive(state.local) };
-  }));
-  const preflightFailures = preflight.map((item, index) => ({ item, id: targets[index] })).filter(({ item }) => item.status === 'rejected');
-  if (preflightFailures.length) {
-    const error = preflightFailures[0].item.reason;
-    error.details = { ...(error.details || {}), batch: {
-      completed: [],
-      failed: preflightFailures.map(({ item, id }) => ({ resource_id: id, status: 'failed', phase: 'preflight', code: item.reason.code || 'PREFLIGHT_FAILED', message: item.reason.message })),
-      not_started: preflight.filter((item) => item.status === 'fulfilled').map((item) => ({ resource_id: item.value.id, status: 'not_started', phase: 'preflight' })),
-    } };
-    throw error;
-  }
-  const prepared = preflight.map((item) => item.value);
-  const uploaded = await Promise.allSettled(prepared.map(async (item) => {
-    const { id, entry, current, archive, state } = item;
-    if (item.unchanged) return { resource_type: 'custom_services', resource_id: String(id), status: 'unchanged' };
-    const url = new URL(current.commit_url, `${config.server.replace(/\/+$/, '')}/`).toString();
-    const response = await (options.fetch || fetch)(url, { method: 'PUT', headers: { Authorization: `Bearer ${config.token || config.sat}`, 'Content-Type': current.content_type,
-      'Content-Length': String(archive.length), 'X-Content-SHA256': sha256(archive), 'If-Match': entry.base_etag }, body: archive, signal: options.signal });
-    let committed;
-    try { committed = parseEnvelope(await response.text(), response); } catch (error) {
-      if ([409, 412].includes(error.status)) { const latest = await metadata(config, id, options); const remoteArchive = await download(config, latest, options); error.details = await writeConflict(projectDir, entry, latest, remoteArchive); }
-      throw error;
-    }
-    applyRemoteEntry(entry, committed, state.local); syncManagedDevelopmentFiles(entry.local_dir); manifest.entries[entryKey(id)] = entry;
-    return { resource_type: 'custom_services', resource_id: String(id), status: 'committed', revision: committed.base_revision, hash: committed.content_hash };
-  }));
-  const results = uploaded.filter((item) => item.status === 'fulfilled').map((item) => item.value);
-  if (results.some((item) => item.status === 'committed')) saveManifest(projectDir, manifest);
-  const uploadFailures = uploaded.map((item, index) => ({ item, id: prepared[index].id })).filter(({ item }) => item.status === 'rejected');
-  if (uploadFailures.length) {
-    const error = uploadFailures[0].item.reason;
-    error.details = { ...(error.details || {}), batch: {
-      completed: results,
-      failed: uploadFailures.map(({ item, id }) => ({ resource_id: id, status: 'failed', phase: 'upload', code: item.reason.code || 'COMMIT_FAILED', message: item.reason.message, remote_change_possible: true })),
-      not_started: [],
-    } };
-    throw error;
-  }
-  return results;
-}
-async function inspectRemote(projectDir, options = {}) {
-  const config = options.config || loadProjectConfig(projectDir);
-  const requested = options.ids ? new Set(options.ids.map(String)) : null;
-  const entries = Object.values(loadManifest(projectDir).entries)
-    .filter((entry) => !requested || requested.has(String(entry.resource_id)));
-  return Promise.all(entries.map(async (entry) => {
-    const state = localState(entry); const remote = await metadata(config, entry.resource_id, options); const remoteMatches = remote.content_hash === entry.base_hash && String(remote.base_revision) === String(entry.base_revision);
-    const localArchiveHash = checkoutHash(state.local); let status;
-    if (remoteMatches) status = state.modified ? 'local_modified' : 'clean';
-    else if (!state.modified) status = 'remote_changed';
-    else if (filesMatchRemote(state.local, remote)) status = 'committed_unrecorded';
-    else status = 'diverged';
-    return { ...entry, state: status, remote_hash: remote.content_hash, remote_revision: remote.base_revision, remote_etag: remote.etag, local_hash: localArchiveHash };
-  }));
-}
-function currentServiceMetadata(entry) { return JSON.parse(readFiles(entry.local_dir)['service.json'].toString('utf8')); }
-function validationCurrent(entry) {
-  const value = currentServiceMetadata(entry);
-  return value.validation_status === 'passed' && String(value.validated_revision) === String(entry.base_revision)
-    && /^[a-f0-9]{64}$/i.test(String(value.validated_hash || ''));
-}
-function syncCheckoutEntry(manifest, id, remote) {
-  const entry = manifest.entries[entryKey(id)];
-  if (!entry) throw new WorktreeError('RESOURCE_NOT_CHECKED_OUT', `Custom service ${id} is not checked out.`);
-  const state = localState(entry);
-  if (state.modified) throw new WorktreeError('LOCAL_CHANGES_PRESENT', `Custom service ${id} changed locally during its remote lifecycle.`);
-  applyRemoteEntry(entry, remote, state.local); syncManagedDevelopmentFiles(entry.local_dir); manifest.entries[entryKey(id)] = entry;
-  return entry;
-}
-async function validateCommitted(projectDir, id, config, manifest, options = {}) {
-  const entry = manifest.entries[entryKey(id)];
-  if (!entry) throw new WorktreeError('RESOURCE_NOT_CHECKED_OUT', `Custom service ${id} is not checked out.`);
-  if (validationCurrent(entry)) return { validation_status: 'passed', revision: entry.base_revision, checkout: null, cached: true };
-  const result = await jsonRequest(config, 'POST', `scripts/${encodeURIComponent(id)}/draft/validate`, { revision: entry.base_revision }, options);
-  if (!result.checkout) throw new WorktreeError('INCOMPLETE_CHECKOUT_METADATA', 'DraftGo validation response did not include checkout metadata.');
-  syncCheckoutEntry(manifest, id, result.checkout);
-  return result;
-}
-function validationStale(error) {
-  return Boolean(error) && error.status === 409 && error.code === 'VALIDATION_FAILED'
-    && error.details && error.details.reason === 'validation_stale';
-}
-async function validate(projectDir, id, options = {}) {
-  const config = options.config || loadProjectConfig(projectDir); await commit(projectDir, [id], { ...options, config, ensureDraft: true });
-  const manifest = loadManifest(projectDir); const result = await validateCommitted(projectDir, id, config, manifest, options);
-  if (!result.cached) saveManifest(projectDir, manifest);
-  return result;
-}
-function parseHandler(handler) {
-  const value = String(handler || '').trim(); if (!value) return undefined;
-  const parts = value.split(':');
-  if (parts[0] === 'route' && parts.length >= 3) return { kind: 'route', method: parts[1], path: parts.slice(2).join(':') };
-  if (parts[0] === 'event') return { kind: 'event', event: parts.slice(1).join(':') };
-  if (parts[0] === 'scheduled') return { kind: 'scheduled', name: parts.slice(1).join(':') };
-  return { kind: 'manual', name: value };
-}
-async function test(projectDir, id, input = {}, options = {}) {
-  const config = options.config || loadProjectConfig(projectDir);
-  const source = String(options.source || 'draft').toLowerCase();
-  if (!['auto', 'draft', 'published'].includes(source)) throw new Error('source must be auto, draft, or published.');
-  let manifest;
-  let entry;
-  let revision;
-  if (source === 'draft') {
-    await commit(projectDir, [id], { ...options, config, ensureDraft: true });
-    manifest = loadManifest(projectDir);
-    const validation = await validateCommitted(projectDir, id, config, manifest, options);
-    entry = manifest.entries[entryKey(id)];
-    revision = entry.base_revision;
-    if (!validation.cached) saveManifest(projectDir, manifest);
-  } else {
-    manifest = loadManifest(projectDir);
-    entry = manifest.entries[entryKey(id)];
-  }
-  const result = await jsonRequest(config, 'POST', `scripts/${encodeURIComponent(id)}/trial`, {
-    source,
-    input, selector: parseHandler(options.handler), headers: options.headers, user: options.user,
-    test_write: Boolean(options.testWrite), side_effect_policy: options.sideEffectPolicy || 'deny', revision,
-  }, options);
-  if (result.checkout && entry) { syncCheckoutEntry(manifest, id, result.checkout); saveManifest(projectDir, manifest); }
-  return result;
-}
-async function publish(projectDir, ids, options = {}) {
-  const config = options.config || loadProjectConfig(projectDir); const targets = uniqueIDs(ids);
-  await commit(projectDir, targets, { ...options, config, ensureDraft: true });
-  const manifest = loadManifest(projectDir);
-  const validations = await Promise.all(targets.map((id) => validateCommitted(projectDir, id, config, manifest, options)));
-  if (validations.some((result) => !result.cached)) saveManifest(projectDir, manifest);
-  const published = await Promise.allSettled(targets.map(async (id) => {
-    let entry = manifest.entries[entryKey(id)];
-    const requestPublish = () => jsonRequest(config, 'POST', `scripts/${encodeURIComponent(id)}/draft/publish`, { revision: entry.base_revision }, options);
-    let result;
-    try {
-      result = await requestPublish();
-    } catch (error) {
-      if (!validationStale(error)) throw error;
-      const validation = await jsonRequest(config, 'POST', `scripts/${encodeURIComponent(id)}/draft/validate`, { revision: entry.base_revision }, options);
-      if (!validation.checkout) throw new WorktreeError('INCOMPLETE_CHECKOUT_METADATA', 'DraftGo validation response did not include checkout metadata.');
-      entry = syncCheckoutEntry(manifest, id, validation.checkout);
-      result = await requestPublish();
-    }
-    if (!result.checkout) throw new WorktreeError('INCOMPLETE_CHECKOUT_METADATA', 'DraftGo publish response did not include checkout metadata.');
-    syncCheckoutEntry(manifest, id, result.checkout); return result;
-  }));
-  const results = published.filter((item) => item.status === 'fulfilled').map((item) => item.value);
-  if (results.length) saveManifest(projectDir, manifest);
-  const failures = published.map((item, index) => ({ item, id: targets[index] })).filter(({ item }) => item.status === 'rejected');
-  if (failures.length) {
-    const error = failures[0].item.reason;
-    error.details = { ...(error.details || {}), batch: {
-      completed: results, failed: failures.map(({ item, id }) => ({ resource_id: id, status: 'failed', code: item.reason.code || 'PUBLISH_FAILED', message: item.reason.message })), not_started: [],
-    } };
-    throw error;
-  }
-  return results;
-}
-
-module.exports = { FILES, MANAGED_MODULE_FILES, MANAGED_SDK_DIRECTORY, checkout, commit, diff, validate, test, publish, inspectRemote, loadManifest, getEntry, metadata, archiveFiles, createArchive, serviceConflicts, showConflict, resolveConflict, parseHandler, validationStale, dependencyRequirements, managedModule, syncManagedDevelopmentFiles, loadSDKBundle, sdkFingerprint };