@corca-org/ceal-host-win32-x64 1.0.5 → 1.0.7

package/libexec/ceal-host/codex-producer.mjs

@@ -146,6 +146,7 @@ var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate
 var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
 var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
 var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
+var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "profile_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
 var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
   "approval_not_required_by_policy",
   "interactive_pending",
@@ -402,7 +403,13 @@ var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
   max_string_length: OPERATION_SCHEMA_LITERAL_MAX_BYTES / 4,
   max_alternatives: 8,
   max_enum_values: 64,
-  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES
+  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES,
+  /** @basis our_policy -- bounds explanatory schema prose carried in one catalog. */
+  max_description_characters: 1024,
+  /** @basis our_policy -- bounds regular-expression compilation input from one schema. */
+  max_pattern_characters: 256,
+  /** @basis our_policy -- bounds traversal work inside one already byte-bounded schema literal. */
+  max_literal_nodes: 512
 });
 
 // packages/ceal-client-protocol/src/operation-validation-primitives.ts
@@ -422,6 +429,9 @@ function requireIsoTimestamp(value, message) {
   if (typeof value !== "string" || !ISO_TIMESTAMP.test(value) || !Number.isFinite(Date.parse(value))) throw new TypeError(message);
 }
 
+// packages/ceal-client-protocol/src/operation-json-schema.ts
+var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
+
 // packages/ceal-client-protocol/src/operation-contract-validation.ts
 var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["profile", "instance_binding", "target", "admission_recheck"]);
 var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
@@ -522,7 +532,6 @@ var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
   control_commit: (root) => join(root, "control-auto-commit.jsonl"),
   engagement_signal: (root) => join(root, "runtime-state", "slack-feedback.jsonl"),
   runtime_error: (root) => join(root, "runtime-state", "runtime-errors.jsonl"),
-  provider_retry: (root) => join(root, "observability", "provider-retry-queue", "queue.jsonl"),
   turn_bridge_request: (root) => join(root, ".ceal", "turn-bridge", "requests.jsonl"),
   channel_log: (root) => join(root, "log.jsonl"),
   thread_run_events: (root) => join(root, "run-events.jsonl"),
@@ -531,8 +540,6 @@ var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
   gateway_capability_audit: (root) => join(root, "capability-audit.jsonl"),
   gateway_retrieval_waste_partition: (root) => `${root}.jsonl`,
   gateway_access_policy_publication: (root) => join(root, "access-policy-publications.jsonl"),
-  gateway_event_lease_journal: (root) => `${root}.journal.jsonl`,
-  gateway_control_audit: (root) => `${root}.control-audits.jsonl`,
   gateway_profile_connector_control_audit: (root) => `${root}.audit.jsonl`,
   gateway_profile_connector_scope_audit: (root) => join(root, "profile-connector-scope-audit.jsonl"),
   gateway_profile_connector_activity_scope_audit: (root) => join(root, "profile-connector-activity-scope-audit.jsonl"),
@@ -547,6 +554,11 @@ var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
   gateway_admin_access_token: (root) => join(root, "access-tokens.jsonl")
 });
 
+// packages/ceal-client-protocol/src/gateway-installation-activation.ts
+var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_DATA_CHARACTERS = 32;
+var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_CHECK_CHARACTERS = 8;
+var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_COMPACT_CHARACTERS = CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_DATA_CHARACTERS + CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_CHECK_CHARACTERS;
+
 // packages/ceal-client-protocol/src/host-registration.ts
 var CEAL_HOST_REGISTRATION_RESULT_KEYS = Object.freeze(["credential_generation", "host_access_token", "host_installation_ref", "host_source_ref", "ok", "registration_attempt_ref", "schema_version", "status"]);
 
@@ -1121,7 +1133,7 @@ var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
 // packages/ceal-client-protocol/src/leased-consumer-vocabulary.ts
 var CEAL_TERMINAL_DISPOSITIONS = vocabulary(["completed", "failed", "cancelled"]);
 var CEAL_LEASE_DISPOSITIONS = vocabulary([...CEAL_TERMINAL_DISPOSITIONS, "deferred"]);
-var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["reaction", "progress_start", "progress_finish"]);
+var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["initial"]);
 var CEAL_LEASED_MESSAGE_DELIVERY_CAPABILITY_IDS = vocabulary(["message.create", "message.update", "message.delete"]);
 var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
 var CEAL_RESULT_DELIVERY_OFFERS = vocabulary(["pending", "offered", "transport_lost"]);
@@ -1261,6 +1273,7 @@ function isAbsoluteNormalizedNonRootPath(value, flavor = process.platform, allow
 // host/producer-service.ts
 var MAX_CONFIG_BYTES = 32 * 1024;
 var SAFE_REF2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+var HOST_PRODUCER_SERVE_COMMAND_PREFIX = ["serve", "--config"];
 var HostProducerServiceError = class extends Error {
   code;
   constructor(code, message = code) {
@@ -1297,7 +1310,7 @@ function hostProducerError(code, message = code) {
   return new HostProducerServiceError(code, message);
 }
 function parseProducerServeArgs(args, platform, error) {
-  if (args.length !== 3 || args[0] !== "serve" || args[1] !== "--config") throw error("invalid_arguments", refusalFact("args", args, "serve --config <absolute path>"));
+  if (args.length !== HOST_PRODUCER_SERVE_COMMAND_PREFIX.length + 1 || args[0] !== HOST_PRODUCER_SERVE_COMMAND_PREFIX[0] || args[1] !== HOST_PRODUCER_SERVE_COMMAND_PREFIX[1]) throw error("invalid_arguments", refusalFact("args", args, "serve --config <absolute path>"));
   assertProducerAbsolutePath(args[2], platform, "config", error);
   return args[2];
 }
@@ -1431,6 +1444,7 @@ function boundedMilliseconds(value) {
 // host/relay/src/producer-frame.ts
 var HOST_PRODUCER_FRAME_SCHEMA = "ceal.host_producer_frame.v1";
 var HOST_PRODUCER_MAX_JSON_BYTES = 262144;
+var HOST_PRODUCER_FRAME_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
 var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var DIGEST2 = /^[a-f0-9]{64}$/u;
 var PRODUCERS = /* @__PURE__ */ new Set(["codex", "claude"]);
@@ -1450,18 +1464,18 @@ function encodeHostProducerFrame(frame) {
   validateFrame(frame);
   const json = Buffer.from(JSON.stringify(frame), "utf8");
   if (json.byteLength > HOST_PRODUCER_MAX_JSON_BYTES) throw new HostProducerFrameError("frame_too_large", `frame_too_large: ${refusalFact("frame_bytes", json.byteLength, `at most ${HOST_PRODUCER_MAX_JSON_BYTES}`)}`);
-  const result = Buffer.allocUnsafe(json.byteLength + 4);
+  const result = Buffer.allocUnsafe(json.byteLength + HOST_PRODUCER_FRAME_LENGTH_BYTES);
   result.writeUInt32BE(json.byteLength, 0);
-  json.copy(result, 4);
+  json.copy(result, HOST_PRODUCER_FRAME_LENGTH_BYTES);
   return result;
 }
 function decodeHostProducerFrame(input) {
-  if (input.byteLength < 4) throw new HostProducerFrameError("frame_truncated", `frame_truncated: ${refusalFact("frame_bytes", input.byteLength, "at least 4")}`);
+  if (input.byteLength < HOST_PRODUCER_FRAME_LENGTH_BYTES) throw new HostProducerFrameError("frame_truncated", `frame_truncated: ${refusalFact("frame_bytes", input.byteLength, `at least ${HOST_PRODUCER_FRAME_LENGTH_BYTES}`)}`);
   const length = input.readUInt32BE(0);
   if (length > HOST_PRODUCER_MAX_JSON_BYTES) throw new HostProducerFrameError("frame_too_large", `frame_too_large: ${refusalFact("declared_bytes", length, `at most ${HOST_PRODUCER_MAX_JSON_BYTES}`)}`);
   if (length === 0) throw new HostProducerFrameError("invalid_frame_length");
-  if (input.byteLength !== length + 4) throw new HostProducerFrameError(input.byteLength < length + 4 ? "frame_truncated" : "invalid_frame_length");
-  const bytes = input.subarray(4);
+  if (input.byteLength !== length + HOST_PRODUCER_FRAME_LENGTH_BYTES) throw new HostProducerFrameError(input.byteLength < length + HOST_PRODUCER_FRAME_LENGTH_BYTES ? "frame_truncated" : "invalid_frame_length");
+  const bytes = input.subarray(HOST_PRODUCER_FRAME_LENGTH_BYTES);
   const text = new TextDecoder("utf-8", { fatal: true });
   let value;
   try {
@@ -1608,6 +1622,8 @@ var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
   "host_input_ref"
 ]);
 var HOST_RELAY_IPC_RESPONSE_SCHEMA = "ceal.host_relay_admission.v1";
+var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
+var HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES = 4096;
 var HostRelayIpcError = class extends Error {
   code;
   constructor(code, message = code) {
@@ -1661,12 +1677,12 @@ function exchange(endpoint, encoded, timeoutMs, decode) {
   });
 }
 function decodeHostRelayIpcResponse(input) {
-  if (input.length < 4) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response is truncated: ${refusalFact("response_bytes", input.byteLength, "at least 4")}.`);
+  if (input.length < HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response is truncated: ${refusalFact("response_bytes", input.byteLength, `at least ${HOST_RELAY_IPC_LENGTH_BYTES}`)}.`);
   const length = input.readUInt32BE(0);
-  if (length === 0 || length > 4096 || input.length !== length + 4) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response length is invalid: ${refusalFacts([{ name: "declared_bytes", value: length, expected: "between 1 and 4096" }, { name: "received_bytes", value: input.byteLength, expected: `exactly ${length + 4}` }])}.`);
+  if (length === 0 || length > HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES || input.length !== length + HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response length is invalid: ${refusalFacts([{ name: "declared_bytes", value: length, expected: `between 1 and ${HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES}` }, { name: "received_bytes", value: input.byteLength, expected: `exactly ${length + HOST_RELAY_IPC_LENGTH_BYTES}` }])}.`);
   let value;
   try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input.subarray(4)));
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input.subarray(HOST_RELAY_IPC_LENGTH_BYTES)));
   } catch {
     throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC response is invalid.");
   }
@@ -1689,11 +1705,11 @@ function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function decodeResponseBuffer(buffer) {
-  if (buffer.length < 4) return null;
+  if (buffer.length < HOST_RELAY_IPC_LENGTH_BYTES) return null;
   const length = buffer.readUInt32BE(0);
-  if (length === 0 || length > 4096) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response length is invalid: ${refusalFact("declared_bytes", length, "between 1 and 4096")}.`);
-  if (buffer.length < length + 4) return null;
-  if (buffer.length !== length + 4) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC returned trailing bytes: ${refusalFacts([{ name: "declared_bytes", value: length, expected: "the received message length minus 4" }, { name: "received_bytes", value: buffer.byteLength, expected: `exactly ${length + 4}` }])}.`);
+  if (length === 0 || length > HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response length is invalid: ${refusalFact("declared_bytes", length, `between 1 and ${HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES}`)}.`);
+  if (buffer.length < length + HOST_RELAY_IPC_LENGTH_BYTES) return null;
+  if (buffer.length !== length + HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC returned trailing bytes: ${refusalFacts([{ name: "declared_bytes", value: length, expected: `the received message length minus ${HOST_RELAY_IPC_LENGTH_BYTES}` }, { name: "received_bytes", value: buffer.byteLength, expected: `exactly ${length + HOST_RELAY_IPC_LENGTH_BYTES}` }])}.`);
   return decodeHostRelayIpcResponse(buffer);
 }
 
@@ -1824,6 +1840,7 @@ function isRecord2(value) {
 
 // host/codex/src/codex-outbox.ts
 var SAFE_REF4 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+var CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS = 4096;
 var CodexOutboxStore = class {
   directory;
   entriesDirectory;
@@ -2190,13 +2207,13 @@ function validateRegistration(value) {
 }
 function validateRegistrationFields(value) {
   if (![value.host_source_ref, value.host_session_ref, value.codex_session_id].every((candidate) => typeof candidate === "string" && SAFE_REF4.test(candidate))) throw storageError(`Codex transcript registration references are malformed (${refusalFacts([{ name: "host_source_ref", value: value.host_source_ref }, { name: "host_session_ref", value: value.host_session_ref }, { name: "codex_session_id", value: value.codex_session_id }])}).`);
-  if (!validRegistrationCwd(value.cwd)) throw storageError(`Codex transcript registration working directory is malformed (${refusalFact("cwd_characters", typeof value.cwd === "string" ? value.cwd.length : 0, "an absolute path of at most 4096 characters")}).`);
+  if (!validRegistrationCwd(value.cwd)) throw storageError(`Codex transcript registration working directory is malformed (${refusalFact("cwd_characters", typeof value.cwd === "string" ? value.cwd.length : 0, `an absolute path of at most ${CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS} characters`)}).`);
   if (typeof value.transcript_path !== "string") throw storageError(`Codex transcript registration path is malformed (${refusalFact("kind", typeof value.transcript_path, "string")}).`);
-  if (value.transcript_path.length === 0 || value.transcript_path.length > 4096) throw storageError(`Codex transcript registration path is malformed (${refusalFact("characters", value.transcript_path.length, "from 1 through 4096")}).`);
+  if (value.transcript_path.length === 0 || value.transcript_path.length > CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS) throw storageError(`Codex transcript registration path is malformed (${refusalFact("characters", value.transcript_path.length, `from 1 through ${CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS}`)}).`);
   if (!isTimestamp(value.registered_at) || !isTimestamp(value.expires_at)) throw storageError(`Codex transcript registration timestamps are malformed (${refusalFacts([{ name: "registered_at", value: value.registered_at }, { name: "expires_at", value: value.expires_at }])}).`);
 }
 function validRegistrationCwd(value) {
-  return value === void 0 || typeof value === "string" && isAbsolute(value) && value.length <= 4096 && !value.includes("\0");
+  return value === void 0 || typeof value === "string" && isAbsolute(value) && value.length <= CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS && !value.includes("\0");
 }
 function validateCursor(value) {
   if (!isRecord3(value)) throw storageError("Codex transcript cursor is malformed.");