ultra-builder-pro-cli 0.24.1 → 0.25.0

package/mcp-server/lib/artifact-registry.cjs

@@ -17,6 +17,12 @@ const ENDPOINT_TYPES = new Set([
 ]);
 const OWNER_TYPES = new Set(['project', 'baseline', 'change', 'task', 'workflow']);
 const STATUSES = new Set(['current', 'stale', 'terminal', 'archived']);
+const ARTIFACT_INPUT_FIELDS = new Set([
+  'id', 'owner_type', 'owner_id', 'change_id', 'task_id', 'kind', 'path',
+  'content_digest', 'expected_before_digest', 'source_refs', 'consumer_refs',
+  'provenance', 'metadata', 'status',
+]);
+const DIGEST = /^[0-9a-f]{64}$/;
 const OWNER_TABLES = Object.freeze({
   baseline: 'baselines',
   change: 'changes',
@@ -48,6 +54,70 @@ class ArtifactRegistryError extends Error {
   }
 }
 
+function artifactText(value, field, { optional = false, nullable = false } = {}) {
+  if (value === undefined && optional) return undefined;
+  if (value === null && nullable) return null;
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new ArtifactRegistryError(
+      'VALIDATION_ERROR',
+      `${field} must be a non-empty string${nullable ? ' or null' : ''}`,
+    );
+  }
+  return value.trim();
+}
+
+function artifactDigest(value, field, { nullable = false } = {}) {
+  if (value === undefined) return undefined;
+  if (value === null && nullable) return null;
+  if (typeof value !== 'string' || !DIGEST.test(value)) {
+    throw new ArtifactRegistryError(
+      'VALIDATION_ERROR',
+      `${field} must be a lowercase SHA-256 digest${nullable ? ' or null' : ''}`,
+    );
+  }
+  return value;
+}
+
+function assertJsonValue(value, field, seen = new Set()) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return;
+  if (typeof value === 'number') {
+    if (Number.isFinite(value)) return;
+    throw new ArtifactRegistryError('VALIDATION_ERROR', `${field} must contain valid JSON values`);
+  }
+  if (typeof value !== 'object') {
+    throw new ArtifactRegistryError('VALIDATION_ERROR', `${field} must contain valid JSON values`);
+  }
+  if (seen.has(value)) {
+    throw new ArtifactRegistryError('VALIDATION_ERROR', `${field} must not contain circular references`);
+  }
+  if (!Array.isArray(value)) {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new ArtifactRegistryError(
+        'VALIDATION_ERROR', `${field} must contain only JSON objects`,
+      );
+    }
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertJsonValue(item, `${field}[${index}]`, seen));
+  } else {
+    Object.entries(value).forEach(([key, item]) => (
+      assertJsonValue(item, `${field}.${key}`, seen)
+    ));
+  }
+  seen.delete(value);
+}
+
+function normalizeJsonObject(value, field) {
+  if (value === undefined) return {};
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new ArtifactRegistryError('VALIDATION_ERROR', `${field} must be a JSON object`);
+  }
+  assertJsonValue(value, field);
+  return JSON.parse(JSON.stringify(value));
+}
+
 function parseJson(value, fallback) {
   if (value == null || value === '') return fallback;
   try { return JSON.parse(value); } catch { return fallback; }
@@ -302,6 +372,13 @@ function normalizeEndpoint(endpoint, field) {
   if (!endpoint || typeof endpoint !== 'object' || Array.isArray(endpoint)) {
     throw new ArtifactRegistryError('VALIDATION_ERROR', `${field} must be an object`);
   }
+  const unknown = Object.keys(endpoint)
+    .filter((key) => !['type', 'id', 'relation'].includes(key));
+  if (unknown.length > 0) {
+    throw new ArtifactRegistryError(
+      'VALIDATION_ERROR', `${field}.${unknown[0]} is not allowed`,
+    );
+  }
   const type = typeof endpoint.type === 'string' ? endpoint.type.trim() : '';
   const id = typeof endpoint.id === 'string' ? endpoint.id.trim() : '';
   const relation = typeof endpoint.relation === 'string' ? endpoint.relation.trim() : '';
@@ -313,6 +390,59 @@ function normalizeEndpoint(endpoint, field) {
   return { type, id, relation };
 }
 
+function normalizeArtifactInput(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new ArtifactRegistryError('VALIDATION_ERROR', 'artifact input is required');
+  }
+  const unknown = Object.keys(input).filter((field) => !ARTIFACT_INPUT_FIELDS.has(field));
+  if (unknown.length > 0) {
+    throw new ArtifactRegistryError(
+      'VALIDATION_ERROR', `artifact.${unknown[0]} is not allowed`,
+    );
+  }
+  const status = input.status === undefined
+    ? 'current'
+    : artifactText(input.status, 'artifact.status');
+  if (!STATUSES.has(status)) {
+    throw new ArtifactRegistryError('VALIDATION_ERROR', `invalid artifact status: ${status}`);
+  }
+  const normalizeRefs = (value, field) => {
+    if (value === undefined) return [];
+    if (!Array.isArray(value)) {
+      throw new ArtifactRegistryError('VALIDATION_ERROR', `${field} must be an array`);
+    }
+    return value.map((item, index) => normalizeEndpoint(item, `${field}[${index}]`));
+  };
+  return {
+    id: artifactText(input.id, 'artifact.id', { optional: true }),
+    ownerType: artifactText(input.owner_type, 'artifact.owner_type'),
+    ownerId: artifactText(input.owner_id, 'artifact.owner_id'),
+    changeId: artifactText(
+      input.change_id,
+      'artifact.change_id',
+      { optional: true, nullable: true },
+    ),
+    taskId: artifactText(
+      input.task_id,
+      'artifact.task_id',
+      { optional: true, nullable: true },
+    ),
+    kind: artifactText(input.kind, 'artifact.kind'),
+    path: artifactText(input.path, 'artifact.path'),
+    status,
+    contentDigest: artifactDigest(input.content_digest, 'artifact.content_digest'),
+    expectedBeforeDigest: artifactDigest(
+      input.expected_before_digest,
+      'artifact.expected_before_digest',
+      { nullable: true },
+    ),
+    sourceRefs: normalizeRefs(input.source_refs, 'artifact.source_refs'),
+    consumerRefs: normalizeRefs(input.consumer_refs, 'artifact.consumer_refs'),
+    provenance: normalizeJsonObject(input.provenance, 'artifact.provenance'),
+    metadata: normalizeJsonObject(input.metadata, 'artifact.metadata'),
+  };
+}
+
 function assertEndpoint(db, endpoint, field) {
   const normalized = normalizeEndpoint(endpoint, field);
   const { type, id } = normalized;
@@ -339,6 +469,34 @@ function assertOwner(db, ownerType, ownerId) {
   }
 }
 
+function assertArtifactOwner(db, ownerType, ownerId) {
+  assertOwner(db, ownerType, ownerId);
+}
+
+function assertDeclaredOwnerRefs(db, normalized) {
+  const expectedTaskId = normalized.ownerType === 'task' ? normalized.ownerId : null;
+  const expectedChangeId = normalized.ownerType === 'change'
+    ? normalized.ownerId
+    : normalized.ownerType === 'task'
+      ? db.prepare('SELECT change_id FROM tasks WHERE id = ?').get(normalized.ownerId)?.change_id || null
+      : normalized.ownerType === 'workflow'
+        ? db.prepare('SELECT change_id FROM workflow_runs WHERE id = ?').get(normalized.ownerId)?.change_id || null
+        : null;
+  for (const [field, supplied, expected] of [
+    ['change_id', normalized.changeId, expectedChangeId],
+    ['task_id', normalized.taskId, expectedTaskId],
+  ]) {
+    if (supplied !== undefined && supplied !== expected) {
+      throw new ArtifactRegistryError(
+        'ARTIFACT_AUTHORITY_CONFLICT',
+        `artifact ${field} does not match its owner authority`,
+        { field, supplied, expected },
+      );
+    }
+  }
+  return { changeId: expectedChangeId, taskId: expectedTaskId };
+}
+
 function edgesForArtifact(db, artifactId) {
   const sources = db.prepare(
     `SELECT source_type AS type, source_id AS id, relation
@@ -473,6 +631,13 @@ function invalidateConsumersFromEndpointInTx(db, start, {
     const key = endpointKey(endpoint);
     if (seen.has(key) || excluded.has(key) || key === endpointKey(start)) continue;
     seen.add(key);
+    if (endpoint.type === 'workflow') {
+      // Workflow rows are retained only as pre-v0.24 audit history. Preserve
+      // graph traversal for downstream current authorities, but never rewrite
+      // the historical workflow row or claim that it was invalidated.
+      queue.push(...outgoingEdges(db, endpoint));
+      continue;
+    }
     invalidated.push({ type: endpoint.type, id: endpoint.id });
     if (endpoint.type === 'artifact') {
       const row = db.prepare('SELECT status FROM artifacts WHERE id = ?').get(endpoint.id);
@@ -503,62 +668,6 @@ function invalidateConsumersFromEndpointInTx(db, start, {
         });
       }
     }
-    if (endpoint.type === 'workflow') {
-      const row = db.prepare(
-        'SELECT status, metadata_json, change_id, task_id FROM workflow_runs WHERE id = ?',
-      ).get(endpoint.id);
-      if (row) {
-        const metadata = parseJson(row.metadata_json, {});
-        if (['active', 'blocked', 'ready'].includes(row.status)) {
-          delete metadata.authority_invalidation;
-          metadata.draft_dirty = true;
-          db.prepare(
-            `UPDATE workflow_runs
-             SET status = CASE WHEN status = 'ready' THEN 'active' ELSE status END,
-                 metadata_json = ?,
-                 updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-             WHERE id = ?`,
-          ).run(JSON.stringify(metadata), endpoint.id);
-          ops.appendEventInTx(db, {
-            type: 'workflow_draft_changed',
-            change_id: row.change_id,
-            task_id: row.task_id,
-            payload: {
-              workflow_id: endpoint.id,
-              source_type: start.type,
-              source_id: start.id,
-              reason,
-            },
-          });
-          queue.push(...outgoingEdges(db, endpoint));
-          continue;
-        }
-        if (metadata.authority_invalidation?.invalidated !== true) {
-          metadata.authority_invalidation = {
-            invalidated: true,
-            source_type: start.type,
-            source_id: start.id,
-            reason,
-            invalidated_at: new Date().toISOString(),
-          };
-          db.prepare(
-            `UPDATE workflow_runs SET metadata_json = ?,
-             updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?`,
-          ).run(JSON.stringify(metadata), endpoint.id);
-          ops.appendEventInTx(db, {
-            type: 'workflow_invalidated',
-            change_id: row.change_id,
-            task_id: row.task_id,
-            payload: {
-              workflow_id: endpoint.id,
-              source_type: start.type,
-              source_id: start.id,
-              reason,
-            },
-          });
-        }
-      }
-    }
     queue.push(...outgoingEdges(db, endpoint));
   }
   return invalidated;
@@ -576,28 +685,20 @@ function invalidateDownstreamInTx(db, artifactId, priorConsumers = []) {
 }
 
 function preflightArtifactPublication(db, input, { rootDir = process.cwd() } = {}) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new ArtifactRegistryError('VALIDATION_ERROR', 'artifact input is required');
-  }
-  const ownerType = typeof input.owner_type === 'string' ? input.owner_type.trim() : '';
-  const ownerId = typeof input.owner_id === 'string' ? input.owner_id.trim() : '';
-  const kind = typeof input.kind === 'string' ? input.kind.trim() : '';
-  const status = input.status || 'current';
-  if (!kind || !STATUSES.has(status)) {
-    throw new ArtifactRegistryError(
-      'VALIDATION_ERROR', 'artifact kind and valid status are required',
-    );
-  }
+  const normalized = normalizeArtifactInput(input);
+  const {
+    ownerType, ownerId, kind, status,
+  } = normalized;
   assertOwner(db, ownerType, ownerId);
-  const resolved = resolveArtifactFile(rootDir, input.path);
+  assertDeclaredOwnerRefs(db, normalized);
+  const resolved = resolveArtifactFile(rootDir, normalized.path);
   if (isExemptArtifactPath(resolved.relative) || isGeneratedProjectionPath(resolved.relative)) {
     throw new ArtifactRegistryError(
       'ARTIFACT_PATH_EXEMPT',
       `runtime, scratch, and generated projection paths are not registry authority: ${resolved.relative}`,
     );
   }
-  const explicitId = typeof input.id === 'string' && input.id.trim() !== ''
-    ? input.id.trim() : null;
+  const explicitId = normalized.id || null;
   const existingById = explicitId
     ? db.prepare('SELECT * FROM artifacts WHERE id = ?').get(explicitId)
     : null;
@@ -674,18 +775,14 @@ function preflightArtifactPublication(db, input, { rootDir = process.cwd() } = {
 }
 
 function recordArtifactInTx(db, input, { rootDir = process.cwd() } = {}) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) {
-    throw new ArtifactRegistryError('VALIDATION_ERROR', 'artifact input is required');
-  }
-  const ownerType = typeof input.owner_type === 'string' ? input.owner_type.trim() : '';
-  const ownerId = typeof input.owner_id === 'string' ? input.owner_id.trim() : '';
-  const kind = typeof input.kind === 'string' ? input.kind.trim() : '';
-  const status = input.status || 'current';
-  if (!kind || !STATUSES.has(status)) {
-    throw new ArtifactRegistryError('VALIDATION_ERROR', 'artifact kind and valid status are required');
-  }
+  const normalized = normalizeArtifactInput(input);
+  const {
+    ownerType, ownerId, kind, status,
+    sourceRefs, consumerRefs, provenance, metadata,
+  } = normalized;
   assertOwner(db, ownerType, ownerId);
-  const resolved = resolveArtifactFile(rootDir, input.path);
+  const ownerRefs = assertDeclaredOwnerRefs(db, normalized);
+  const resolved = resolveArtifactFile(rootDir, normalized.path);
   if (isExemptArtifactPath(resolved.relative) || isGeneratedProjectionPath(resolved.relative)) {
     throw new ArtifactRegistryError(
       'ARTIFACT_PATH_EXEMPT',
@@ -694,18 +791,7 @@ function recordArtifactInTx(db, input, { rootDir = process.cwd() } = {}) {
   }
   const stableRead = openStableArtifactRead(resolved);
   try {
-  const sourceRefs = Array.isArray(input.source_refs)
-    ? input.source_refs.map((item, index) => normalizeEndpoint(item, `source_refs[${index}]`))
-    : [];
-  const consumerRefs = Array.isArray(input.consumer_refs)
-    ? input.consumer_refs.map((item, index) => normalizeEndpoint(item, `consumer_refs[${index}]`))
-    : [];
-  const provenance = input.provenance && typeof input.provenance === 'object'
-    && !Array.isArray(input.provenance) ? input.provenance : {};
-  const metadata = input.metadata && typeof input.metadata === 'object'
-    && !Array.isArray(input.metadata) ? input.metadata : {};
-  const explicitId = typeof input.id === 'string' && input.id.trim() !== ''
-    ? input.id.trim() : null;
+  const explicitId = normalized.id || null;
   const existingById = explicitId
     ? db.prepare('SELECT * FROM artifacts WHERE id = ?').get(explicitId)
     : null;
@@ -759,31 +845,25 @@ function recordArtifactInTx(db, input, { rootDir = process.cwd() } = {}) {
     });
   }
   const beforeDigest = existing?.digest || existing?.content_hash || null;
-  if (input.expected_before_digest !== undefined
-    && input.expected_before_digest !== beforeDigest) {
+  if (normalized.expectedBeforeDigest !== undefined
+    && normalized.expectedBeforeDigest !== beforeDigest) {
     throw new ArtifactRegistryError(
       'ARTIFACT_DIGEST_CONFLICT',
       `artifact ${artifactId} changed since it was read`,
-      { expected: input.expected_before_digest, actual: beforeDigest },
+      { expected: normalized.expectedBeforeDigest, actual: beforeDigest },
     );
   }
   const afterDigest = stableRead.digest;
-  if (input.content_digest !== undefined && input.content_digest !== afterDigest) {
+  if (normalized.contentDigest !== undefined && normalized.contentDigest !== afterDigest) {
     throw new ArtifactRegistryError(
       'ARTIFACT_DIGEST_CONFLICT',
       `artifact bytes do not match the supplied digest: ${resolved.relative}`,
-      { expected: input.content_digest, actual: afterDigest },
+      { expected: normalized.contentDigest, actual: afterDigest },
     );
   }
   const changed = beforeDigest !== afterDigest;
   const priorConsumers = existing ? edgesForArtifact(db, artifactId).consumers : [];
-  const ownerChangeId = ownerType === 'change'
-    ? ownerId
-    : ownerType === 'task'
-      ? db.prepare('SELECT change_id FROM tasks WHERE id = ?').get(ownerId)?.change_id || null
-      : ownerType === 'workflow'
-        ? db.prepare('SELECT change_id FROM workflow_runs WHERE id = ?').get(ownerId)?.change_id || null
-        : null;
+  const ownerChangeId = ownerRefs.changeId;
   const now = new Date().toISOString();
   let invalidated = [];
   db.prepare(
@@ -803,7 +883,7 @@ function recordArtifactInTx(db, input, { rootDir = process.cwd() } = {}) {
   ).run(
     artifactId, ownerType, ownerId,
     ownerChangeId,
-    ownerType === 'task' ? ownerId : null,
+    ownerRefs.taskId,
     kind, resolved.relative, afterDigest, afterDigest, beforeDigest, afterDigest,
     JSON.stringify(provenance), JSON.stringify(metadata), status,
     existing?.created_at || now, now,
@@ -1134,6 +1214,7 @@ module.exports = {
   ENDPOINT_TYPES,
   OWNER_TYPES,
   STATUSES,
+  assertArtifactOwner,
   digestFile,
   getArtifact,
   inspectArtifactHealth,