@aria-cli/tools 1.0.19 → 1.0.33

package/dist/mcp/jsonrpc.js

@@ -0,0 +1,145 @@
+/**
+ * JSON-RPC 2.0 Client for MCP
+ *
+ * Handles newline-delimited JSON over stdio streams.
+ */
+import { EventEmitter } from "events";
+import { randomUUID } from "crypto";
+export class JSONRPCClient extends EventEmitter {
+    stdin;
+    stdout;
+    pending = new Map();
+    buffer = "";
+    requestTimeout;
+    constructor(options = {}) {
+        super();
+        this.requestTimeout = options.timeout ?? 30000;
+    }
+    /**
+     * Connect to a process via stdio streams
+     */
+    connect(stdin, stdout) {
+        this.stdin = stdin;
+        this.stdout = stdout;
+        stdout.on("data", (chunk) => {
+            this.buffer += chunk.toString();
+            this.processBuffer();
+        });
+        stdout.on("error", (error) => {
+            this.emit("error", error);
+        });
+        stdout.on("end", () => {
+            this.emit("close");
+        });
+    }
+    processBuffer() {
+        let newlineIdx;
+        while ((newlineIdx = this.buffer.indexOf("\n")) !== -1) {
+            const line = this.buffer.slice(0, newlineIdx).trim();
+            this.buffer = this.buffer.slice(newlineIdx + 1);
+            if (line) {
+                try {
+                    this.handleMessage(JSON.parse(line));
+                }
+                catch (e) {
+                    this.emit("error", new Error(`Invalid JSON: ${line}`));
+                }
+            }
+        }
+    }
+    handleMessage(msg) {
+        // Ignore messages that aren't valid JSON-RPC 2.0
+        if (typeof msg !== "object" ||
+            msg === null ||
+            !("jsonrpc" in msg) ||
+            msg.jsonrpc !== "2.0")
+            return;
+        const rpcMsg = msg;
+        // Response to our request
+        if ("id" in rpcMsg && rpcMsg.id !== undefined) {
+            const response = rpcMsg;
+            const pending = this.pending.get(String(response.id));
+            if (pending) {
+                this.pending.delete(String(response.id));
+                clearTimeout(pending.timeout);
+                if (response.error) {
+                    pending.reject(new Error(`${response.error.code}: ${response.error.message}`));
+                }
+                else {
+                    pending.resolve(response.result);
+                }
+            }
+            return;
+        }
+        // Notification from server
+        if ("method" in rpcMsg) {
+            const notification = rpcMsg;
+            this.emit(notification.method, notification.params);
+            this.emit("notification", {
+                method: notification.method,
+                params: notification.params,
+            });
+        }
+    }
+    /**
+     * Send a request and wait for response
+     */
+    async request(method, params) {
+        if (!this.stdin) {
+            throw new Error("Not connected");
+        }
+        const id = randomUUID();
+        const message = {
+            jsonrpc: "2.0",
+            id,
+            method,
+            params,
+        };
+        return new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                if (this.pending.has(id)) {
+                    this.pending.delete(id);
+                    reject(new Error(`Request timeout: ${method}`));
+                }
+            }, this.requestTimeout);
+            this.pending.set(id, {
+                resolve: resolve,
+                reject,
+                timeout,
+            });
+            this.send(message);
+        });
+    }
+    /**
+     * Send a notification (no response expected)
+     */
+    notify(method, params) {
+        const message = {
+            jsonrpc: "2.0",
+            method,
+            params,
+        };
+        this.send(message);
+    }
+    send(message) {
+        if (!this.stdin) {
+            throw new Error("Not connected");
+        }
+        this.stdin.write(JSON.stringify(message) + "\n");
+    }
+    /**
+     * Close and cleanup
+     */
+    close() {
+        for (const [, pending] of this.pending) {
+            clearTimeout(pending.timeout);
+            pending.reject(new Error("Connection closed"));
+        }
+        this.pending.clear();
+        this.buffer = "";
+        this.stdin = undefined;
+        this.stdout?.removeAllListeners();
+        this.stdout = undefined;
+    }
+}
+//# sourceMappingURL=jsonrpc.js.map

package/dist/mcp/types.js

@@ -0,0 +1,8 @@
+/**
+ * MCP (Model Context Protocol) Types
+ *
+ * Protocol version: 2024-11-05
+ * https://modelcontextprotocol.io
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/network-control-adapter.js

@@ -0,0 +1,73 @@
+import { SigningPublicKeySchema } from "./network-runtime/index.js";
+export function toNetworkPeerView(peer) {
+    const parsedSigningPublicKey = SigningPublicKeySchema.safeParse(peer.signingPublicKey?.trim());
+    if (!parsedSigningPublicKey.success ||
+        typeof peer.nodeId !== "string" ||
+        peer.nodeId.length === 0) {
+        return null;
+    }
+    const signingPublicKey = parsedSigningPublicKey.data;
+    return {
+        nodeId: peer.nodeId,
+        transportPublicKey: peer.publicKey,
+        displayNameSnapshot: peer.name,
+        endpointHost: peer.endpointHost,
+        endpointPort: peer.endpointPort,
+        controlEndpoint: peer.controlEndpoint ?? null,
+        signingPublicKey,
+        status: peer.status,
+        membershipStatus: peer.membershipStatus ?? peer.status,
+        routeOwnership: peer.routeOwnership,
+        routeOwnerNodeId: peer.routeOwnerNodeId ?? null,
+        sessionState: peer.sessionState,
+        deliveryReadiness: peer.deliveryReadiness,
+        lastHandshake: peer.lastHandshake,
+        createdAt: peer.createdAt,
+        endpointRevision: peer.endpointRevision ?? 0,
+        updatedAt: peer.updatedAt ?? peer.createdAt,
+    };
+}
+export function toNetworkStatusView(status) {
+    const parsedSigningPublicKey = SigningPublicKeySchema.safeParse(status.signingPublicKey?.trim());
+    const signingPublicKey = parsedSigningPublicKey.success
+        ? parsedSigningPublicKey.data
+        : null;
+    return {
+        configured: status.configured,
+        nodeId: status.nodeId,
+        principalFingerprint: status.principalFingerprint,
+        transportPublicKey: status.publicKey,
+        listenPort: status.listenPort,
+        externalEndpoint: status.externalEndpoint,
+        activePeers: status.activePeers,
+        totalPeers: status.totalPeers,
+        connectedPeers: status.connectedPeers,
+        handshakingPeers: status.handshakingPeers,
+        queueOnlyPeers: status.queueOnlyPeers,
+        supersededPeers: status.supersededPeers,
+        signingPublicKey,
+    };
+}
+export function toNetworkControlRef(networkManager) {
+    if (!networkManager) {
+        return undefined;
+    }
+    return {
+        invite(displayName, options) {
+            return networkManager.invite(displayName, options);
+        },
+        revokePeer(nodeId) {
+            return networkManager.revokePeer(nodeId);
+        },
+        listPeers() {
+            return networkManager.listPeers().flatMap((peer) => {
+                const projected = toNetworkPeerView(peer);
+                return projected ? [projected] : [];
+            });
+        },
+        status() {
+            return toNetworkStatusView(networkManager.status());
+        },
+    };
+}
+//# sourceMappingURL=network-control-adapter.js.map

package/dist/network-runtime/address-types.js

@@ -0,0 +1,166 @@
+import { z } from "zod";
+const NonEmptyStringSchema = z.string().trim().min(1);
+/**
+ * Stable durable identity for a node.
+ * Semantic rules are enforced by the runtime cutover plan; the contract layer
+ * starts by making the shape canonical everywhere.
+ */
+export const NodeIdSchema = NonEmptyStringSchema.brand();
+/** One boot of a given node runtime. */
+export const RuntimeIdSchema = NonEmptyStringSchema.brand();
+export const NodeMetadataSchema = z.object({
+    nodeId: NodeIdSchema,
+    createdAt: NonEmptyStringSchema,
+    schemaVersion: z.number().int().positive(),
+    migratedFromLegacy: z.boolean(),
+});
+/** Monotonic publication revision for externally visible runtime advertisements. */
+export const PublicationRevisionSchema = z.number().int().nonnegative();
+/** Monotonic endpoint revision for register/discovery refreshes. */
+export const EndpointRevisionSchema = z.number().int().nonnegative();
+/** Monotonic generation for peer-binding continuity transitions. */
+export const BindingGenerationSchema = z.number().int().nonnegative();
+/** Monotonic generation for revocation precedence and continuity conflict checks. */
+export const RevocationGenerationSchema = z.number().int().nonnegative();
+/** How a local operator confirmed a revocation decision. */
+export const RevocationOperatorConfirmationSchema = z.enum([
+    "local_operator_confirmed",
+    "remote_capability_authenticated",
+]);
+/** Structured local authority record for a peer revocation decision. */
+export const RevocationDecisionSchema = z.object({
+    localNodeId: NodeIdSchema,
+    targetNodeId: NodeIdSchema,
+    revocationGeneration: RevocationGenerationSchema,
+    operatorConfirmation: RevocationOperatorConfirmationSchema,
+});
+/** Monotonic owner generation for runtime ownership records. */
+export const OwnerGenerationSchema = z.number().int().positive();
+/** Monotonic revision for durable delivery lifecycle state transitions. */
+export const DeliveryLifecycleRevisionSchema = z.number().int().nonnegative();
+export const RuntimeOwnerRecordSchema = z
+    .object({
+    schemaVersion: z.number().int().positive(),
+    nodeId: NodeIdSchema,
+    ariaHome: NonEmptyStringSchema,
+    runtimePid: z.number().int().positive(),
+    runtimeId: RuntimeIdSchema,
+    displayNameSnapshot: NonEmptyStringSchema.optional(),
+    runtimeSocket: NonEmptyStringSchema,
+    startedAt: NonEmptyStringSchema,
+    lastHeartbeat: NonEmptyStringSchema,
+    ownerGeneration: OwnerGenerationSchema,
+})
+    .strict();
+/** One attached local client of the runtime. */
+export const ClientIdSchema = NonEmptyStringSchema.brand();
+/** Durable principal fingerprint (SHA-256 hex of signing public key DER). Signing-key evidence only. */
+export const PrincipalFingerprintSchema = NonEmptyStringSchema.brand();
+/** Transport public key / transport identity for a peer. */
+export const PeerTransportIdSchema = NonEmptyStringSchema.brand();
+/** TLS CA certificate fingerprint (SHA-256 hex of CA cert DER). Certificate-authority evidence only — distinct from signing-key evidence. */
+export const TlsCaFingerprintSchema = NonEmptyStringSchema.brand();
+/** Local-only loopback TLS SAN identity used for same-machine control attachment. */
+export const LoopbackTlsIdentitySchema = NonEmptyStringSchema.brand();
+/** Base64-encoded signing public key material crossing runtime/shared boundaries. */
+export const SigningPublicKeySchema = NonEmptyStringSchema.brand();
+/** Explicit network transport endpoint advertisement. */
+export const TransportEndpointAdvertisementSchema = z.object({
+    host: NonEmptyStringSchema,
+    port: z.number().int().min(1).max(65535),
+});
+/**
+ * Runtime-owned local inbox addressing.
+ * Same-machine clients are local attachments, not mesh peers.
+ */
+export const InboxAddressSchema = z.discriminatedUnion("kind", [
+    z.object({
+        kind: z.literal("node"),
+        nodeId: NodeIdSchema,
+    }),
+    z.object({
+        kind: z.literal("client"),
+        clientId: ClientIdSchema,
+    }),
+]);
+/**
+ * Public control-plane endpoint advertisement used by peers for pinned,
+ * mutating requests.
+ */
+export const ControlEndpointAdvertisementSchema = z.object({
+    host: NonEmptyStringSchema,
+    port: z.number().int().min(1).max(65535),
+    tlsCaFingerprint: TlsCaFingerprintSchema,
+    tlsServerIdentity: PrincipalFingerprintSchema,
+    protocolVersion: z.number().int().positive(),
+    endpointRevision: EndpointRevisionSchema.optional(),
+});
+/**
+ * Remote/public node advertisement. This deliberately excludes local-only
+ * runtime/session identity like RuntimeId.
+ */
+export const NodeAdvertisementSchema = z.object({
+    nodeId: NodeIdSchema,
+    principalFingerprint: PrincipalFingerprintSchema,
+    transportPublicKey: PeerTransportIdSchema,
+    publicationRevision: PublicationRevisionSchema.optional(),
+    controlEndpoint: ControlEndpointAdvertisementSchema.optional(),
+    displayNameSnapshot: NonEmptyStringSchema.optional(),
+});
+/**
+ * Local-only runtime registry summary. This is not a remote/public mesh
+ * contract and may include RuntimeId.
+ */
+export const LocalRuntimeSummarySchema = z.object({
+    nodeId: NodeIdSchema,
+    runtimeId: RuntimeIdSchema,
+    lastHeartbeat: NonEmptyStringSchema.optional(),
+    controlEndpoint: ControlEndpointAdvertisementSchema.optional(),
+    displayNameSnapshot: NonEmptyStringSchema.optional(),
+});
+// ── Durable Delivery Handle ────────────────────────────────────────
+/**
+ * Branded operation handle for durable delivery.
+ * Produced ONLY by `submitDurable()` — the caller never mints handles.
+ */
+export const DurableDeliveryHandleSchema = NonEmptyStringSchema.brand();
+/**
+ * Terminal status types for a durable delivery operation.
+ */
+export const DurableDeliveryResultSchema = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("pending"),
+        queuedAt: z.string(),
+        nextAttemptAt: z.string().optional(),
+        attemptCount: z.number(),
+    }),
+    z.object({
+        status: z.literal("delivered"),
+        deliveredAt: z.string(),
+    }),
+    z.object({
+        status: z.literal("expired"),
+        reason: z.literal("ttl_exceeded"),
+        queuedAt: z.string(),
+        expiredAt: z.string(),
+    }),
+    z.object({
+        status: z.literal("rejected"),
+        reason: z.enum(["recipient_revoked", "recipient_unknown", "envelope_invalid"]),
+    }),
+]);
+/**
+ * Submit result — returned immediately from `submitDurable()`.
+ */
+export const DurableSubmitResultSchema = z.discriminatedUnion("status", [
+    z.object({
+        status: z.literal("accepted"),
+        operationId: DurableDeliveryHandleSchema,
+        queuedAt: z.string(),
+    }),
+    z.object({
+        status: z.literal("rejected"),
+        reason: z.enum(["recipient_revoked", "recipient_unknown", "envelope_invalid"]),
+    }),
+]);
+//# sourceMappingURL=address-types.js.map

package/dist/network-runtime/db-owner-fencing.js

@@ -0,0 +1,70 @@
+/**
+ * Shared database-level ownership fencing for runtime-owned durable stores.
+ *
+ * All stores backed by the same SQLite database share one `owner_epoch` table.
+ * The runtime claims the epoch once at startup. Each store's write methods
+ * call `assertDbOwnership()` before durable mutations.
+ *
+ * A zombie runtime whose generation is stale gets StaleOwnerError on
+ * its next write — no external kill needed.
+ */
+export class StaleOwnerError extends Error {
+    kind = "StaleOwnerError";
+    claimedGeneration;
+    currentGeneration;
+    constructor(claimed, current) {
+        super(`StaleOwnerError: runtime claims generation ${claimed} but store is at generation ${current}. ` +
+            `This runtime has been superseded and must shut down immediately.`);
+        this.name = "StaleOwnerError";
+        this.claimedGeneration = claimed;
+        this.currentGeneration = current;
+    }
+}
+/**
+ * Ensure the owner_epoch table exists in the given database.
+ * Safe to call multiple times (idempotent).
+ */
+export function ensureOwnerEpochTable(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS owner_epoch (
+      scope TEXT PRIMARY KEY DEFAULT 'runtime',
+      owner_generation INTEGER NOT NULL
+    )
+  `);
+}
+/**
+ * Atomically claim the owner epoch for this runtime.
+ * Throws StaleOwnerError if a newer generation already owns the database.
+ */
+export function claimDbOwnerEpoch(db, generation) {
+    ensureOwnerEpochTable(db);
+    const result = db
+        .prepare(`INSERT INTO owner_epoch (scope, owner_generation) VALUES ('runtime', ?)
+       ON CONFLICT(scope) DO UPDATE SET owner_generation = excluded.owner_generation
+       WHERE excluded.owner_generation > owner_epoch.owner_generation`)
+        .run(generation);
+    if (result.changes === 0) {
+        const row = db
+            .prepare("SELECT owner_generation FROM owner_epoch WHERE scope = 'runtime'")
+            .get();
+        const current = row?.owner_generation ?? 0;
+        if (current > generation) {
+            throw new StaleOwnerError(generation, current);
+        }
+    }
+}
+/**
+ * Assert the calling runtime is still the current owner of this database.
+ * Must be called inside the same SQLite transaction as the write.
+ * Throws StaleOwnerError if superseded.
+ */
+export function assertDbOwnership(db, generation) {
+    const row = db
+        .prepare("SELECT owner_generation FROM owner_epoch WHERE scope = 'runtime'")
+        .get();
+    const current = row?.owner_generation ?? 0;
+    if (current > generation) {
+        throw new StaleOwnerError(generation, current);
+    }
+}
+//# sourceMappingURL=db-owner-fencing.js.map