@angri450/zvec-grep 0.2.2

package/dist/authorization/store.d.ts

@@ -0,0 +1,20 @@
+import { type RemoteEmbeddingAuthorizationStatus, type RemoteEmbeddingTarget, type RemoteEmbeddingWorkspaceGrant } from "./types.js";
+export type RemoteEmbeddingAuthorizationStoreOptions = {
+    signingKeyPath?: string;
+};
+export declare class RemoteEmbeddingAuthorizationStore {
+    private readonly signingKeyPath;
+    constructor(options?: RemoteEmbeddingAuthorizationStoreOptions);
+    grantPath(target: Pick<RemoteEmbeddingTarget, "workspaceRoots">): string;
+    hasGrant(target: RemoteEmbeddingTarget): Promise<boolean>;
+    grant(target: RemoteEmbeddingTarget): Promise<RemoteEmbeddingWorkspaceGrant>;
+    revoke(target: RemoteEmbeddingTarget): Promise<boolean>;
+    revokeAll(root: string): Promise<number>;
+    status(root: string): Promise<RemoteEmbeddingAuthorizationStatus>;
+    private readDocument;
+    private writeDocument;
+    private withDocumentWrite;
+    private verifyGrant;
+    private readSigningKey;
+    private getOrCreateSigningKey;
+}

package/dist/authorization/store.js

@@ -0,0 +1,251 @@
+import { createHmac, randomBytes, randomUUID, timingSafeEqual, } from "node:crypto";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { readJsonFile, writeJsonFile } from "../engine/utils/json.js";
+import { acquireReadWriteLock } from "../engine/utils/lock.js";
+import { REMOTE_EMBEDDING_CAPABILITY, } from "./types.js";
+const DOCUMENT_VERSION = 1;
+const GRANT_FILE = "authorization.json";
+export class RemoteEmbeddingAuthorizationStore {
+    signingKeyPath;
+    constructor(options = {}) {
+        this.signingKeyPath = resolve(options.signingKeyPath ??
+            process.env.ZVEC_GREP_AUTHORIZATION_KEY_FILE ??
+            join(homedir(), ".zvec-grep", "authorization-signing.key"));
+    }
+    grantPath(target) {
+        const root = target.workspaceRoots[0];
+        if (!root) {
+            throw new Error("Remote Embedding target has no workspace roots.");
+        }
+        return join(root, ".zvec-grep", GRANT_FILE);
+    }
+    async hasGrant(target) {
+        const key = await this.readSigningKey();
+        if (!key)
+            return false;
+        const document = await this.readDocument(this.grantPath(target));
+        return document.grants.some((grant) => grant.targetFingerprint === target.targetFingerprint &&
+            this.verifyGrant(grant, key));
+    }
+    async grant(target) {
+        const key = await this.getOrCreateSigningKey();
+        const unsigned = {
+            version: DOCUMENT_VERSION,
+            id: randomUUID(),
+            capability: REMOTE_EMBEDDING_CAPABILITY,
+            scope: "workspace",
+            workspaceRoots: [...target.workspaceRoots],
+            workspaceFingerprint: target.workspaceFingerprint,
+            provider: target.provider,
+            model: target.model,
+            endpoint: target.endpoint,
+            targetFingerprint: target.targetFingerprint,
+            grantedAt: Date.now(),
+        };
+        const grant = {
+            ...unsigned,
+            signature: sign(unsigned, key),
+        };
+        for (const root of target.workspaceRoots) {
+            const path = join(root, ".zvec-grep", GRANT_FILE);
+            await this.withDocumentWrite(path, async (document) => {
+                const next = {
+                    version: DOCUMENT_VERSION,
+                    grants: [
+                        ...document.grants.filter((candidate) => candidate.targetFingerprint !== target.targetFingerprint),
+                        grant,
+                    ],
+                };
+                await this.writeDocument(path, next);
+            });
+        }
+        return grant;
+    }
+    async revoke(target) {
+        let revoked = false;
+        for (const root of target.workspaceRoots) {
+            const path = join(root, ".zvec-grep", GRANT_FILE);
+            await this.withDocumentWrite(path, async (document) => {
+                const grants = document.grants.filter((grant) => grant.targetFingerprint !== target.targetFingerprint);
+                if (grants.length === document.grants.length)
+                    return;
+                revoked = true;
+                await this.writeDocument(path, {
+                    version: DOCUMENT_VERSION,
+                    grants,
+                });
+            });
+        }
+        return revoked;
+    }
+    async revokeAll(root) {
+        const path = join(resolve(root), ".zvec-grep", GRANT_FILE);
+        let revoked = 0;
+        let validGrants = [];
+        const key = await this.readSigningKey();
+        await this.withDocumentWrite(path, async (document) => {
+            revoked = document.grants.length;
+            if (revoked === 0)
+                return;
+            validGrants = key
+                ? document.grants.filter((grant) => this.verifyGrant(grant, key))
+                : [];
+            await this.writeDocument(path, {
+                version: DOCUMENT_VERSION,
+                grants: [],
+            });
+        });
+        const fingerprintsByPath = new Map();
+        for (const grant of validGrants) {
+            for (const workspaceRoot of grant.workspaceRoots) {
+                const grantPath = join(workspaceRoot, ".zvec-grep", GRANT_FILE);
+                if (resolve(grantPath) === resolve(path))
+                    continue;
+                const fingerprints = fingerprintsByPath.get(grantPath) ?? new Set();
+                fingerprints.add(grant.targetFingerprint);
+                fingerprintsByPath.set(grantPath, fingerprints);
+            }
+        }
+        for (const [grantPath, fingerprints] of fingerprintsByPath) {
+            await this.withDocumentWrite(grantPath, async (document) => {
+                const grants = document.grants.filter((grant) => !fingerprints.has(grant.targetFingerprint));
+                if (grants.length === document.grants.length)
+                    return;
+                await this.writeDocument(grantPath, {
+                    version: DOCUMENT_VERSION,
+                    grants,
+                });
+            });
+        }
+        return revoked;
+    }
+    async status(root) {
+        const path = join(resolve(root), ".zvec-grep", GRANT_FILE);
+        const document = await this.readDocument(path);
+        const key = await this.readSigningKey();
+        return {
+            path,
+            grants: document.grants.map(({ signature, ...grant }) => ({
+                ...grant,
+                valid: key ? this.verifyGrant({ ...grant, signature }, key) : false,
+            })),
+        };
+    }
+    async readDocument(path) {
+        const value = await readJsonFile(path, {
+            version: DOCUMENT_VERSION,
+            grants: [],
+        });
+        if (!isAuthorizationDocument(value)) {
+            return { version: DOCUMENT_VERSION, grants: [] };
+        }
+        return value;
+    }
+    async writeDocument(path, document) {
+        await writeJsonFile(path, document, {
+            directoryMode: 0o700,
+            fileMode: 0o600,
+        });
+    }
+    async withDocumentWrite(path, operation) {
+        const lock = acquireReadWriteLock(join(dirname(path), "authorization-store"), "write", { operation: "remote-embedding-authorization" });
+        try {
+            return await operation(await this.readDocument(path));
+        }
+        finally {
+            lock.release();
+        }
+    }
+    verifyGrant(grant, key) {
+        const { signature, ...unsigned } = grant;
+        const expected = sign(unsigned, key);
+        const actualBytes = Buffer.from(signature, "hex");
+        const expectedBytes = Buffer.from(expected, "hex");
+        return (actualBytes.length === expectedBytes.length &&
+            timingSafeEqual(actualBytes, expectedBytes));
+    }
+    async readSigningKey() {
+        try {
+            const value = (await readFile(this.signingKeyPath, "utf8")).trim();
+            return value ? Buffer.from(value, "hex") : undefined;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async getOrCreateSigningKey() {
+        const existing = await this.readSigningKey();
+        if (existing)
+            return existing;
+        await mkdir(dirname(this.signingKeyPath), { recursive: true, mode: 0o700 });
+        await chmod(dirname(this.signingKeyPath), 0o700);
+        const key = randomBytes(32);
+        try {
+            await writeFile(this.signingKeyPath, key.toString("hex"), {
+                encoding: "utf8",
+                mode: 0o600,
+                flag: "wx",
+            });
+            return key;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const concurrent = await this.readSigningKey();
+            if (!concurrent)
+                throw error;
+            return concurrent;
+        }
+    }
+}
+function sign(value, key) {
+    return createHmac("sha256", key).update(stableStringify(value)).digest("hex");
+}
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function isAuthorizationDocument(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const document = value;
+    if (document.version !== DOCUMENT_VERSION ||
+        !Array.isArray(document.grants)) {
+        return false;
+    }
+    return document.grants.every(isWorkspaceGrant);
+}
+function isWorkspaceGrant(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const grant = value;
+    return (grant.version === DOCUMENT_VERSION &&
+        grant.capability === REMOTE_EMBEDDING_CAPABILITY &&
+        grant.scope === "workspace" &&
+        Array.isArray(grant.workspaceRoots) &&
+        grant.workspaceRoots.every((root) => typeof root === "string") &&
+        [
+            "id",
+            "workspaceFingerprint",
+            "provider",
+            "model",
+            "endpoint",
+            "targetFingerprint",
+            "signature",
+        ].every((key) => typeof grant[key] === "string") &&
+        typeof grant.grantedAt === "number");
+}
+//# sourceMappingURL=store.js.map

package/dist/authorization/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/authorization/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,2BAA2B,GAK5B,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,CAAU,CAAC;AACpC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAMxC,MAAM,OAAO,iCAAiC;IAC3B,cAAc,CAAS;IAExC,YAAY,UAAoD,EAAE;QAChE,IAAI,CAAC,cAAc,GAAG,OAAO,CAC3B,OAAO,CAAC,cAAc;YACpB,OAAO,CAAC,GAAG,CAAC,gCAAgC;YAC5C,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,MAAqD;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAA6B;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;YACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAA6B;QAE7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,gBAAgB;YACzB,EAAE,EAAE,UAAU,EAAE;YAChB,UAAU,EAAE,2BAA2B;YACvC,KAAK,EAAE,WAAoB;YAC3B,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;YAC1C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,KAAK,GAAkC;YAC3C,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC/B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,IAAI,GAAyC;oBACjD,OAAO,EAAE,gBAAgB;oBACzB,MAAM,EAAE;wBACN,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACvB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,CAC3D;wBACD,KAAK;qBACN;iBACF,CAAC;gBACF,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA6B;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,CAChE,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO;gBACrD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,WAAW,GAAoC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpD,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YACjC,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO;YAC1B,WAAW,GAAG,GAAG;gBACf,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;gBAC7B,OAAO,EAAE,gBAAgB;gBACzB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACjD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACpE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CACtD,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO;gBACrD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;oBAClC,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,GAAG,KAAK;gBACR,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK;aACpE,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAU,IAAI,EAAE;YAC9C,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,IAAY,EACZ,QAA8C;QAE9C,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE;YAClC,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,IAAY,EACZ,SAAyE;QAEzE,MAAM,IAAI,GAAG,oBAAoB,CAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,EAC1C,OAAO,EACP,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAChD,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,WAAW,CACjB,KAAoC,EACpC,GAAW;QAEX,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CACL,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;YAC3C,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBACxD,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU;gBAAE,MAAM,KAAK,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IACE,QAAQ,CAAC,OAAO,KAAK,gBAAgB;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACL,KAAK,CAAC,OAAO,KAAK,gBAAgB;QAClC,KAAK,CAAC,UAAU,KAAK,2BAA2B;QAChD,KAAK,CAAC,KAAK,KAAK,WAAW;QAC3B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC9D;YACE,IAAI;YACJ,sBAAsB;YACtB,UAAU;YACV,OAAO;YACP,UAAU;YACV,mBAAmB;YACnB,WAAW;SACZ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QAChD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC"}

package/dist/authorization/target.d.ts

@@ -0,0 +1,15 @@
+import type { RemoteEmbeddingTarget } from "./types.js";
+export declare function canonicalizeWorkspaceRoots(roots: readonly string[]): Promise<string[]>;
+export declare function workspaceFingerprint(roots: readonly string[]): string;
+export declare function remoteEmbeddingTargetFingerprint(input: {
+    workspaceFingerprint: string;
+    provider: string;
+    model: string;
+    endpoint: string;
+}): string;
+export declare function createRemoteEmbeddingTarget(input: {
+    roots: readonly string[];
+    provider: string;
+    model: string;
+    endpoint: string;
+}): Promise<RemoteEmbeddingTarget>;

package/dist/authorization/target.js

@@ -0,0 +1,49 @@
+import { createHash } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { resolve } from "node:path";
+export async function canonicalizeWorkspaceRoots(roots) {
+    const canonical = await Promise.all(roots.map(async (root) => {
+        const absolute = resolve(root);
+        return await realpath(absolute).catch(() => absolute);
+    }));
+    return [...new Set(canonical)].sort();
+}
+export function workspaceFingerprint(roots) {
+    return sha256(JSON.stringify([...roots]));
+}
+export function remoteEmbeddingTargetFingerprint(input) {
+    return sha256(JSON.stringify([
+        input.workspaceFingerprint,
+        input.provider,
+        input.model,
+        input.endpoint,
+    ]));
+}
+export async function createRemoteEmbeddingTarget(input) {
+    const workspaceRoots = await canonicalizeWorkspaceRoots(input.roots);
+    if (workspaceRoots.length === 0) {
+        throw new Error("Remote Embedding authorization requires a workspace root.");
+    }
+    const endpoint = input.endpoint.trim();
+    if (endpoint.length === 0) {
+        throw new Error("Remote Embedding authorization requires an endpoint.");
+    }
+    const rootFingerprint = workspaceFingerprint(workspaceRoots);
+    return {
+        workspaceRoots,
+        workspaceFingerprint: rootFingerprint,
+        provider: input.provider,
+        model: input.model,
+        endpoint,
+        targetFingerprint: remoteEmbeddingTargetFingerprint({
+            workspaceFingerprint: rootFingerprint,
+            provider: input.provider,
+            model: input.model,
+            endpoint,
+        }),
+    };
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+//# sourceMappingURL=target.js.map

package/dist/authorization/target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/authorization/target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAwB;IAExB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAKhD;IACC,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,QAAQ;KACf,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC7D,OAAO;QACL,cAAc;QACd,oBAAoB,EAAE,eAAe;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,iBAAiB,EAAE,gCAAgC,CAAC;YAClD,oBAAoB,EAAE,eAAe;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;SACT,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/authorization/types.d.ts

@@ -0,0 +1,61 @@
+export declare const REMOTE_EMBEDDING_CAPABILITY: "remote_embedding";
+export type RemoteEmbeddingAuthorizationScope = "once" | "workspace";
+export type RemoteEmbeddingOperation = "query" | "index" | "query_and_index";
+export type RemoteEmbeddingDataDisclosure = {
+    queryText: boolean;
+    workspaceContent: "none" | "selected" | "changed" | "full";
+};
+export type RemoteEmbeddingTarget = {
+    workspaceRoots: readonly string[];
+    workspaceFingerprint: string;
+    provider: string;
+    model: string;
+    endpoint: string;
+    targetFingerprint: string;
+};
+export type RemoteEmbeddingRequest = {
+    provider: string;
+    model: string;
+    endpoint: string;
+    purpose: "document" | "query";
+    contentKinds: readonly ("text" | "image")[];
+    contentCount: number;
+};
+export type RemoteEmbeddingAuthorizationPlan = {
+    operation: RemoteEmbeddingOperation;
+    target: RemoteEmbeddingTarget;
+    disclosure: RemoteEmbeddingDataDisclosure;
+    reason: "query" | "index_create" | "index_update" | "index_rebuild";
+    grantPath: string;
+};
+export type RemoteEmbeddingOperationPermit = {
+    capability: typeof REMOTE_EMBEDDING_CAPABILITY;
+    scope: RemoteEmbeddingAuthorizationScope;
+    target: RemoteEmbeddingTarget;
+    issuedAt: number;
+    operationId: string;
+};
+export type RemoteEmbeddingWorkspaceGrant = {
+    version: 1;
+    id: string;
+    capability: typeof REMOTE_EMBEDDING_CAPABILITY;
+    scope: "workspace";
+    workspaceRoots: string[];
+    workspaceFingerprint: string;
+    provider: string;
+    model: string;
+    endpoint: string;
+    targetFingerprint: string;
+    grantedAt: number;
+    signature: string;
+};
+export type RemoteEmbeddingAuthorizationDocument = {
+    version: 1;
+    grants: RemoteEmbeddingWorkspaceGrant[];
+};
+export type RemoteEmbeddingAuthorizationStatus = {
+    path: string;
+    grants: Array<Omit<RemoteEmbeddingWorkspaceGrant, "signature"> & {
+        valid: boolean;
+    }>;
+};

package/dist/authorization/types.js

@@ -0,0 +1,2 @@
+export const REMOTE_EMBEDDING_CAPABILITY = "remote_embedding";
+//# sourceMappingURL=types.js.map

package/dist/authorization/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAA2B,CAAC"}

package/dist/cli/args.d.ts

@@ -0,0 +1,6 @@
+import type { ParsedArgs } from "./types.js";
+export declare function compatibilityWarningForArgs(args: readonly string[]): string | undefined;
+export declare function parseArgs(args: readonly string[]): ParsedArgs;
+export declare function parseDevice(value: string): "auto" | "cpu" | "metal" | "vulkan" | "cuda";
+export declare function splitPathFilters(value: string): string[];
+export declare function parseModifiedTime(value: string, option: string): number;