t44 0.4.0-rc.13 → 0.4.0-rc.14

package/.github/workflows/test.yaml

@@ -0,0 +1,26 @@
+name: Tests
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run tests
+        run: bun test

package/caps/ProjectPublishing.ts

@@ -71,7 +71,7 @@ export async function capsule({
                     type: CapsulePropertyTypes.Function,
                     value: async function (this: any, { args }: any): Promise<void> {
 
-                        const { projectSelector, rc, release, bump, publish, dangerouslyResetMain, yesSignoff } = args
+                        const { projectSelector, rc, release, bump, publish, dangerouslyResetMain, dangerouslyResetGordianOpenIntegrity, yesSignoff } = args
 
                         // Determine if this is a dry-run (default) or actual publish
                         const isDryRun = !rc && !release && !bump && !publish
@@ -149,7 +149,8 @@ export async function capsule({
                             await this.ProjectRepository.sync({
                                 rootDir: repoSourceDir,
                                 sourceDir: projectSourceDir,
-                                gitignorePath
+                                gitignorePath,
+                                excludePatterns: repositoriesConfig.alwaysIgnore || []
                             })
 
                             stageSourceDirs.set(repoName, repoSourceDir)
@@ -433,8 +434,9 @@ export async function capsule({
                                 })
                             } else if (capsuleName === 't44/caps/providers/git-scm.com/ProjectPublishing' && !isDryRun) {
                                 await this.GitRepository.push({
-                                    config: { ...repoConfig, provider: providerConfig, sourceDir: repoSourceDir },
+                                    config: { ...repoConfig, provider: providerConfig, sourceDir: repoSourceDir, alwaysIgnore: repositoriesConfig.alwaysIgnore },
                                     dangerouslyResetMain,
+                                    dangerouslyResetGordianOpenIntegrity,
                                     yesSignoff,
                                     metadata: gitMetadata.get(repoName),
                                     projectSourceDir: (repoConfig as any).sourceDir

package/caps/ProjectRepository.ts

@@ -62,10 +62,11 @@ export async function capsule({
                 },
                 sync: {
                     type: CapsulePropertyTypes.Function,
-                    value: async function (this: any, { rootDir, sourceDir, gitignorePath }: {
+                    value: async function (this: any, { rootDir, sourceDir, gitignorePath, excludePatterns }: {
                         rootDir: string
                         sourceDir: string
                         gitignorePath?: string
+                        excludePatterns?: string[]
                     }): Promise<void> {
                         let gitignoreExists = false
                         if (gitignorePath) {
@@ -79,6 +80,12 @@ export async function capsule({
                         if (gitignoreExists && gitignorePath) {
                             rsyncArgs.push('--exclude-from=' + gitignorePath)
                         }
+                        // Add additional exclude patterns from alwaysIgnore config
+                        if (excludePatterns && excludePatterns.length > 0) {
+                            for (const pattern of excludePatterns) {
+                                rsyncArgs.push('--exclude', pattern)
+                            }
+                        }
                         rsyncArgs.push(sourceDir + '/', rootDir + '/')
                         await $`${rsyncArgs}`
                     }

package/caps/WorkspaceConfig.yaml

@@ -55,6 +55,8 @@ extends:
             value: optional
           dangerously-reset-main:
             description: Reset the git repository and force push to remote.
+          dangerously-reset-gordian-open-integrity:
+            description: Reset the Gordian Open Integrity trust root.
           yes-signoff:
             description: Automatically agree to DCO sign-off without prompting.
       deploy:

package/caps/WorkspaceConnection.ts

@@ -10,6 +10,9 @@ import { join } from 'path'
 const shownConnectionTitles = new Set<string>()
 const shownDescriptions = new Set<string>()
 
+// Cache for in-flight getStoredConfig promises to prevent parallel decryption race conditions
+const storedConfigCache = new Map<string, Promise<Record<string, any> | null>>()
+
 export async function capsule({
     encapsulate,
     CapsulePropertyTypes,
@@ -77,9 +80,29 @@ export async function capsule({
                 getStoredConfig: {
                     type: CapsulePropertyTypes.Function,
                     value: async function (this: any): Promise<Record<string, any> | null> {
-                        const { readFile } = await import('fs/promises')
                         const filepath = await this.getFilepath()
 
+                        // Use cached promise if already in-flight to prevent parallel decryption race conditions
+                        if (storedConfigCache.has(filepath)) {
+                            return storedConfigCache.get(filepath)!
+                        }
+
+                        const promise = this._getStoredConfigImpl(filepath)
+                        storedConfigCache.set(filepath, promise)
+
+                        try {
+                            return await promise
+                        } finally {
+                            // Clear cache after completion so next call gets fresh data
+                            storedConfigCache.delete(filepath)
+                        }
+                    }
+                },
+                _getStoredConfigImpl: {
+                    type: CapsulePropertyTypes.Function,
+                    value: async function (this: any, filepath: string): Promise<Record<string, any> | null> {
+                        const { readFile } = await import('fs/promises')
+
                         try {
                             const content = await readFile(filepath, 'utf-8')
                             const parsed = JSON.parse(content)

package/caps/WorkspaceTest.ts

@@ -1,7 +1,7 @@
-
 import type * as BunTest from 'bun:test'
 import { config as loadDotenv } from 'dotenv'
-import { join } from 'path'
+import { join, dirname, basename } from 'path'
+import { mkdir } from 'fs/promises'
 
 // Global cache for loaded env files (this is fine as a cache)
 const loadedEnvFiles = new Set<string>()
@@ -67,6 +67,35 @@ export async function capsule({
                         return process.env[envVarName]
                     }
                 },
+                workbenchDir: {
+                    type: CapsulePropertyTypes.GetterFunction,
+                    value: function (this: any): string {
+
+                        const moduleFilepath = this['#@stream44.studio/encapsulate/structs/Capsule'].rootCapsule.moduleFilepath
+                        const dir = join(dirname(moduleFilepath), '.~o/workspace.foundation/workbenches', basename(moduleFilepath).replace(/\.[^\.]+$/, ''))
+
+                        return dir
+                    }
+                },
+                emptyWorkbenchDir: {
+                    type: CapsulePropertyTypes.Function,
+                    value: async function (this: any): Promise<void> {
+                        const dir = this.workbenchDir
+
+                        // Ensure the directory exists first
+                        await mkdir(dir, { recursive: true })
+
+                        // Remove directory contents (not the directory itself) including dotfiles
+                        // Use shell with proper globbing to handle both regular files and dotfiles
+                        await Bun.$`sh -c 'rm -rf ${dir}/* ${dir}/.[!.]* ${dir}/..?* 2>/dev/null || true'`.quiet()
+                    }
+                },
+                EnsureEmptyWorkbenchDir: {
+                    type: CapsulePropertyTypes.StructInit,
+                    value: async function (this: any) {
+                        await this.emptyWorkbenchDir()
+                    }
+                },
                 describe: {
                     type: CapsulePropertyTypes.GetterFunction,
                     value: function (this: any) {
@@ -161,7 +190,7 @@ export async function capsule({
     }, {
         importMeta: import.meta,
         importStack: makeImportStack(),
-        capsuleName: capsule['#'],
+        capsuleName: capsule['#']
     })
 }
 capsule['#'] = 't44/caps/WorkspaceTest'

package/caps/providers/git-scm.com/ProjectPublishing.ts

@@ -90,7 +90,8 @@ export async function capsule({
                         await this.ProjectRepository.sync({
                             rootDir: stageDir,
                             sourceDir: projectSourceDir,
-                            gitignorePath
+                            gitignorePath,
+                            excludePatterns: config.alwaysIgnore || []
                         })
 
                         // Generate files from config properties starting with '/'
@@ -195,7 +196,7 @@ export async function capsule({
                 },
                 push: {
                     type: CapsulePropertyTypes.Function,
-                    value: async function (this: any, { config, dangerouslyResetMain, yesSignoff, metadata, projectSourceDir }: { config: any, dangerouslyResetMain?: boolean, yesSignoff?: boolean, metadata: any, projectSourceDir?: string }) {
+                    value: async function (this: any, { config, dangerouslyResetMain, dangerouslyResetGordianOpenIntegrity, yesSignoff, metadata, projectSourceDir }: { config: any, dangerouslyResetMain?: boolean, dangerouslyResetGordianOpenIntegrity?: boolean, yesSignoff?: boolean, metadata: any, projectSourceDir?: string }) {
 
                         const {
                             originUri,
@@ -327,25 +328,15 @@ export async function capsule({
                                     await rm(join(dir!, '.dco-signatures'), { force: true })
                                 }
 
-                                // Create OI identity using the workspace signing key
-                                console.log(`Creating GordianOpenIntegrity identity ...`)
-                                console.log(chalk.gray(`  Author: ${authorName} <${authorEmail}>`))
-                                const author = await this.GordianOpenIntegrity.createIdentity({
-                                    key: {
-                                        privateKeyPath: signingKeyPath,
-                                        publicKeyPath: `${signingKeyPath}.pub`,
-                                        publicKey: signingPublicKey,
-                                        fingerprint: signingFingerprint,
-                                    },
-                                    authorName,
-                                    authorEmail,
-                                })
-
-                                // Create OI inception repo at stageDir
+                                // Create OI inception repo at stageDir using the workspace signing key
                                 console.log(`Creating GordianOpenIntegrity inception repository ...`)
+                                console.log(chalk.gray(`  Author: ${authorName} <${authorEmail}>`))
                                 const repoResult = await this.GordianOpenIntegrity.createRepository({
                                     repoDir: stageDir,
-                                    author,
+                                    authorName,
+                                    authorEmail,
+                                    firstTrustKeyPath: signingKeyPath,
+                                    provenanceKeyPath: signingKeyPath,
                                 })
                                 console.log(chalk.green(`  ✓ Inception commit: ${repoResult.commitHash.slice(0, 8)}`))
                                 console.log(chalk.green(`  ✓ DID: ${repoResult.did}`))
@@ -434,7 +425,8 @@ export async function capsule({
                                 await this.ProjectRepository.sync({
                                     rootDir: stageDir,
                                     sourceDir: projectSourcePath,
-                                    gitignorePath
+                                    gitignorePath,
+                                    excludePatterns: config.alwaysIgnore || []
                                 })
 
                                 // Generate files from config properties starting with '/'
@@ -454,7 +446,7 @@ export async function capsule({
                                 const hasDco = await this.Dco.hasDco({ repoDir: stageDir })
                                 if (hasDco) {
                                     console.log(chalk.cyan(`DCO.md detected — running DCO signing process ...`))
-                                    await this.Dco.sign({ repoDir: stageDir, autoAgree: yesSignoff, signingKeyPath: author.sshKey.privateKeyPath })
+                                    await this.Dco.sign({ repoDir: stageDir, autoAgree: yesSignoff, signingKeyPath })
                                 }
 
                                 // Stage all files and commit as a signed commit
@@ -462,7 +454,9 @@ export async function capsule({
                                 await $`git add -A`.cwd(stageDir).quiet()
                                 await this.GordianOpenIntegrity.commitToRepository({
                                     repoDir: stageDir,
-                                    author,
+                                    authorName,
+                                    authorEmail,
+                                    signingKeyPath,
                                     message: 'Published using @Stream44 Studio',
                                 })
                                 console.log(chalk.green(`  ✓ Source content committed`))
@@ -516,7 +510,113 @@ export async function capsule({
                                 })
                                 console.log(`Repository reset to initial commit`)
                             }
-                        } else if (hasNewChanges) {
+                        }
+
+                        // Handle Gordian Open Integrity trust root reset (without deleting git history)
+                        if (dangerouslyResetGordianOpenIntegrity && oiEnabled && !dangerouslyResetMain) {
+                            console.log(chalk.cyan(`\nResetting Gordian Open Integrity trust root ...`))
+
+                            // Get author info from workspace.yaml config
+                            const authorConfig = config.provider?.config?.RepositorySettings?.author
+                            if (!authorConfig?.name || !authorConfig?.email) {
+                                throw new Error('GordianOpenIntegrity requires author.name and author.email in RepositorySettings config')
+                            }
+                            const authorName = authorConfig.name
+                            const authorEmail = authorConfig.email
+
+                            // Resolve the workspace signing key
+                            const signingKeyPath = await this.SigningKey.getKeyPath()
+                            const signingPublicKey = await this.SigningKey.getPublicKey()
+                            const signingFingerprint = await this.SigningKey.getFingerprint()
+                            const signingKeyName = await this.SigningKey.getKeyName()
+                            if (!signingKeyPath || !signingPublicKey || !signingFingerprint) {
+                                throw new Error('Signing key not configured. Run SigningKey.ensureKey() first.')
+                            }
+                            console.log(chalk.gray(`  Signing key: ${signingKeyName} (${signingKeyPath})`))
+                            console.log(chalk.gray(`  Author: ${authorName} <${authorEmail}>`))
+
+                            // Check if .repo-identifier exists to decide which method to call
+                            const repoIdentifierPath = join(stageDir, '.repo-identifier')
+                            let repoIdentifierExists = false
+                            try {
+                                await access(repoIdentifierPath, constants.F_OK)
+                                repoIdentifierExists = true
+                            } catch {
+                                // File doesn't exist
+                            }
+
+                            let repoResult: any
+                            if (repoIdentifierExists) {
+                                // .repo-identifier exists — reset trust root only
+                                console.log(chalk.gray(`  Found existing .repo-identifier — resetting trust root only`))
+                                repoResult = await this.GordianOpenIntegrity.createTrustRoot({
+                                    repoDir: stageDir,
+                                    authorName,
+                                    authorEmail,
+                                    firstTrustKeyPath: signingKeyPath,
+                                    provenanceKeyPath: signingKeyPath,
+                                })
+                            } else {
+                                // No .repo-identifier — create full repository (identifier + trust root)
+                                console.log(chalk.gray(`  No .repo-identifier found — creating repository identifier and trust root`))
+                                repoResult = await this.GordianOpenIntegrity.createRepository({
+                                    repoDir: stageDir,
+                                    authorName,
+                                    authorEmail,
+                                    firstTrustKeyPath: signingKeyPath,
+                                    provenanceKeyPath: signingKeyPath,
+                                })
+                            }
+                            console.log(chalk.green(`  ✓ New trust root created`))
+                            console.log(chalk.green(`  ✓ DID: ${repoResult.did}`))
+
+                            // Copy .o/GordianOpenIntegrity.yaml and lifehash images to source directories
+                            const stageODir = join(stageDir, '.o')
+                            const projectSourcePath = join(config.sourceDir)
+
+                            const prStageInceptionDir = join(projectSourcePath, '.o')
+                            await mkdir(prStageInceptionDir, { recursive: true })
+                            await copyFile(join(stageODir, 'GordianOpenIntegrity.yaml'), join(prStageInceptionDir, 'GordianOpenIntegrity.yaml'))
+                            for (const lifehashFile of ['GordianOpenIntegrity-InceptionLifehash.svg', 'GordianOpenIntegrity-CurrentLifehash.svg']) {
+                                await copyFile(join(stageODir, lifehashFile), join(prStageInceptionDir, lifehashFile))
+                            }
+
+                            if (projectSourceDir) {
+                                const sourceInceptionDir = join(projectSourceDir, '.o')
+                                await mkdir(sourceInceptionDir, { recursive: true })
+                                await copyFile(join(stageODir, 'GordianOpenIntegrity.yaml'), join(sourceInceptionDir, 'GordianOpenIntegrity.yaml'))
+                                for (const lifehashFile of ['GordianOpenIntegrity-InceptionLifehash.svg', 'GordianOpenIntegrity-CurrentLifehash.svg']) {
+                                    await copyFile(join(stageODir, lifehashFile), join(sourceInceptionDir, lifehashFile))
+                                }
+                            }
+                            console.log(chalk.green(`  ✓ Copied .o/GordianOpenIntegrity.yaml and lifehash images to source directories`))
+
+                            // Update Repository DID in README.md files if present
+                            const DID_PATTERN = /^(Repository DID: `)([^`]*)(`)$/m
+                            for (const dir of [stageDir, projectSourcePath, projectSourceDir].filter(Boolean)) {
+                                const readmePath = join(dir!, 'README.md')
+                                try {
+                                    const readmeContent = await readFile(readmePath, 'utf-8')
+                                    if (DID_PATTERN.test(readmeContent)) {
+                                        const updated = readmeContent.replace(DID_PATTERN, `$1${repoResult.did}$3`)
+                                        await writeFile(readmePath, updated, 'utf-8')
+                                        console.log(chalk.green(`  ✓ Updated Repository DID in ${readmePath}`))
+                                    }
+                                } catch { }
+                            }
+
+                            // Store generator in the registry
+                            const registryRootDir = await this.HomeRegistry.rootDir
+                            const oiRegistryDir = join(registryRootDir, OI_REGISTRY_CAPSULE, repoResult.did)
+                            await mkdir(oiRegistryDir, { recursive: true })
+
+                            const repoGeneratorPath = join(stageDir, GENERATOR_FILE)
+                            const registryGeneratorPath = join(oiRegistryDir, 'GordianOpenIntegrity-generator.yaml')
+                            await cp(repoGeneratorPath, registryGeneratorPath)
+                            console.log(chalk.green(`  ✓ Generator stored at: ${registryGeneratorPath}`))
+                        }
+
+                        if (!dangerouslyResetMain && hasNewChanges) {
                             // Check if DCO.md exists in the stage dir
                             const hasDco = await this.Dco.hasDco({ repoDir: stageDir })
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "t44",
-    "version": "0.4.0-rc.13",
+    "version": "0.4.0-rc.14",
     "license": "Apache-2.0",
     "repository": {
         "type": "git",
@@ -10,6 +10,9 @@
     "bin": {
         "t44": "./bin/t44"
     },
+    "scripts": {
+        "test": "bun test"
+    },
     "exports": {
         "./workspace-rt": "./workspace-rt.ts",
         "./standalone-rt": "./standalone-rt.ts",
@@ -85,9 +88,9 @@
         "@ucanto/principal": "^9.0.3",
         "@ucanto/server": "^11.0.3",
         "json-schema-ref-resolver": "^3.0.0",
-        "@stream44.studio/encapsulate": "^0.4.0-rc.11",
-        "@stream44.studio/dco": "^0.3.0-rc.11",
-        "@stream44.studio/t44-blockchaincommons.com": "^0.1.0-rc.12"
+        "@stream44.studio/encapsulate": "^0.4.0-rc.12",
+        "@stream44.studio/dco": "^0.3.0-rc.12",
+        "@stream44.studio/t44-blockchaincommons.com": "^0.1.0-rc.13"
     },
     "devDependencies": {
         "@types/bun": "^1.3.4",

package/standalone-rt.ts

@@ -38,7 +38,7 @@ export async function run(encapsulateHandler: any, runHandler: any, options?: {
 
     const { encapsulate, freeze, CapsulePropertyTypes, makeImportStack, hoistSnapshot } = await CapsuleSpineFactory({
         spineFilesystemRoot,
-        capsuleModuleProjectionRoot: (import.meta as any).dir,
+        capsuleModuleProjectionRoot: options?.importMeta?.dir!,
         enableCallerStackInference: true,
         spineContracts: {
             ['#' + CapsuleSpineContract['#']]: CapsuleSpineContract