fix: allocate share-link layer tokens without collisions

scripts/check-layer-state-tokens.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import {
+  LAYER_STATE_TOKEN_RESERVATIONS,
+  parseLayerStateTokenReservations,
+  validateLayerStateAllocations,
+  validateLayerStateRegistry,
+} from '../src/data/layerState.js';
+
+// The pre-ledger main revision had exactly the 28 pinned v2 registry entries.
+// Accept only that source blob as the one-time bootstrap; any other published
+// source without a ledger must fail closed rather than risk losing a token.
+const PRE_LEDGER_LAYER_STATE_BLOB = 'e559a4c40191512dcefb83134958a3bfd4a98a69';
+// This snapshot belongs to the verified published blob above, not to the PR's
+// editable legacy map. Otherwise a candidate could redefine both its ledger
+// and its comparison baseline before the first ledger reaches main.
+export const PRE_LEDGER_LAYER_STATE_TOKENS = Object.freeze({
+  'ais-live-vessels': 'a',
+  'alpr-cameras': 'p',
+  'bhote-koshi-2026': 'h',
+  'bhote-koshi-locator': 'z',
+  bikeshare: 'b',
+  cctv: 'c',
+  directions: 'n',
+  earthquakes: 'e',
+  'fire-perimeters': '2',
+  flights: 'f',
+  'local-dams': 'q',
+  'local-datacenters': 'd',
+  'local-firms': 'w',
+  military: 'm',
+  'military-awareness': 'g',
+  'military-installations': 'i',
+  radio: 'r',
+  'recent-imagery': '1',
+  'rocket-launches': 'x',
+  satellites: 's',
+  'telegeography-submarine-cables': 'u',
+  traffic: 't',
+  transit: 'j',
+  'weather-cyclones': 'y',
+  'weather-lightning': 'l',
+  'weather-radar': 'v',
+  'weather-satellite': 'o',
+  wind: 'k',
+});
+const LEDGER_PATH = 'src/data/layerStateTokenReservations.json';
+const SOURCE_PATH = 'src/data/layerState.js';
+
+function git(args, cwd) {
+  return execFileSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  }).trim();
+}
+
+/** Read every permanent assignment from a published Git revision. */
+export function readPublishedLayerStateReservations(
+  baseRef,
+  cwd = process.cwd(),
+) {
+  const commit = git(
+    ['rev-parse', '--verify', '--end-of-options', `${baseRef}^{commit}`],
+    cwd,
+  );
+  const ledgerSpec = `${commit}:${LEDGER_PATH}`;
+  let hasLedger = true;
+  try {
+    git(['cat-file', '-e', ledgerSpec], cwd);
+  } catch {
+    hasLedger = false;
+  }
+  if (!hasLedger) {
+    const sourceBlob = git(['rev-parse', `${commit}:${SOURCE_PATH}`], cwd);
+    if (sourceBlob !== PRE_LEDGER_LAYER_STATE_BLOB) {
+      throw new Error(
+        'Published base has no recognizable layer-state token ledger',
+      );
+    }
+    return PRE_LEDGER_LAYER_STATE_TOKENS;
+  }
+  let rows;
+  try {
+    rows = JSON.parse(git(['show', ledgerSpec], cwd));
+  } catch (error) {
+    throw new Error(
+      `Cannot read published layer-state token ledger: ${error.message}`,
+    );
+  }
+  return parseLayerStateTokenReservations(rows);
+}
+
+export function checkLayerStateTokens(baseRef, cwd = process.cwd()) {
+  const base = readPublishedLayerStateReservations(baseRef, cwd);
+  validateLayerStateRegistry();
+  validateLayerStateAllocations(base, LAYER_STATE_TOKEN_RESERVATIONS);
+  return {
+    published: Object.keys(base).length,
+    added:
+      Object.keys(LAYER_STATE_TOKEN_RESERVATIONS).length -
+      Object.keys(base).length,
+  };
+}
+
+const invokedPath = process.argv[1]
+  ? pathToFileURL(path.resolve(process.argv[1])).href
+  : '';
+if (import.meta.url === invokedPath) {
+  const args = process.argv.slice(2);
+  const baseRef =
+    args[0] === '--base-ref' && args.length === 2 ? args[1] : null;
+  if (!baseRef || baseRef.startsWith('-')) {
+    console.error('Usage: npm run layer-token:check -- --base-ref origin/main');
+    process.exitCode = 1;
+  } else {
+    try {
+      const result = checkLayerStateTokens(baseRef);
+      console.log(
+        `Layer tokens valid against ${baseRef}: ${result.published} published, ` +
+          `${result.added} new.`,
+      );
+    } catch (error) {
+      console.error(`Layer token check failed: ${error.message}`);
+      process.exitCode = 1;
+    }
+  }
+}