@aristanetworks/eos-mcp-server 0.8.0-beta → 0.9.0-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (88) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/README.md +19 -42
  3. package/dist/cli.d.ts +1 -4
  4. package/dist/cli.js +4 -63
  5. package/dist/cli.js.map +1 -1
  6. package/dist/commands/probe.js +2 -1
  7. package/dist/commands/probe.js.map +1 -1
  8. package/dist/config/diagnostics.d.ts +15 -5
  9. package/dist/config/diagnostics.js +8 -3
  10. package/dist/config/diagnostics.js.map +1 -1
  11. package/dist/config/loadConfig.js +2 -5
  12. package/dist/config/loadConfig.js.map +1 -1
  13. package/dist/config/schema.d.ts +123 -15
  14. package/dist/config/schema.js +14 -1
  15. package/dist/config/schema.js.map +1 -1
  16. package/dist/connection/eosDeviceReader.d.ts +6 -1
  17. package/dist/connection/eosDeviceReader.js +14 -3
  18. package/dist/connection/eosDeviceReader.js.map +1 -1
  19. package/dist/diagnostics/eapiRunner.js +7 -1
  20. package/dist/diagnostics/eapiRunner.js.map +1 -1
  21. package/dist/diagnostics/executor.d.ts +7 -4
  22. package/dist/diagnostics/executor.js +16 -14
  23. package/dist/diagnostics/executor.js.map +1 -1
  24. package/dist/diagnostics/types.d.ts +22 -6
  25. package/dist/eapi/client.js +5 -4
  26. package/dist/eapi/client.js.map +1 -1
  27. package/dist/eapi/types.d.ts +3 -0
  28. package/dist/eapi/types.js.map +1 -1
  29. package/dist/index.js +0 -10
  30. package/dist/index.js.map +1 -1
  31. package/dist/mcp/createServer.js +21 -21
  32. package/dist/mcp/createServer.js.map +1 -1
  33. package/dist/mcp/tools/ping.d.ts +2 -9
  34. package/dist/mcp/tools/ping.js +13 -26
  35. package/dist/mcp/tools/ping.js.map +1 -1
  36. package/dist/operations/eapiSlots.d.ts +68 -0
  37. package/dist/operations/eapiSlots.js +237 -0
  38. package/dist/operations/eapiSlots.js.map +1 -0
  39. package/dist/operations/readExecution.js +1 -1
  40. package/dist/operations/readExecution.js.map +1 -1
  41. package/dist/serverInfo/buildServerInfo.js +4 -1
  42. package/dist/serverInfo/buildServerInfo.js.map +1 -1
  43. package/dist/serverInfo/types.d.ts +3 -0
  44. package/docs/CHECKPOINT.md +3 -6
  45. package/docs/CODE_WALKTHROUGH.md +6 -11
  46. package/docs/DEMO_SKILLS_YOUTUBE.md +346 -0
  47. package/docs/DESIGN.md +4 -4
  48. package/docs/DIAGNOSTICS.md +26 -74
  49. package/docs/IMPLEMENTATION_PLAN.md +2 -2
  50. package/docs/adr/0002-fail-closed-diagnostic-reservations.md +2 -0
  51. package/docs/adr/0003-durable-diagnostic-ledger.md +2 -0
  52. package/docs/adr/0004-offline-operator-attested-release.md +2 -0
  53. package/docs/adr/0005-multi-destination-ping.md +5 -1
  54. package/docs/adr/0006-in-memory-timed-diagnostic-capacity.md +23 -0
  55. package/docs/adr/0007-per-device-diagnostic-concurrency.md +16 -0
  56. package/docs/adr/0008-read-only-tool-annotations.md +16 -0
  57. package/docs/adr/0009-shared-per-device-eapi-slots.md +40 -0
  58. package/docs/research/eos-diagnostic-lifecycle.md +2 -0
  59. package/docs/research/eos-linter-integration.md +70 -0
  60. package/package.json +1 -1
  61. package/dist/commands/inspectDiagnostics.d.ts +0 -3
  62. package/dist/commands/inspectDiagnostics.js +0 -35
  63. package/dist/commands/inspectDiagnostics.js.map +0 -1
  64. package/dist/commands/releaseDiagnostics.d.ts +0 -9
  65. package/dist/commands/releaseDiagnostics.js +0 -87
  66. package/dist/commands/releaseDiagnostics.js.map +0 -1
  67. package/dist/diagnostics/concurrency.d.ts +0 -33
  68. package/dist/diagnostics/concurrency.js +0 -157
  69. package/dist/diagnostics/concurrency.js.map +0 -1
  70. package/dist/diagnostics/journal.d.ts +0 -14
  71. package/dist/diagnostics/journal.js +0 -317
  72. package/dist/diagnostics/journal.js.map +0 -1
  73. package/dist/diagnostics/journalTypes.d.ts +0 -8
  74. package/dist/diagnostics/journalTypes.js +0 -2
  75. package/dist/diagnostics/journalTypes.js.map +0 -1
  76. package/dist/diagnostics/releaseEvidence.d.ts +0 -502
  77. package/dist/diagnostics/releaseEvidence.js +0 -115
  78. package/dist/diagnostics/releaseEvidence.js.map +0 -1
  79. package/dist/diagnostics/reservationSchema.d.ts +0 -49
  80. package/dist/diagnostics/reservationSchema.js +0 -18
  81. package/dist/diagnostics/reservationSchema.js.map +0 -1
  82. package/dist/diagnostics/statePath.d.ts +0 -4
  83. package/dist/diagnostics/statePath.js +0 -25
  84. package/dist/diagnostics/statePath.js.map +0 -1
  85. package/dist/utils/privateFile.d.ts +0 -3
  86. package/dist/utils/privateFile.js +0 -7
  87. package/dist/utils/privateFile.js.map +0 -1
  88. package/docs/examples/diagnostic-release-evidence.template.json +0 -26
@@ -1,502 +0,0 @@
1
- import { z } from "zod";
2
- import type { DiagnosticReservationInfo } from "./types.js";
3
- export declare const fencingAttestationSchema: z.ZodEffects<z.ZodObject<{
4
- evidence_version: z.ZodLiteral<1>;
5
- attestation_id: z.ZodString;
6
- inventory_identity: z.ZodString;
7
- verified_by: z.ZodEffects<z.ZodString, string, string>;
8
- verified_at: z.ZodString;
9
- reason: z.ZodEffects<z.ZodString, string, string>;
10
- assertions: z.ZodObject<{
11
- independent_evidence_verified: z.ZodLiteral<true>;
12
- running_work_terminated: z.ZodLiteral<true>;
13
- accepted_queued_work_cannot_execute: z.ZodLiteral<true>;
14
- replay_prevented: z.ZodLiteral<true>;
15
- }, "strict", z.ZodTypeAny, {
16
- independent_evidence_verified: true;
17
- running_work_terminated: true;
18
- accepted_queued_work_cannot_execute: true;
19
- replay_prevented: true;
20
- }, {
21
- independent_evidence_verified: true;
22
- running_work_terminated: true;
23
- accepted_queued_work_cannot_execute: true;
24
- replay_prevented: true;
25
- }>;
26
- reservations: z.ZodArray<z.ZodEffects<z.ZodObject<{
27
- reservation_id: z.ZodString;
28
- rpc_request_id: z.ZodNullable<z.ZodString>;
29
- inventory_hostname: z.ZodString;
30
- reserved_at: z.ZodString;
31
- physical_device_identity: z.ZodEffects<z.ZodString, string, string>;
32
- execution_epoch: z.ZodEffects<z.ZodString, string, string>;
33
- fenced_at: z.ZodString;
34
- evidence_reference: z.ZodEffects<z.ZodString, string, string>;
35
- }, "strict", z.ZodTypeAny, {
36
- inventory_hostname: string;
37
- reservation_id: string;
38
- rpc_request_id: string | null;
39
- reserved_at: string;
40
- physical_device_identity: string;
41
- execution_epoch: string;
42
- fenced_at: string;
43
- evidence_reference: string;
44
- }, {
45
- inventory_hostname: string;
46
- reservation_id: string;
47
- rpc_request_id: string | null;
48
- reserved_at: string;
49
- physical_device_identity: string;
50
- execution_epoch: string;
51
- fenced_at: string;
52
- evidence_reference: string;
53
- }>, {
54
- inventory_hostname: string;
55
- reservation_id: string;
56
- rpc_request_id: string | null;
57
- reserved_at: string;
58
- physical_device_identity: string;
59
- execution_epoch: string;
60
- fenced_at: string;
61
- evidence_reference: string;
62
- }, {
63
- inventory_hostname: string;
64
- reservation_id: string;
65
- rpc_request_id: string | null;
66
- reserved_at: string;
67
- physical_device_identity: string;
68
- execution_epoch: string;
69
- fenced_at: string;
70
- evidence_reference: string;
71
- }>, "many">;
72
- }, "strict", z.ZodTypeAny, {
73
- evidence_version: 1;
74
- attestation_id: string;
75
- inventory_identity: string;
76
- verified_by: string;
77
- verified_at: string;
78
- reason: string;
79
- assertions: {
80
- independent_evidence_verified: true;
81
- running_work_terminated: true;
82
- accepted_queued_work_cannot_execute: true;
83
- replay_prevented: true;
84
- };
85
- reservations: {
86
- inventory_hostname: string;
87
- reservation_id: string;
88
- rpc_request_id: string | null;
89
- reserved_at: string;
90
- physical_device_identity: string;
91
- execution_epoch: string;
92
- fenced_at: string;
93
- evidence_reference: string;
94
- }[];
95
- }, {
96
- evidence_version: 1;
97
- attestation_id: string;
98
- inventory_identity: string;
99
- verified_by: string;
100
- verified_at: string;
101
- reason: string;
102
- assertions: {
103
- independent_evidence_verified: true;
104
- running_work_terminated: true;
105
- accepted_queued_work_cannot_execute: true;
106
- replay_prevented: true;
107
- };
108
- reservations: {
109
- inventory_hostname: string;
110
- reservation_id: string;
111
- rpc_request_id: string | null;
112
- reserved_at: string;
113
- physical_device_identity: string;
114
- execution_epoch: string;
115
- fenced_at: string;
116
- evidence_reference: string;
117
- }[];
118
- }>, {
119
- evidence_version: 1;
120
- attestation_id: string;
121
- inventory_identity: string;
122
- verified_by: string;
123
- verified_at: string;
124
- reason: string;
125
- assertions: {
126
- independent_evidence_verified: true;
127
- running_work_terminated: true;
128
- accepted_queued_work_cannot_execute: true;
129
- replay_prevented: true;
130
- };
131
- reservations: {
132
- inventory_hostname: string;
133
- reservation_id: string;
134
- rpc_request_id: string | null;
135
- reserved_at: string;
136
- physical_device_identity: string;
137
- execution_epoch: string;
138
- fenced_at: string;
139
- evidence_reference: string;
140
- }[];
141
- }, {
142
- evidence_version: 1;
143
- attestation_id: string;
144
- inventory_identity: string;
145
- verified_by: string;
146
- verified_at: string;
147
- reason: string;
148
- assertions: {
149
- independent_evidence_verified: true;
150
- running_work_terminated: true;
151
- accepted_queued_work_cannot_execute: true;
152
- replay_prevented: true;
153
- };
154
- reservations: {
155
- inventory_hostname: string;
156
- reservation_id: string;
157
- rpc_request_id: string | null;
158
- reserved_at: string;
159
- physical_device_identity: string;
160
- execution_epoch: string;
161
- fenced_at: string;
162
- evidence_reference: string;
163
- }[];
164
- }>;
165
- export type FencingAttestation = z.infer<typeof fencingAttestationSchema>;
166
- export declare const releaseAuditSchema: z.ZodObject<{
167
- release_id: z.ZodString;
168
- recorded_at: z.ZodString;
169
- authority: z.ZodLiteral<"operator_attestation">;
170
- inventory_identity: z.ZodString;
171
- os_user: z.ZodObject<{
172
- username: z.ZodString;
173
- uid: z.ZodNullable<z.ZodNumber>;
174
- }, "strict", z.ZodTypeAny, {
175
- username: string;
176
- uid: number | null;
177
- }, {
178
- username: string;
179
- uid: number | null;
180
- }>;
181
- evidence_sha256: z.ZodString;
182
- evidence: z.ZodEffects<z.ZodObject<{
183
- evidence_version: z.ZodLiteral<1>;
184
- attestation_id: z.ZodString;
185
- inventory_identity: z.ZodString;
186
- verified_by: z.ZodEffects<z.ZodString, string, string>;
187
- verified_at: z.ZodString;
188
- reason: z.ZodEffects<z.ZodString, string, string>;
189
- assertions: z.ZodObject<{
190
- independent_evidence_verified: z.ZodLiteral<true>;
191
- running_work_terminated: z.ZodLiteral<true>;
192
- accepted_queued_work_cannot_execute: z.ZodLiteral<true>;
193
- replay_prevented: z.ZodLiteral<true>;
194
- }, "strict", z.ZodTypeAny, {
195
- independent_evidence_verified: true;
196
- running_work_terminated: true;
197
- accepted_queued_work_cannot_execute: true;
198
- replay_prevented: true;
199
- }, {
200
- independent_evidence_verified: true;
201
- running_work_terminated: true;
202
- accepted_queued_work_cannot_execute: true;
203
- replay_prevented: true;
204
- }>;
205
- reservations: z.ZodArray<z.ZodEffects<z.ZodObject<{
206
- reservation_id: z.ZodString;
207
- rpc_request_id: z.ZodNullable<z.ZodString>;
208
- inventory_hostname: z.ZodString;
209
- reserved_at: z.ZodString;
210
- physical_device_identity: z.ZodEffects<z.ZodString, string, string>;
211
- execution_epoch: z.ZodEffects<z.ZodString, string, string>;
212
- fenced_at: z.ZodString;
213
- evidence_reference: z.ZodEffects<z.ZodString, string, string>;
214
- }, "strict", z.ZodTypeAny, {
215
- inventory_hostname: string;
216
- reservation_id: string;
217
- rpc_request_id: string | null;
218
- reserved_at: string;
219
- physical_device_identity: string;
220
- execution_epoch: string;
221
- fenced_at: string;
222
- evidence_reference: string;
223
- }, {
224
- inventory_hostname: string;
225
- reservation_id: string;
226
- rpc_request_id: string | null;
227
- reserved_at: string;
228
- physical_device_identity: string;
229
- execution_epoch: string;
230
- fenced_at: string;
231
- evidence_reference: string;
232
- }>, {
233
- inventory_hostname: string;
234
- reservation_id: string;
235
- rpc_request_id: string | null;
236
- reserved_at: string;
237
- physical_device_identity: string;
238
- execution_epoch: string;
239
- fenced_at: string;
240
- evidence_reference: string;
241
- }, {
242
- inventory_hostname: string;
243
- reservation_id: string;
244
- rpc_request_id: string | null;
245
- reserved_at: string;
246
- physical_device_identity: string;
247
- execution_epoch: string;
248
- fenced_at: string;
249
- evidence_reference: string;
250
- }>, "many">;
251
- }, "strict", z.ZodTypeAny, {
252
- evidence_version: 1;
253
- attestation_id: string;
254
- inventory_identity: string;
255
- verified_by: string;
256
- verified_at: string;
257
- reason: string;
258
- assertions: {
259
- independent_evidence_verified: true;
260
- running_work_terminated: true;
261
- accepted_queued_work_cannot_execute: true;
262
- replay_prevented: true;
263
- };
264
- reservations: {
265
- inventory_hostname: string;
266
- reservation_id: string;
267
- rpc_request_id: string | null;
268
- reserved_at: string;
269
- physical_device_identity: string;
270
- execution_epoch: string;
271
- fenced_at: string;
272
- evidence_reference: string;
273
- }[];
274
- }, {
275
- evidence_version: 1;
276
- attestation_id: string;
277
- inventory_identity: string;
278
- verified_by: string;
279
- verified_at: string;
280
- reason: string;
281
- assertions: {
282
- independent_evidence_verified: true;
283
- running_work_terminated: true;
284
- accepted_queued_work_cannot_execute: true;
285
- replay_prevented: true;
286
- };
287
- reservations: {
288
- inventory_hostname: string;
289
- reservation_id: string;
290
- rpc_request_id: string | null;
291
- reserved_at: string;
292
- physical_device_identity: string;
293
- execution_epoch: string;
294
- fenced_at: string;
295
- evidence_reference: string;
296
- }[];
297
- }>, {
298
- evidence_version: 1;
299
- attestation_id: string;
300
- inventory_identity: string;
301
- verified_by: string;
302
- verified_at: string;
303
- reason: string;
304
- assertions: {
305
- independent_evidence_verified: true;
306
- running_work_terminated: true;
307
- accepted_queued_work_cannot_execute: true;
308
- replay_prevented: true;
309
- };
310
- reservations: {
311
- inventory_hostname: string;
312
- reservation_id: string;
313
- rpc_request_id: string | null;
314
- reserved_at: string;
315
- physical_device_identity: string;
316
- execution_epoch: string;
317
- fenced_at: string;
318
- evidence_reference: string;
319
- }[];
320
- }, {
321
- evidence_version: 1;
322
- attestation_id: string;
323
- inventory_identity: string;
324
- verified_by: string;
325
- verified_at: string;
326
- reason: string;
327
- assertions: {
328
- independent_evidence_verified: true;
329
- running_work_terminated: true;
330
- accepted_queued_work_cannot_execute: true;
331
- replay_prevented: true;
332
- };
333
- reservations: {
334
- inventory_hostname: string;
335
- reservation_id: string;
336
- rpc_request_id: string | null;
337
- reserved_at: string;
338
- physical_device_identity: string;
339
- execution_epoch: string;
340
- fenced_at: string;
341
- evidence_reference: string;
342
- }[];
343
- }>;
344
- released_reservations: z.ZodArray<z.ZodEffects<z.ZodObject<{
345
- reservation_id: z.ZodString;
346
- rpc_request_id: z.ZodOptional<z.ZodString>;
347
- inventory_hostname: z.ZodString;
348
- diagnostic: z.ZodLiteral<"ping">;
349
- state: z.ZodEnum<["active", "uncertain"]>;
350
- reserved_at: z.ZodString;
351
- uncertain_since: z.ZodOptional<z.ZodString>;
352
- reason_code: z.ZodOptional<z.ZodString>;
353
- }, "strict", z.ZodTypeAny, {
354
- inventory_hostname: string;
355
- state: "active" | "uncertain";
356
- reservation_id: string;
357
- diagnostic: "ping";
358
- reserved_at: string;
359
- rpc_request_id?: string | undefined;
360
- uncertain_since?: string | undefined;
361
- reason_code?: string | undefined;
362
- }, {
363
- inventory_hostname: string;
364
- state: "active" | "uncertain";
365
- reservation_id: string;
366
- diagnostic: "ping";
367
- reserved_at: string;
368
- rpc_request_id?: string | undefined;
369
- uncertain_since?: string | undefined;
370
- reason_code?: string | undefined;
371
- }>, {
372
- inventory_hostname: string;
373
- state: "active" | "uncertain";
374
- reservation_id: string;
375
- diagnostic: "ping";
376
- reserved_at: string;
377
- rpc_request_id?: string | undefined;
378
- uncertain_since?: string | undefined;
379
- reason_code?: string | undefined;
380
- }, {
381
- inventory_hostname: string;
382
- state: "active" | "uncertain";
383
- reservation_id: string;
384
- diagnostic: "ping";
385
- reserved_at: string;
386
- rpc_request_id?: string | undefined;
387
- uncertain_since?: string | undefined;
388
- reason_code?: string | undefined;
389
- }>, "many">;
390
- } & {
391
- audit_sha256: z.ZodString;
392
- }, "strict", z.ZodTypeAny, {
393
- inventory_identity: string;
394
- release_id: string;
395
- recorded_at: string;
396
- authority: "operator_attestation";
397
- os_user: {
398
- username: string;
399
- uid: number | null;
400
- };
401
- evidence_sha256: string;
402
- evidence: {
403
- evidence_version: 1;
404
- attestation_id: string;
405
- inventory_identity: string;
406
- verified_by: string;
407
- verified_at: string;
408
- reason: string;
409
- assertions: {
410
- independent_evidence_verified: true;
411
- running_work_terminated: true;
412
- accepted_queued_work_cannot_execute: true;
413
- replay_prevented: true;
414
- };
415
- reservations: {
416
- inventory_hostname: string;
417
- reservation_id: string;
418
- rpc_request_id: string | null;
419
- reserved_at: string;
420
- physical_device_identity: string;
421
- execution_epoch: string;
422
- fenced_at: string;
423
- evidence_reference: string;
424
- }[];
425
- };
426
- released_reservations: {
427
- inventory_hostname: string;
428
- state: "active" | "uncertain";
429
- reservation_id: string;
430
- diagnostic: "ping";
431
- reserved_at: string;
432
- rpc_request_id?: string | undefined;
433
- uncertain_since?: string | undefined;
434
- reason_code?: string | undefined;
435
- }[];
436
- audit_sha256: string;
437
- }, {
438
- inventory_identity: string;
439
- release_id: string;
440
- recorded_at: string;
441
- authority: "operator_attestation";
442
- os_user: {
443
- username: string;
444
- uid: number | null;
445
- };
446
- evidence_sha256: string;
447
- evidence: {
448
- evidence_version: 1;
449
- attestation_id: string;
450
- inventory_identity: string;
451
- verified_by: string;
452
- verified_at: string;
453
- reason: string;
454
- assertions: {
455
- independent_evidence_verified: true;
456
- running_work_terminated: true;
457
- accepted_queued_work_cannot_execute: true;
458
- replay_prevented: true;
459
- };
460
- reservations: {
461
- inventory_hostname: string;
462
- reservation_id: string;
463
- rpc_request_id: string | null;
464
- reserved_at: string;
465
- physical_device_identity: string;
466
- execution_epoch: string;
467
- fenced_at: string;
468
- evidence_reference: string;
469
- }[];
470
- };
471
- released_reservations: {
472
- inventory_hostname: string;
473
- state: "active" | "uncertain";
474
- reservation_id: string;
475
- diagnostic: "ping";
476
- reserved_at: string;
477
- rpc_request_id?: string | undefined;
478
- uncertain_since?: string | undefined;
479
- reason_code?: string | undefined;
480
- }[];
481
- audit_sha256: string;
482
- }>;
483
- export type DiagnosticReleaseAudit = z.infer<typeof releaseAuditSchema>;
484
- export interface DiagnosticReleaseRequest {
485
- reservationIds: string[];
486
- evidence: unknown;
487
- confirmedFenced: boolean;
488
- expectedInventoryIdentity?: string;
489
- }
490
- export interface DiagnosticReleaseResult {
491
- release_id: string;
492
- attestation_id: string;
493
- released_reservation_ids: string[];
494
- already_committed: boolean;
495
- }
496
- export declare function parseFencingAttestation(value: unknown): FencingAttestation;
497
- export declare function evidenceDigest(evidence: FencingAttestation): string;
498
- export declare function validateReleaseRequest(request: DiagnosticReleaseRequest): FencingAttestation;
499
- /** Consistency checks cannot establish the truth of an operator's external evidence. */
500
- export declare function matchAttestedReservations(evidence: FencingAttestation, current: DiagnosticReservationInfo[], now: number): DiagnosticReservationInfo[];
501
- export declare function createReleaseAudit(value: unknown): DiagnosticReleaseAudit;
502
- export declare function parseReleaseAudit(value: unknown): DiagnosticReleaseAudit;
@@ -1,115 +0,0 @@
1
- import { createHash } from "node:crypto";
2
- import { z } from "zod";
3
- import { AppError } from "../core/errors.js";
4
- import { parseReservation, reservationSchema } from "./reservationSchema.js";
5
- const identifier = z.string().regex(/^[A-Za-z0-9_.:-]{1,128}$/);
6
- const text = z.string().min(1).max(2000).refine((value) => value.trim().length > 0);
7
- const identity = z.string().regex(/^[a-f0-9]{64}$/);
8
- const coveredReservationSchema = z.object({
9
- reservation_id: identifier,
10
- rpc_request_id: identifier.nullable(),
11
- inventory_hostname: z.string().regex(/^[A-Za-z0-9_.-]+$/),
12
- reserved_at: z.string().datetime(),
13
- physical_device_identity: text,
14
- execution_epoch: text,
15
- fenced_at: z.string().datetime(),
16
- evidence_reference: text
17
- }).strict().refine((value) => value.rpc_request_id === null || value.rpc_request_id === value.reservation_id, { message: "Wire request identity must match the selected reservation" });
18
- export const fencingAttestationSchema = z.object({
19
- evidence_version: z.literal(1),
20
- attestation_id: z.string().uuid(),
21
- inventory_identity: identity,
22
- verified_by: text,
23
- verified_at: z.string().datetime(),
24
- reason: text,
25
- assertions: z.object({
26
- independent_evidence_verified: z.literal(true),
27
- running_work_terminated: z.literal(true),
28
- accepted_queued_work_cannot_execute: z.literal(true),
29
- replay_prevented: z.literal(true)
30
- }).strict(),
31
- reservations: z.array(coveredReservationSchema).min(1).max(100)
32
- }).strict().refine((value) => new Set(value.reservations.map((record) => record.reservation_id)).size === value.reservations.length, { message: "Attestation contains duplicate reservations" });
33
- const releaseAuditBodySchema = z.object({
34
- release_id: z.string().uuid(),
35
- recorded_at: z.string().datetime(),
36
- authority: z.literal("operator_attestation"),
37
- inventory_identity: identity,
38
- os_user: z.object({ username: z.string().min(1), uid: z.number().int().nullable() }).strict(),
39
- evidence_sha256: identity,
40
- evidence: fencingAttestationSchema,
41
- released_reservations: z.array(reservationSchema).min(1).max(100)
42
- }).strict();
43
- export const releaseAuditSchema = releaseAuditBodySchema.extend({ audit_sha256: identity }).strict();
44
- export function parseFencingAttestation(value) {
45
- const parsed = fencingAttestationSchema.safeParse(value);
46
- if (!parsed.success) {
47
- throw new AppError("diagnostic_release_evidence_invalid", "A complete fencing attestation with exact reservation scope and all required assertions is required");
48
- }
49
- return parsed.data;
50
- }
51
- function sha256Json(value) {
52
- return createHash("sha256").update(JSON.stringify(value)).digest("hex");
53
- }
54
- export function evidenceDigest(evidence) {
55
- return sha256Json(evidence);
56
- }
57
- export function validateReleaseRequest(request) {
58
- if (request.confirmedFenced !== true) {
59
- throw new AppError("diagnostic_release_confirmation_required", "Explicit --confirm-fenced is required; silence and elapsed time are not completion evidence");
60
- }
61
- const selected = z.array(identifier).min(1).max(100).safeParse(request.reservationIds);
62
- if (!selected.success || new Set(request.reservationIds).size !== request.reservationIds.length) {
63
- throw new AppError("diagnostic_release_scope_invalid", "Select explicit, unique reservation IDs; there is no wildcard or release-all operation");
64
- }
65
- const evidence = parseFencingAttestation(request.evidence);
66
- const covered = new Set(evidence.reservations.map((record) => record.reservation_id));
67
- if (covered.size !== request.reservationIds.length || request.reservationIds.some((id) => !covered.has(id))) {
68
- throw new AppError("diagnostic_release_scope_mismatch", "Selected reservation IDs must exactly match the attestation scope");
69
- }
70
- if (request.expectedInventoryIdentity !== undefined && request.expectedInventoryIdentity !== evidence.inventory_identity) {
71
- throw new AppError("diagnostic_state_inventory_mismatch", "Configured inventory does not match the attested ledger identity");
72
- }
73
- return evidence;
74
- }
75
- /** Consistency checks cannot establish the truth of an operator's external evidence. */
76
- export function matchAttestedReservations(evidence, current, now) {
77
- const verified = Date.parse(evidence.verified_at);
78
- if (verified > now)
79
- throw new AppError("diagnostic_release_evidence_invalid", "Verification time must not be in the future");
80
- return evidence.reservations.map((covered) => {
81
- const reservation = current.find((record) => record.reservation_id === covered.reservation_id);
82
- if (reservation === undefined) {
83
- throw new AppError("diagnostic_release_reservation_missing", "A selected reservation no longer exists; inspect the audit before retrying");
84
- }
85
- if (covered.inventory_hostname !== reservation.inventory_hostname || covered.reserved_at !== reservation.reserved_at ||
86
- covered.rpc_request_id !== (reservation.rpc_request_id ?? null)) {
87
- throw new AppError("diagnostic_release_evidence_mismatch", "Attestation does not match the selected immutable execution identity");
88
- }
89
- const fenced = Date.parse(covered.fenced_at);
90
- if (fenced < Date.parse(reservation.reserved_at) || fenced > verified) {
91
- throw new AppError("diagnostic_release_evidence_invalid", "Fencing must follow reservation admission and precede verification");
92
- }
93
- return reservation;
94
- });
95
- }
96
- export function createReleaseAudit(value) {
97
- const body = releaseAuditBodySchema.parse(value);
98
- return parseReleaseAudit({ ...body, audit_sha256: sha256Json(body) });
99
- }
100
- export function parseReleaseAudit(value) {
101
- const audit = releaseAuditSchema.parse(value);
102
- const { audit_sha256: digest, ...body } = audit;
103
- if (sha256Json(body) !== digest) {
104
- throw new AppError("diagnostic_state_invalid", "Operator release audit checksum is invalid");
105
- }
106
- if (audit.inventory_identity !== audit.evidence.inventory_identity || audit.evidence_sha256 !== evidenceDigest(audit.evidence)) {
107
- throw new AppError("diagnostic_state_invalid", "Operator release audit evidence or inventory binding is invalid");
108
- }
109
- matchAttestedReservations(audit.evidence, audit.released_reservations.map(parseReservation), Date.parse(audit.recorded_at));
110
- if (audit.released_reservations.length !== audit.evidence.reservations.length) {
111
- throw new AppError("diagnostic_state_invalid", "Operator release audit has inconsistent reservation scope");
112
- }
113
- return audit;
114
- }
115
- //# sourceMappingURL=releaseEvidence.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"releaseEvidence.js","sourceRoot":"","sources":["../../src/diagnostics/releaseEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG7E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAChE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACpD,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,cAAc,EAAE,UAAU;IAC1B,cAAc,EAAE,UAAU,CAAC,QAAQ,EAAE;IACrC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,wBAAwB,EAAE,IAAI;IAC9B,eAAe,EAAE,IAAI;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kBAAkB,EAAE,IAAI;CACzB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAC1G,EAAE,OAAO,EAAE,2DAA2D,EAAE,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACjC,kBAAkB,EAAE,QAAQ;IAC5B,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,mCAAmC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC,MAAM,EAAE;IACX,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY,CAAC,MAAM,EACjI,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;AAI9D,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAC5C,kBAAkB,EAAE,QAAQ;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7F,eAAe,EAAE,QAAQ;IACzB,QAAQ,EAAE,wBAAwB;IAClC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAClE,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAiBrG,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,qGAAqG,CAAC,CAAC;IACnK,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAA4B;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACtE,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC,0CAA0C,EAAE,6FAA6F,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;QAChG,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,wFAAwF,CAAC,CAAC;IACnJ,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,cAAc,CAAC,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE,mEAAmE,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,CAAC,yBAAyB,KAAK,SAAS,IAAI,OAAO,CAAC,yBAAyB,KAAK,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACzH,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,kEAAkE,CAAC,CAAC;IAChI,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,yBAAyB,CAAC,QAA4B,EAAE,OAAoC,EAAE,GAAW;IACvH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,6CAA6C,CAAC,CAAC;IAC7H,OAAO,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE,4EAA4E,CAAC,CAAC;QAC7I,CAAC;QACD,IAAI,OAAO,CAAC,kBAAkB,KAAK,WAAW,CAAC,kBAAkB,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW;YAChH,OAAO,CAAC,cAAc,KAAK,CAAC,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,QAAQ,CAAC,sCAAsC,EAAE,sEAAsE,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YACtE,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,oEAAoE,CAAC,CAAC;QAClI,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,iBAAiB,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,4CAA4C,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,QAAQ,CAAC,kBAAkB,IAAI,KAAK,CAAC,eAAe,KAAK,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/H,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,iEAAiE,CAAC,CAAC;IACpH,CAAC;IACD,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5H,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,2DAA2D,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
@@ -1,49 +0,0 @@
1
- import { z } from "zod";
2
- import type { DiagnosticReservationInfo } from "./types.js";
3
- export declare const reservationSchema: z.ZodEffects<z.ZodObject<{
4
- reservation_id: z.ZodString;
5
- rpc_request_id: z.ZodOptional<z.ZodString>;
6
- inventory_hostname: z.ZodString;
7
- diagnostic: z.ZodLiteral<"ping">;
8
- state: z.ZodEnum<["active", "uncertain"]>;
9
- reserved_at: z.ZodString;
10
- uncertain_since: z.ZodOptional<z.ZodString>;
11
- reason_code: z.ZodOptional<z.ZodString>;
12
- }, "strict", z.ZodTypeAny, {
13
- inventory_hostname: string;
14
- state: "active" | "uncertain";
15
- reservation_id: string;
16
- diagnostic: "ping";
17
- reserved_at: string;
18
- rpc_request_id?: string | undefined;
19
- uncertain_since?: string | undefined;
20
- reason_code?: string | undefined;
21
- }, {
22
- inventory_hostname: string;
23
- state: "active" | "uncertain";
24
- reservation_id: string;
25
- diagnostic: "ping";
26
- reserved_at: string;
27
- rpc_request_id?: string | undefined;
28
- uncertain_since?: string | undefined;
29
- reason_code?: string | undefined;
30
- }>, {
31
- inventory_hostname: string;
32
- state: "active" | "uncertain";
33
- reservation_id: string;
34
- diagnostic: "ping";
35
- reserved_at: string;
36
- rpc_request_id?: string | undefined;
37
- uncertain_since?: string | undefined;
38
- reason_code?: string | undefined;
39
- }, {
40
- inventory_hostname: string;
41
- state: "active" | "uncertain";
42
- reservation_id: string;
43
- diagnostic: "ping";
44
- reserved_at: string;
45
- rpc_request_id?: string | undefined;
46
- uncertain_since?: string | undefined;
47
- reason_code?: string | undefined;
48
- }>;
49
- export declare function parseReservation(value: unknown): DiagnosticReservationInfo;