quixos-protocol/src/capability-language/candidate-check.ts

import fs from "node:fs/promises";
import path from "node:path";
import os from "node:os";
import { execFile as execFileCallback } from "node:child_process";
import { promisify } from "node:util";
import { createHash } from "node:crypto";
import { compileWorkspaceRepository, compileCapabilityResourceRepository } from "./assembly.js";
import { createGitCapabilityResolver } from "./git-resolver.js";
import {
  contentDigest,
  planEvolution,
  type EvolutionReview,
  type WorkspaceRevision,
} from "../capability-model/index.js";
import { bindingSchema } from "../bindings/index.js";
import { snapshotCommit, checkoutCommit, buildCheckedPackage } from "./checked-build.js";
const execFile = promisify(execFileCallback);
const bytesDigest = (value: Uint8Array) => `sha256:${createHash("sha256").update(value).digest("hex")}`;

export const localResourceSnapshots = async (
  root: string,
  filename?: string,
): Promise<{ resources: { kind: string; repository: string; commit: string; directory: string }[] }> => {
  if (filename) {
    const document = JSON.parse(await fs.readFile(filename, "utf8"));
    return {
      resources: document.resources.map((entry: { directory: string }) => ({
        ...entry,
        directory: path.resolve(path.dirname(filename), entry.directory),
      })),
    };
  }
  let directory = await fs.realpath(root);
  for (;;) {
    let graphText: string | undefined;
    try {
      graphText = await fs.readFile(path.join(directory, ".quixos/resource-graph.json"), "utf8");
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
    }
    if (graphText !== undefined) {
      const graph = JSON.parse(graphText);
      const resources = [];
      for (const entry of graph.resources) {
        const location = await fs.realpath(path.resolve(directory, entry.directory));
        if (!location.startsWith(`${directory}/resources/`))
          throw new Error("Workbench resource escapes managed directory");
        resources.push({ kind: entry.kind, ...entry.source, directory: location });
      }
      return { resources };
    }
    const parent = path.dirname(directory);
    if (parent === directory) return { resources: [] };
    directory = parent;
  }
};

/** Copy actual authoring files without snapshotting jj or creating a Git commit. */
export const snapshotRepository = async (source: string, destination: string) => {
  const root = await fs.realpath(source);
  const files = async () =>
    (
      await execFile("git", ["-C", root, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
        maxBuffer: 16 * 1024 * 1024,
      })
    ).stdout
      .split("\0")
      .filter(Boolean)
      .sort();
  const names = [...new Set(await files())];
  if (names.length > 50_000) throw new Error("Candidate source exceeds 50000 files");
  const contents: { name: string; digest: string; mode: number }[] = [];
  let bytes = 0;
  await fs.mkdir(destination, { recursive: true, mode: 0o700 });
  for (const name of names) {
    if (path.isAbsolute(name) || name.split(/[\\/]/).some((part) => part === ".." || part === ".git" || part === ".jj"))
      throw new Error("Invalid candidate source path");
    const file = path.join(root, name);
    let metadata;
    try {
      metadata = await fs.lstat(file);
    } catch (error) {
      if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
      throw error;
    }
    if (!metadata.isFile() || metadata.isSymbolicLink() || !(await fs.realpath(file)).startsWith(`${root}${path.sep}`))
      throw new Error(`Candidate source must be a regular file: ${name}`);
    const data = await fs.readFile(file);
    bytes += data.length;
    if (bytes > 128 * 1024 * 1024) throw new Error("Candidate source exceeds 128 MiB");
    contents.push({ name, digest: bytesDigest(data), mode: metadata.mode & 0o777 });
    await fs.mkdir(path.dirname(path.join(destination, name)), { recursive: true });
    await fs.writeFile(path.join(destination, name), data, { flag: "wx", mode: metadata.mode & 0o777 });
  }
  if (JSON.stringify([...new Set(await files())]) !== JSON.stringify(names))
    throw new Error("Source files changed during candidate snapshot");
  for (const entry of contents)
    if (bytesDigest(await fs.readFile(path.join(root, entry.name))) !== entry.digest)
      throw new Error(`Source changed during candidate snapshot: ${entry.name}`);
  return { source: root, directory: destination, treeDigest: contentDigest(contents), files: contents };
};

// Local mirrors accelerate resolution, but only their committed locked trees
// may stand in for published dependencies. Never relabel dirty files as a pin.
async function committedResolver(root: string, temporary: string, filename?: string, publishedOnly = false) {
  const map = publishedOnly ? { resources: [] } : await localResourceSnapshots(root, filename);
  const resources = [];
  for (const [index, entry] of map.resources.entries()) {
    const directory = path.join(temporary, `dependency-${index}`);
    await checkoutCommit(entry.directory, entry.commit, directory);
    resources.push({ ...entry, directory });
  }
  const snapshotMap = path.join(temporary, "snapshots.json");
  await fs.writeFile(snapshotMap, JSON.stringify({ resources }));
  return createGitCapabilityResolver({ checkoutRoot: path.join(temporary, "resolved"), snapshotMap });
}

export const checkResourceCandidate = async (options: {
  root: string;
  output: string;
  kind: "package" | "interface";
  source: { repository: string; commit: string };
  snapshotMap?: string;
  publishedOnly?: boolean;
}) => {
  await fs.mkdir(options.output, { mode: 0o700 });
  const temporary = await fs.mkdtemp(path.join(os.tmpdir(), "qx-resource-check-"));
  const blockers: string[] = [];
  let treeDigest: string | undefined, commit: string | undefined, artifactPath: string | undefined;
  try {
    commit = await snapshotCommit(options.root);
    treeDigest = (await snapshotRepository(options.root, path.join(temporary, "observed"))).treeDigest;
    const root = path.join(temporary, "source");
    await checkoutCommit(options.root, commit, root);
    const resolveResource = await committedResolver(
      options.root,
      temporary,
      options.snapshotMap,
      options.publishedOnly,
    );
    const compiled = await compileCapabilityResourceRepository({
      rootDirectory: root,
      kind: options.kind,
      source: { resolver: "git", repository: options.source.repository, commit },
      resolveResource,
    });
    if (compiled.resource.kind === "package") {
      const schema = path.join(temporary, "bindings.json");
      await fs.writeFile(schema, JSON.stringify(bindingSchema(compiled)));
      artifactPath = await buildCheckedPackage(root, schema, compiled.resource.revision.revisionId);
    }
    if ((await snapshotCommit(options.root)) !== commit)
      throw new Error("Source changed during verification; run the check again");
    await fs.writeFile(path.join(options.output, "candidate.json"), JSON.stringify(compiled.resource, null, 2));
  } catch (error) {
    blockers.push(error instanceof Error ? error.message : String(error));
  } finally {
    await fs.rm(temporary, { recursive: true, force: true });
  }
  const result = {
    candidateOnly: true,
    activationEvidence: false,
    commit,
    treeDigest,
    artifactPath,
    blockers,
    note: "Checked immutable candidate; cutover independently checks current migration/review requirements. No publication or activation performed.",
  };
  await fs.writeFile(path.join(options.output, "report.json"), JSON.stringify(result, null, 2));
  return result;
};

export const checkWorkspaceCandidate = async (options: {
  root: string;
  output: string;
  snapshotMap?: string;
  baseline?: string;
  reviews?: string;
}) => {
  await fs.mkdir(options.output, { mode: 0o700 });
  const temporary = await fs.mkdtemp(path.join(os.tmpdir(), "qx-workspace-check-"));
  const blockers: string[] = [],
    checks: { packageRevisionId: string; artifactPath: string }[] = [];
  let commit: string | undefined;
  try {
    commit = await snapshotCommit(options.root);
    for (const entry of (await localResourceSnapshots(options.root, options.snapshotMap)).resources) {
      const current = await snapshotCommit(entry.directory);
      const tree = async (revision: string) =>
        (await execFile("git", ["rev-parse", `${revision}^{tree}`], { cwd: entry.directory })).stdout.trim();
      if ((await tree(current)) !== (await tree(entry.commit)))
        throw new Error(
          `Edited resource is not in the root's locked candidate: ${entry.directory}. Check that resource, then run qx-workspace resource upgrade --publish to propagate its revision.`,
        );
    }
    const root = path.join(temporary, "source");
    await checkoutCommit(options.root, commit, root);
    const resolveResource = await committedResolver(options.root, temporary, options.snapshotMap);
    const compiled = await compileWorkspaceRepository({
      rootDirectory: root,
      sourceRootCommit: commit,
      resolveResource,
    });
    const baseline = options.baseline
      ? (JSON.parse(await fs.readFile(options.baseline, "utf8")) as WorkspaceRevision)
      : null;
    const reviews = options.reviews
      ? (JSON.parse(await fs.readFile(options.reviews, "utf8")) as EvolutionReview[])
      : [];
    const evolution = planEvolution(baseline, compiled.workspace, { reviews });
    blockers.push(...evolution.blockers);
    for (const resource of compiled.resources.filter((entry) => entry.kind === "package")) {
      // Per-package recursive schema, identical to host activation, not unrelated
      // workspace declarations that would unnecessarily invalidate build caches.
      const candidate = await compileCapabilityResourceRepository({
        rootDirectory: resource.directory,
        kind: "package",
        source: resource.source,
        resolveResource,
      });
      const schema = path.join(temporary, "bindings.json");
      await fs.writeFile(schema, JSON.stringify(bindingSchema(candidate)));
      const artifactPath = await buildCheckedPackage(
        resource.directory,
        schema,
        candidate.resource.revision.revisionId,
      );
      checks.push({ packageRevisionId: candidate.resource.revision.revisionId, artifactPath });
    }
    if ((await snapshotCommit(options.root)) !== commit)
      throw new Error("Source changed during verification; run the check again");
    const result = {
      schemaVersion: 1,
      candidateOnly: true,
      activationEvidence: false,
      commit,
      evolution,
      checks,
      blockers,
      note: "Checks the committed root and its exact locked dependencies. Resource edits must be verified and repinned before they enter this candidate. No publication or activation performed.",
    };
    await fs.writeFile(path.join(options.output, "candidate.json"), JSON.stringify(compiled.workspace, null, 2));
    await fs.writeFile(path.join(options.output, "report.json"), JSON.stringify(result, null, 2));
    return result;
  } catch (error) {
    const result = {
      schemaVersion: 1,
      candidateOnly: true,
      activationEvidence: false,
      commit,
      checks,
      blockers: [...blockers, error instanceof Error ? error.message : String(error)],
    };
    await fs.writeFile(path.join(options.output, "report.json"), JSON.stringify(result, null, 2));
    return result;
  } finally {
    await fs.rm(temporary, { recursive: true, force: true });
  }
};