@danypops/vehicle-core 0.12.3 → 0.12.5

package/dist/vehicle-approvals.d.ts

@@ -9,6 +9,17 @@
 import type { VehicleEffect, VehiclePrincipal } from "./vehicle-contract.js";
 /** Set once at registry-configuration time (VehicleRegistry.configureApprovals()); never on a per-invoke basis. */
 export declare const DEFAULT_APPROVAL_EFFECTS: readonly VehicleEffect[];
+/**
+ * The name VehicleRegistry.configureApprovals() registers its built-in
+ * grant/deny operation under. Shared so vehicle-client-pi can recognize and
+ * exclude it from Pi tool projection by exact name (see its own use site):
+ * it is invoked only via this package's own approval-required retry dance
+ * using the extension's already-fixed permissions, never meant to be a
+ * model-callable tool -- a model that could call it directly would be able
+ * to grant its own pending approval requests, defeating the human-in-the-
+ * loop point of the gate entirely.
+ */
+export declare const VEHICLE_APPROVAL_RESOLVE_OPERATION_NAME = "vehicle.approval.resolve";
 /** How long a request stays resolvable before it lapses and must be re-requested. */
 export declare const DEFAULT_APPROVAL_TIMEOUT_MS: number;
 /** Emitted (as a Vehicle Event) the moment a gated-effect invoke() has no valid capability -- durable-first, before any interactive prompt is attempted. */

package/dist/vehicle-approvals.js

@@ -1,6 +1,17 @@
 import { defineVehicleEvent, defineVehicleSchema } from "./vehicle-contract.js";
 /** Set once at registry-configuration time (VehicleRegistry.configureApprovals()); never on a per-invoke basis. */
 export const DEFAULT_APPROVAL_EFFECTS = ["destructive", "open-world"];
+/**
+ * The name VehicleRegistry.configureApprovals() registers its built-in
+ * grant/deny operation under. Shared so vehicle-client-pi can recognize and
+ * exclude it from Pi tool projection by exact name (see its own use site):
+ * it is invoked only via this package's own approval-required retry dance
+ * using the extension's already-fixed permissions, never meant to be a
+ * model-callable tool -- a model that could call it directly would be able
+ * to grant its own pending approval requests, defeating the human-in-the-
+ * loop point of the gate entirely.
+ */
+export const VEHICLE_APPROVAL_RESOLVE_OPERATION_NAME = "vehicle.approval.resolve";
 /** How long a request stays resolvable before it lapses and must be re-requested. */
 export const DEFAULT_APPROVAL_TIMEOUT_MS = 5 * 60_000;
 const requestedPayloadSchema = defineVehicleSchema({

package/dist/vehicle-watchers.d.ts

@@ -29,6 +29,19 @@ export declare class WatchLimitExceeded extends Error {
     readonly max: number;
     constructor(scope: string, max: number);
 }
+/**
+ * Raised when watchId already identifies a registration, in this scope or any other.
+ * add() previously let a duplicate id silently overwrite byId's entry while leaving
+ * the id behind in its original scope's byScope Set, corrupting both indexes: the
+ * original scope kept counting a watch whose byId lookup now pointed at the wrong
+ * scope/resource/topic (or, after remove(), a permanent phantom entry that could
+ * never itself be looked up but still consumed that scope's own bound forever).
+ * Fails closed instead, before either index is touched.
+ */
+export declare class WatchIdConflict extends Error {
+    readonly watchId: string;
+    constructor(watchId: string);
+}
 export interface WatchRegistryOptions {
     /** Defaults to DEFAULT_MAX_WATCHES_PER_SCOPE. */
     readonly maxWatchesPerScope?: number;

package/dist/vehicle-watchers.js

@@ -28,6 +28,23 @@ export class WatchLimitExceeded extends Error {
         this.name = "WatchLimitExceeded";
     }
 }
+/**
+ * Raised when watchId already identifies a registration, in this scope or any other.
+ * add() previously let a duplicate id silently overwrite byId's entry while leaving
+ * the id behind in its original scope's byScope Set, corrupting both indexes: the
+ * original scope kept counting a watch whose byId lookup now pointed at the wrong
+ * scope/resource/topic (or, after remove(), a permanent phantom entry that could
+ * never itself be looked up but still consumed that scope's own bound forever).
+ * Fails closed instead, before either index is touched.
+ */
+export class WatchIdConflict extends Error {
+    watchId;
+    constructor(watchId) {
+        super(`watchId "${watchId}" is already registered -- watch ids must be unique across every scope`);
+        this.watchId = watchId;
+        this.name = "WatchIdConflict";
+    }
+}
 export class WatchRegistry {
     byId = new Map();
     byScope = new Map();
@@ -36,6 +53,8 @@ export class WatchRegistry {
         this.maxWatchesPerScope = options.maxWatchesPerScope ?? DEFAULT_MAX_WATCHES_PER_SCOPE;
     }
     add(scope, resource, watchId, topic) {
+        if (this.byId.has(watchId))
+            throw new WatchIdConflict(watchId);
         const existing = this.byScope.get(scope) ?? new Set();
         if (existing.size >= this.maxWatchesPerScope)
             throw new WatchLimitExceeded(scope, this.maxWatchesPerScope);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@danypops/vehicle-core",
-	"version": "0.12.3",
+	"version": "0.12.5",
 	"description": "Vehicle's runtime-neutral wire contract: operation descriptors, schema codecs, failure shapes. Zero runtime dependencies, zero Bun-specific code -- the one thing every Vehicle client and server package depends on.",
 	"license": "MIT",
 	"type": "module",
@@ -19,7 +19,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "^22.0.0",
-		"typescript": "^5.9.2"
+		"typescript": "^5.9.3"
 	},
 	"repository": {
 		"type": "git",

package/src/vehicle-approvals.ts

@@ -12,6 +12,18 @@ import { defineVehicleEvent, defineVehicleSchema } from "./vehicle-contract.js";
 /** Set once at registry-configuration time (VehicleRegistry.configureApprovals()); never on a per-invoke basis. */
 export const DEFAULT_APPROVAL_EFFECTS: readonly VehicleEffect[] = ["destructive", "open-world"];
 
+/**
+ * The name VehicleRegistry.configureApprovals() registers its built-in
+ * grant/deny operation under. Shared so vehicle-client-pi can recognize and
+ * exclude it from Pi tool projection by exact name (see its own use site):
+ * it is invoked only via this package's own approval-required retry dance
+ * using the extension's already-fixed permissions, never meant to be a
+ * model-callable tool -- a model that could call it directly would be able
+ * to grant its own pending approval requests, defeating the human-in-the-
+ * loop point of the gate entirely.
+ */
+export const VEHICLE_APPROVAL_RESOLVE_OPERATION_NAME = "vehicle.approval.resolve";
+
 /** How long a request stays resolvable before it lapses and must be re-requested. */
 export const DEFAULT_APPROVAL_TIMEOUT_MS = 5 * 60_000;
 

package/src/vehicle-watchers.ts

@@ -37,6 +37,22 @@ export class WatchLimitExceeded extends Error {
 	}
 }
 
+/**
+ * Raised when watchId already identifies a registration, in this scope or any other.
+ * add() previously let a duplicate id silently overwrite byId's entry while leaving
+ * the id behind in its original scope's byScope Set, corrupting both indexes: the
+ * original scope kept counting a watch whose byId lookup now pointed at the wrong
+ * scope/resource/topic (or, after remove(), a permanent phantom entry that could
+ * never itself be looked up but still consumed that scope's own bound forever).
+ * Fails closed instead, before either index is touched.
+ */
+export class WatchIdConflict extends Error {
+	constructor(readonly watchId: string) {
+		super(`watchId "${watchId}" is already registered -- watch ids must be unique across every scope`);
+		this.name = "WatchIdConflict";
+	}
+}
+
 export interface WatchRegistryOptions {
 	/** Defaults to DEFAULT_MAX_WATCHES_PER_SCOPE. */
 	readonly maxWatchesPerScope?: number;
@@ -52,6 +68,7 @@ export class WatchRegistry {
 	}
 
 	add(scope: string, resource: string, watchId: string, topic: string): WatchRegistration {
+		if (this.byId.has(watchId)) throw new WatchIdConflict(watchId);
 		const existing = this.byScope.get(scope) ?? new Set();
 		if (existing.size >= this.maxWatchesPerScope) throw new WatchLimitExceeded(scope, this.maxWatchesPerScope);
 		const registration: WatchRegistration = { watchId, scope, resource, topic };