lua-cli 3.15.3 → 3.16.0

package/node_modules/@lua/shared-source-sync/src/hash.ts

@@ -1,40 +0,0 @@
-/**
- * Hashing primitives.
- *
- * Wire-format note: the rest of the Lua platform (compiler, CLI cache, server
- * blob keys) uses the FIRST 16 HEX CHARS of SHA-256 as the file hash. This
- * truncation is part of the protocol — full 64-char digests would be
- * incompatible with the existing S3 layout and dedup. `hashContentTruncated`
- * is the canonical helper; callers should not roll their own.
- */
-
-import { createHash } from 'crypto';
-
-/** Default truncation length used across the Lua platform. */
-export const FILE_HASH_LENGTH = 16;
-
-/** Hash file content with the canonical 16-char truncated SHA-256. */
-export function hashContentTruncated(content: string | Buffer): string {
-  return createHash('sha256')
-    .update(content as Buffer)
-    .digest('hex')
-    .slice(0, FILE_HASH_LENGTH);
-}
-
-/** Full-length SHA-256 hex; used only for the combined project hash. */
-export function sha256Hex(content: string | Buffer): string {
-  return createHash('sha256')
-    .update(content as Buffer)
-    .digest('hex');
-}
-
-/**
- * Deterministic project hash: full-length SHA-256 over the sorted list of
- * per-file hashes joined by `|`. Matches `calculateProjectHash` in
- * `packages/lua-cli/src/utils/backup-helpers.ts` byte-for-byte so cross-tool
- * pushes do not produce spurious drift.
- */
-export function combineFileHashes(files: { relativePath: string; hash: string }[]): string {
-  const sorted = [...files].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-  return sha256Hex(sorted.map((f) => f.hash).join('|'));
-}

package/node_modules/@lua/shared-source-sync/src/http.ts

@@ -1,132 +0,0 @@
-/**
- * HTTP client for the `/developer/agents/:agentId/backup/*` endpoints on lua-api.
- *
- * Authentication is opaque to this module — the caller injects an
- * `Authorization` header value. lua-cli uses a Bearer API key; server-side
- * callers (`lua-claude-builder`) use a scoped service token.
- *
- * Errors surface as `BackupHttpError` instances with status code attached so
- * the caller can distinguish auth (`401/403`) from transport vs CAS-conflict
- * (`409`) failures.
- */
-
-import type {
-  BackupExistsResponse,
-  BackupManifest,
-  BackupMetadata,
-  CheckBlobsResponse,
-  GetBlobUrlsResponse,
-  SaveManifestRequest,
-} from './types';
-
-/** Minimal `fetch` contract — Node 18+, browser, or a test stub. */
-export type FetchLike = typeof fetch;
-
-export class BackupHttpError extends Error {
-  constructor(
-    message: string,
-    public readonly status: number,
-    public readonly endpoint: string,
-    public readonly body?: string
-  ) {
-    super(message);
-    this.name = 'BackupHttpError';
-  }
-}
-
-export interface BackupHttpClientOptions {
-  /** Base URL for lua-api (e.g. `https://api.heylua.ai`). No trailing slash. */
-  baseUrl: string;
-  /** Full `Authorization` header value, e.g. `Bearer <apiKey>`. */
-  authHeader: string;
-  /** Target agent id. Embedded into every path. */
-  agentId: string;
-  /** Override the global `fetch` (tests inject a mock). */
-  fetch?: FetchLike;
-}
-
-/**
- * Thin wrapper around the backup endpoints. All methods return the parsed
- * JSON body on `2xx` and throw `BackupHttpError` otherwise — by design this
- * pushes branching (e.g. "no backup yet → 404") into the caller, where the
- * intent is clearer than a discriminated success/error wrapper.
- */
-export class BackupHttpClient {
-  private readonly fetchFn: FetchLike;
-
-  constructor(private readonly options: BackupHttpClientOptions) {
-    this.fetchFn = options.fetch ?? fetch;
-  }
-
-  private url(path: string): string {
-    const base = this.options.baseUrl.replace(/\/$/, '');
-    return `${base}/developer/agents/${encodeURIComponent(this.options.agentId)}${path}`;
-  }
-
-  private async json<T>(method: 'GET' | 'POST', path: string, body?: unknown): Promise<T> {
-    const endpoint = this.url(path);
-    const res = await this.fetchFn(endpoint, {
-      method,
-      headers: {
-        Authorization: this.options.authHeader,
-        ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
-        Accept: 'application/json',
-      },
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
-    if (!res.ok) {
-      let text: string | undefined;
-      try {
-        text = await res.text();
-      } catch {
-        text = undefined;
-      }
-      throw new BackupHttpError(
-        `Backup request failed: ${method} ${path} → ${res.status} ${res.statusText}`,
-        res.status,
-        endpoint,
-        text
-      );
-    }
-    // 204 / empty body is unusual here but tolerate it for the manifest save
-    // path where the server may decide to return only headers in the future.
-    const text = await res.text();
-    if (!text) return undefined as unknown as T;
-    return JSON.parse(text) as T;
-  }
-
-  /** `POST /backup/check-blobs` — returns existing vs missing partition. */
-  checkBlobsExist(hashes: string[]): Promise<CheckBlobsResponse> {
-    return this.json<CheckBlobsResponse>('POST', '/backup/check-blobs', { hashes });
-  }
-
-  /** `POST /backup/blob-upload-urls` — presigned S3 PUT URLs. */
-  getBlobUploadUrls(hashes: string[]): Promise<GetBlobUrlsResponse> {
-    return this.json<GetBlobUrlsResponse>('POST', '/backup/blob-upload-urls', { hashes });
-  }
-
-  /** `POST /backup/blob-urls` — presigned S3 GET URLs (for restore). */
-  getBlobUrls(hashes: string[]): Promise<GetBlobUrlsResponse> {
-    return this.json<GetBlobUrlsResponse>('POST', '/backup/blob-urls', { hashes });
-  }
-
-  /** `POST /backup/manifest` — final step in a push; returns server metadata. */
-  saveManifest(data: SaveManifestRequest): Promise<BackupMetadata> {
-    return this.json<BackupMetadata>('POST', '/backup/manifest', data);
-  }
-
-  /** `GET /backup` — metadata only, no file list. */
-  getMetadata(): Promise<BackupMetadata> {
-    return this.json<BackupMetadata>('GET', '/backup');
-  }
-
-  /** `GET /backup/manifest` — metadata + file list. */
-  getManifest(): Promise<BackupManifest> {
-    return this.json<BackupManifest>('GET', '/backup/manifest');
-  }
-
-  /** `GET /backup/check/:hash` — fast freshness probe. */
-  checkBackupExists(hash: string): Promise<BackupExistsResponse> {
-    return this.json<BackupExistsResponse>('GET', `/backup/check/${encodeURIComponent(hash)}`);
-  }
-}

package/node_modules/@lua/shared-source-sync/src/index.ts

@@ -1,56 +0,0 @@
-/**
- * @lua/shared-source-sync — runtime-agnostic implementation of the agent
- * project backup protocol used by lua-cli (`lua push backup` / `lua sync`)
- * and lua-claude-builder (post-deploy source persist).
- *
- * The wire format and S3 layout are defined by the existing
- * `/developer/agents/:agentId/backup/*` endpoints on lua-api. This package
- * is the single source of truth for how to drive them so the CLI and any
- * server-side caller cannot drift apart.
- */
-
-export type {
-  BackupFileRef,
-  BackupManifest,
-  BackupMetadata,
-  BackupExistsResponse,
-  CheckBlobsRequest,
-  CheckBlobsResponse,
-  GetBlobUrlsRequest,
-  GetBlobUrlsResponse,
-  SaveManifestRequest,
-} from './types';
-
-export { FILE_HASH_LENGTH, hashContentTruncated, sha256Hex, combineFileHashes } from './hash';
-
-export { shouldSkipFile, shouldSkipDirectory, classifyFile, DEFAULT_MAX_FILE_BYTES } from './filter';
-
-export { walkWorkspace, type WalkOptions, type WalkResult } from './walk';
-
-export { BackupHttpClient, BackupHttpError, type BackupHttpClientOptions, type FetchLike } from './http';
-
-export { uploadBlobs, downloadBlobs } from './transfer';
-
-export { resolveBackupFileTarget, restoreFromBlobs, type RestoreOptions, type RestoreResult } from './restore';
-
-export { pushAgentBackup, type PushAgentBackupOptions, type PushAgentBackupResult } from './push';
-
-export { pullAgentBackup, type PullAgentBackupOptions, type PullAgentBackupResult } from './pull';
-
-export {
-  ARCHIVE_SCHEMA_VERSION,
-  encodeWorkspaceArchive,
-  decodeWorkspaceArchive,
-  writeArchiveToWorkspace,
-} from './archive';
-
-export type {
-  SkillSourceTool,
-  FetchedSkillSource,
-  AttachSkillSourceTool,
-  AttachSkillSourcePayload,
-  AttachSkillSourceResponse,
-  SkillSourceEditor,
-} from './skill-source';
-
-export { SKILL_SOURCE_EDITORS } from './skill-source';

package/node_modules/@lua/shared-source-sync/src/pull.ts

@@ -1,50 +0,0 @@
-/**
- * High-level "pull the per-agent backup into `targetDir`".
- *
- * Counterpart to `pushAgentBackup`. Today only the CLI calls this; the
- * shared package exposes it so future server-side features (e.g. "rehydrate
- * Builder workspace from the latest CLI push") can reuse the same logic.
- */
-
-import { BackupHttpClient, type BackupHttpClientOptions } from './http';
-import { downloadBlobs } from './transfer';
-import { restoreFromBlobs, type RestoreOptions, type RestoreResult } from './restore';
-import type { BackupManifest } from './types';
-
-export interface PullAgentBackupOptions {
-  http: BackupHttpClientOptions;
-  /** Destination on disk. Will be created if necessary. */
-  targetDir: string;
-  /** Restore options (overwrite policy). */
-  restore?: RestoreOptions;
-  /** Tuning knob for the parallel S3 GETs. */
-  concurrency?: number;
-}
-
-export interface PullAgentBackupResult extends RestoreResult {
-  manifest: BackupManifest;
-}
-
-/**
- * Fetch the manifest, download every referenced blob, write to disk. Returns
- * the manifest plus a tally of write/no-op/skip outcomes.
- *
- * Errors propagate — a missing backup throws `BackupHttpError` (404). Callers
- * decide whether that warrants a friendly "no source yet" message or a hard
- * failure.
- */
-export async function pullAgentBackup(opts: PullAgentBackupOptions): Promise<PullAgentBackupResult> {
-  const client = new BackupHttpClient(opts.http);
-  const manifest = await client.getManifest();
-  const uniqueHashes = [...new Set(manifest.files.map((f) => f.hash))];
-
-  const blobs = uniqueHashes.length
-    ? await (async () => {
-        const urls = await client.getBlobUrls(uniqueHashes);
-        return downloadBlobs({ urls: urls.urls, fetch: opts.http.fetch, concurrency: opts.concurrency });
-      })()
-    : new Map<string, Buffer>();
-
-  const result = restoreFromBlobs(manifest, blobs, opts.targetDir, opts.restore);
-  return { ...result, manifest };
-}

package/node_modules/@lua/shared-source-sync/src/push.ts

@@ -1,94 +0,0 @@
-/**
- * High-level "push the contents of `workspaceDir` to the per-agent backup".
- *
- * This is the algorithm shared between `lua-cli`'s `lua push backup` and the
- * `lua-claude-builder` `SourceSyncService`. Pure (no console output, no
- * filesystem mutation outside of reading `workspaceDir`, no telemetry — the
- * caller layers those concerns on top).
- */
-
-import { BackupHttpClient, type BackupHttpClientOptions } from './http';
-import { uploadBlobs } from './transfer';
-import { walkWorkspace, type WalkOptions } from './walk';
-import type { BackupFileRef, BackupMetadata } from './types';
-
-export interface PushAgentBackupOptions {
-  /** HTTP client config — the helper constructs the client internally. */
-  http: BackupHttpClientOptions;
-  /** Workspace root. Walked recursively with the standard skip rules. */
-  workspaceDir: string;
-  /** Org id (forwarded to the saveManifest body so the server can skip a lookup). */
-  orgId: string;
-  /** Semver of the deployed primitive when known. */
-  version?: string;
-  /** Audit label, e.g. `'admin-tool-builder'` or `'manual lua push backup'`. */
-  triggeredBy?: string;
-  /** Provenance label for the manifest record. Defaults to `'cli'` to match historical behavior. */
-  createdBy?: string;
-  /** Tuning knobs for the walk. */
-  walkOptions?: WalkOptions;
-  /** Tuning knob for the parallel S3 PUTs. */
-  concurrency?: number;
-}
-
-export interface PushAgentBackupResult {
-  /** Combined project hash that was pushed. */
-  projectHash: string;
-  /** Number of files described by the manifest (post-dedupe by path). */
-  fileCount: number;
-  /** Number of blobs the helper actually PUT to S3 (deduped against existing). */
-  filesUploaded: number;
-  /** Server-assigned monotonic version, when the V2 manifest path returned one. */
-  activeVersion?: number;
-  /** Full server metadata response for the saveManifest call. */
-  metadata: BackupMetadata;
-  /** The manifest file refs in the order they were sent. */
-  files: BackupFileRef[];
-}
-
-/**
- * Walk the workspace, upload missing blobs, save the manifest, return the
- * server's response. Throws on any non-2xx — callers decide how to react.
- *
- * Idempotent by design: the algorithm is content-addressed, so re-running the
- * push for the same workspace state is a no-op aside from the manifest write
- * (which the server treats as either equal-to-current or a new version).
- */
-export async function pushAgentBackup(opts: PushAgentBackupOptions): Promise<PushAgentBackupResult> {
-  const snapshot = walkWorkspace(opts.workspaceDir, opts.walkOptions);
-  const client = new BackupHttpClient(opts.http);
-
-  const uniqueHashes = [...new Set(snapshot.files.map((f) => f.hash))];
-  let filesUploaded = 0;
-
-  if (uniqueHashes.length > 0) {
-    const checked = await client.checkBlobsExist(uniqueHashes);
-    if (checked.missing.length > 0) {
-      const urls = await client.getBlobUploadUrls(checked.missing);
-      filesUploaded = await uploadBlobs({
-        uploadUrls: urls.urls,
-        contentByHash: snapshot.contentByHash,
-        fetch: opts.http.fetch,
-        concurrency: opts.concurrency,
-      });
-    }
-  }
-
-  const metadata = await client.saveManifest({
-    projectHash: snapshot.projectHash,
-    files: snapshot.files,
-    version: opts.version,
-    orgId: opts.orgId,
-    createdBy: opts.createdBy ?? 'cli',
-    triggeredBy: opts.triggeredBy,
-  });
-
-  return {
-    projectHash: snapshot.projectHash,
-    fileCount: snapshot.files.length,
-    filesUploaded,
-    activeVersion: metadata.activeVersion,
-    metadata,
-    files: snapshot.files,
-  };
-}

package/node_modules/@lua/shared-source-sync/src/restore.ts

@@ -1,83 +0,0 @@
-/**
- * Restore primitives: write a downloaded blob map back to disk.
- *
- * Mirrors `restoreProjectFromBackup` + `resolveBackupFileTarget` in
- * `packages/lua-cli/src/utils/backup-helpers.ts`. The sandbox rule for
- * `external: true` entries is preserved: they land under
- * `<targetDir>/.lua/external/<workspaceRelativePath>` rather than being
- * written back to their original workspace location.
- */
-
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'fs';
-import { dirname, join, resolve, sep } from 'path';
-import type { BackupFileRef, BackupManifest } from './types';
-
-/**
- * Compute the disk path where a manifest entry should land during restore.
- *
- * Throws if the result would escape `targetDir` — a malicious manifest with
- * `../` segments must not be allowed to overwrite arbitrary files.
- */
-export function resolveBackupFileTarget(file: BackupFileRef, targetDir: string): string {
-  const base = resolve(targetDir);
-  const sandboxed = file.external ? join(base, '.lua', 'external', file.relativePath) : join(base, file.relativePath);
-  const resolved = resolve(sandboxed);
-  if (resolved !== base && !resolved.startsWith(base + sep)) {
-    throw new Error(`Backup entry escapes target directory: ${file.relativePath}`);
-  }
-  return resolved;
-}
-
-export interface RestoreOptions {
-  /** Overwrite existing files. Defaults to `false` — collision-safe. */
-  overwrite?: boolean;
-}
-
-export interface RestoreResult {
-  filesWritten: number;
-  filesUnchanged: number;
-  filesSkipped: number;
-}
-
-/**
- * Materialize a manifest's files into `targetDir`. Skips writes when the
- * on-disk bytes already match the blob (so callers can distinguish "9 files
- * restored" from "9 files matched, 0 written") and respects `overwrite=false`
- * to avoid clobbering edits the user hasn't yet pushed.
- */
-export function restoreFromBlobs(
-  manifest: BackupManifest,
-  blobs: Map<string, Buffer>,
-  targetDir: string,
-  opts: RestoreOptions = {}
-): RestoreResult {
-  let filesWritten = 0;
-  let filesUnchanged = 0;
-  let filesSkipped = 0;
-
-  for (const file of manifest.files) {
-    const content = blobs.get(file.hash);
-    if (!content) {
-      throw new Error(`Blob not found for hash: ${file.hash} (${file.relativePath})`);
-    }
-    const targetPath = resolveBackupFileTarget(file, targetDir);
-
-    if (existsSync(targetPath)) {
-      const sameSize = statSync(targetPath).size === content.length;
-      if (sameSize && readFileSync(targetPath).equals(content)) {
-        filesUnchanged++;
-        continue;
-      }
-      if (!opts.overwrite) {
-        filesSkipped++;
-        continue;
-      }
-    }
-
-    mkdirSync(dirname(targetPath), { recursive: true });
-    writeFileSync(targetPath, content);
-    filesWritten++;
-  }
-
-  return { filesWritten, filesUnchanged, filesSkipped };
-}

package/node_modules/@lua/shared-source-sync/src/skill-source.ts

@@ -1,55 +0,0 @@
-/**
- * Wire types for the per-skill canonical source store.
- * Spec: docs/superpowers/specs/2026-05-02-canonical-tool-source-design.md.
- *
- * Driven by both the admin-tool-builder's CanonicalSourceClient (internal
- * lua-agents URI, no auth) and lua-cli's SkillApi (developer-facing lua-api
- * endpoint, Bearer auth). Transport differs; the wire shapes are shared.
- */
-
-export const SKILL_SOURCE_EDITORS = ['builder', 'cli', 'engineer', 'system'] as const;
-export type SkillSourceEditor = (typeof SKILL_SOURCE_EDITORS)[number];
-
-/** Per-tool entry returned by `GET /skills/.../source`. */
-export interface SkillSourceTool {
-  name: string;
-  entryFile: string | null;
-  source: string | null;
-  lastEditedBy: SkillSourceEditor | null;
-  lastEditedAt: string | Date | null;
-}
-
-/** Response from `GET /skills/.../source` (lua-agents internal) / `GET /developer/skills/.../source` (lua-api). */
-export interface FetchedSkillSource {
-  skillId: string;
-  version: string;
-  sourceArchive: string | null;
-  archiveSchemaVersion: number | null;
-  tools: SkillSourceTool[];
-}
-
-/** Per-tool entry accepted by `PUT /skills/.../version/.../source`. */
-export interface AttachSkillSourceTool {
-  name: string;
-  source?: string;
-  entryFile?: string;
-  lastEditedBy?: SkillSourceEditor;
-}
-
-/** Body of `PUT /skills/.../version/.../source`. */
-export interface AttachSkillSourcePayload {
-  sourceArchive?: string;
-  archiveSchemaVersion?: number;
-  tools?: AttachSkillSourceTool[];
-  /**
-   * CAS gate: if supplied and not matching the skill's current
-   * `activeVersionId` on the server, the write is rejected with 409.
-   */
-  expectedActiveVersionId?: string;
-}
-
-/** Successful response shape from `PUT /skills/.../version/.../source`. */
-export interface AttachSkillSourceResponse {
-  ok: true;
-  version: string;
-}

package/node_modules/@lua/shared-source-sync/src/transfer.ts

@@ -1,92 +0,0 @@
-/**
- * S3 transfer primitives: gzip-compressed blob upload and download.
- *
- * Content is always gzipped before upload (matches the CLI convention) and
- * decompressed transparently on download (magic-byte sniff with raw fallback
- * for legacy/uncompressed blobs that may still exist).
- */
-
-import { gunzipSync, gzipSync } from 'zlib';
-import type { FetchLike } from './http';
-
-const DEFAULT_CONCURRENCY = 10;
-
-/**
- * PUT each blob to its presigned URL. Caller supplies a map of `hash → URL`
- * (from `BackupHttpClient.getBlobUploadUrls`) plus a map of `hash → content`.
- * Returns the count of blobs that landed in S3.
- */
-export async function uploadBlobs(opts: {
-  uploadUrls: Record<string, string>;
-  contentByHash: Map<string, Buffer>;
-  fetch?: FetchLike;
-  concurrency?: number;
-}): Promise<number> {
-  const fetchFn = opts.fetch ?? fetch;
-  const concurrency = opts.concurrency ?? DEFAULT_CONCURRENCY;
-  const hashes = Object.keys(opts.uploadUrls);
-
-  for (let i = 0; i < hashes.length; i += concurrency) {
-    const batch = hashes.slice(i, i + concurrency);
-    await Promise.all(
-      batch.map(async (hash) => {
-        const buf = opts.contentByHash.get(hash);
-        if (!buf) {
-          throw new Error(`uploadBlobs: no content for hash ${hash.slice(0, 12)}…`);
-        }
-        const compressed = gzipSync(buf);
-        const res = await fetchFn(opts.uploadUrls[hash], {
-          method: 'PUT',
-          body: compressed,
-          headers: { 'Content-Type': 'application/octet-stream' },
-        });
-        if (!res.ok) {
-          throw new Error(`S3 upload failed for ${hash.slice(0, 12)}…: ${res.status} ${res.statusText}`);
-        }
-      })
-    );
-  }
-  return hashes.length;
-}
-
-/**
- * GET each blob from its presigned URL and return `hash → buffer`. Detects
- * gzip via magic bytes (1f 8b) and gracefully falls back to the raw response
- * body for any legacy uncompressed blobs.
- */
-export async function downloadBlobs(opts: {
-  urls: Record<string, string>;
-  fetch?: FetchLike;
-  concurrency?: number;
-}): Promise<Map<string, Buffer>> {
-  const fetchFn = opts.fetch ?? fetch;
-  const concurrency = opts.concurrency ?? DEFAULT_CONCURRENCY;
-  const out = new Map<string, Buffer>();
-  const entries = Object.entries(opts.urls);
-
-  for (let i = 0; i < entries.length; i += concurrency) {
-    const batch = entries.slice(i, i + concurrency);
-    const downloaded = await Promise.all(
-      batch.map(async ([hash, url]) => {
-        const res = await fetchFn(url);
-        if (!res.ok) {
-          throw new Error(`S3 download failed for ${hash.slice(0, 12)}…: ${res.status} ${res.statusText}`);
-        }
-        const ab = await res.arrayBuffer();
-        const buf = Buffer.from(ab);
-        if (buf.length >= 2 && buf[0] === 0x1f && buf[1] === 0x8b) {
-          try {
-            return [hash, gunzipSync(buf)] as const;
-          } catch {
-            // Looked gzipped but wasn't — fall through to the raw bytes
-            // rather than failing the whole restore.
-            return [hash, buf] as const;
-          }
-        }
-        return [hash, buf] as const;
-      })
-    );
-    for (const [hash, buf] of downloaded) out.set(hash, buf);
-  }
-  return out;
-}