@dharma-ai-labs/agent-fabric 0.2.208 → 0.2.210

package/dist/schemas/device-signing-recovery-offer-response.schema.json

@@ -0,0 +1,43 @@
+{
+  "$schema":"https://json-schema.org/draft/2020-12/schema",
+  "$id":"https://schemas.dharma-ai.io/device-signing-recovery-offer-response/v1",
+  "title":"Public pending challenge for its exact prepared device; always not ready",
+  "$comment":"Runtime additionally validates the original preparation and every local challenge binding, immutable expiry, exact next generation and distinct root. No intent, candidate keyset, credential, consent or installation is returned.",
+  "oneOf":[
+    {
+      "type":"object","additionalProperties":false,
+      "required":["schema","organizationId","deviceId","preparationId","expiresAt","state","deviceProofRegistered","clientTrustInstalled","ready"],
+      "properties":{
+        "schema":{"const":"dharma.device-signing-recovery-offer-response/v1"},
+        "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+        "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},
+        "expiresAt":{"type":"string","format":"date-time","maxLength":40},"state":{"const":"awaiting_browser_offer"},
+        "deviceProofRegistered":{"const":false},"clientTrustInstalled":{"const":false},"ready":{"const":false}
+      }
+    },
+    {
+      "type":"object","additionalProperties":false,
+      "required":["schema","organizationId","deviceId","preparationId","expiresAt","state","deviceProofRegistered","clientTrustInstalled","ready","challenge"],
+      "properties":{
+        "schema":{"const":"dharma.device-signing-recovery-offer-response/v1"},
+        "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+        "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},
+        "expiresAt":{"type":"string","format":"date-time","maxLength":40},"state":{"const":"awaiting_device_proof"},
+        "deviceProofRegistered":{"const":false},"clientTrustInstalled":{"const":false},"ready":{"const":false},
+        "challenge":{"oneOf":[{"$ref":"https://schemas.dharma-ai.io/device-signing-recovery-challenge/v1"},{"$ref":"https://schemas.dharma-ai.io/device-signing-maintenance-challenge/v1"}]}
+      }
+    },
+    {
+      "type":"object","additionalProperties":false,
+      "required":["schema","organizationId","deviceId","preparationId","expiresAt","state","deviceProofRegistered","clientTrustInstalled","ready","challenge"],
+      "properties":{
+        "schema":{"const":"dharma.device-signing-recovery-offer-response/v1"},
+        "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+        "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},
+        "expiresAt":{"type":"string","format":"date-time","maxLength":40},"state":{"const":"pending_approval"},
+        "deviceProofRegistered":{"const":true},"clientTrustInstalled":{"const":false},"ready":{"const":false},
+        "challenge":{"oneOf":[{"$ref":"https://schemas.dharma-ai.io/device-signing-recovery-challenge/v1"},{"$ref":"https://schemas.dharma-ai.io/device-signing-maintenance-challenge/v1"}]}
+      }
+    }
+  ]
+}

package/dist/schemas/device-signing-recovery-plan.schema.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-plan/v1",
+  "title": "Read-only local signing recovery context; not proof or authorization",
+  "$comment": "Issuer must equal origin; the existing protected anchor is matched to config. Current server source/session/role policy and recipient/owner approval must still be independently checked. This plan never establishes private-key possession or signing authority.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "planId", "authority", "preparedAt", "expiresAt", "origin", "issuer", "audience", "organizationId", "recipientMembershipId", "deviceId", "installationId", "workspaceId", "publicKeyEd25519", "repositoryFingerprint", "policyRevision", "scopeDigest", "contractDigest", "sourceSelectionDigest", "nativeSessionBindingDigest", "previousAnchorHash", "protectedConfigDigest", "previousGeneration", "previousKeysetHash", "previousRootFingerprint"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-plan/v1"},
+    "planId": {"$ref": "#/$defs/uuid"},
+    "authority": {"const": "local_context_only_not_recovery_authorization"},
+    "preparedAt": {"type": "string", "format": "date-time"},
+    "expiresAt": {"type": "string", "format": "date-time"},
+    "origin": {"type": "string", "maxLength": 256, "format": "uri", "pattern": "^https://[^/@?#\\s]+$(?![\\s\\S])"},
+    "issuer": {"type": "string", "maxLength": 256, "format": "uri", "pattern": "^https://[^/@?#\\s]+$(?![\\s\\S])"},
+    "audience": {"const": "dharma.agent-fabric.signing-recovery/v1"},
+    "organizationId": {"type": "string", "maxLength": 256, "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+    "recipientMembershipId": {"$ref": "#/$defs/uuid"},
+    "deviceId": {"$ref": "#/$defs/uuid"},
+    "installationId": {"$ref": "#/$defs/uuid"},
+    "workspaceId": {"$ref": "#/$defs/uuid"},
+    "publicKeyEd25519": {"type": "string", "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$(?![\\s\\S])"},
+    "repositoryFingerprint": {"$ref": "#/$defs/digest"},
+    "policyRevision": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$(?![\\s\\S])"},
+    "scopeDigest": {"$ref": "#/$defs/digest"},
+    "contractDigest": {"$ref": "#/$defs/digest"},
+    "sourceSelectionDigest": {"$ref": "#/$defs/digest"},
+    "nativeSessionBindingDigest": {"$ref": "#/$defs/digest"},
+    "previousAnchorHash": {"$ref": "#/$defs/digest"},
+    "protectedConfigDigest": {"$ref": "#/$defs/digest"},
+    "previousGeneration": {"type": "integer", "minimum": 1, "maximum": 9007199254740991},
+    "previousKeysetHash": {"$ref": "#/$defs/digest"},
+    "previousRootFingerprint": {"$ref": "#/$defs/digest"}
+  },
+  "$defs": {
+    "uuid": {"type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+    "digest": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$(?![\\s\\S])"}
+  }
+}

package/dist/schemas/device-signing-recovery-preparation.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-preparation/v1",
+  "title": "Device-attested recovery preparation; not consent, enrollment or trust activation",
+  "$comment": "Runtime binds every plan field to independently obtained local expectations and verifies the historical keyset hash/signature at its original expiry. The server separately checks current member/device/source and frozen server history. Native session metadata is device-attested, not independently observed. No secret, token or arbitrary approval flag is accepted.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "purpose", "method", "path", "plan", "historicalKeysetCanonical", "historicalRootPublicKey", "credentialEncryptionPublicKey", "nonce"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-preparation/v1"},
+    "purpose": {"const": "prepare_expired_signing_trust_recovery"},
+    "method": {"const": "POST"},
+    "path": {"const": "/api/v1/agent-fabric/signing-recovery/preparations"},
+    "plan": {"$ref": "https://schemas.dharma-ai.io/device-signing-recovery-plan/v1"},
+    "historicalKeysetCanonical": {"type": "string", "minLength": 2, "maxLength": 16384},
+    "historicalRootPublicKey": {"$ref": "#/$defs/bytes32"},
+    "credentialEncryptionPublicKey": {"$ref": "#/$defs/bytes32"},
+    "nonce": {"$ref": "#/$defs/bytes32"}
+  },
+  "$defs": {
+    "bytes32": {"type": "string", "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$(?![\\s\\S])"}
+  }
+}

package/dist/schemas/provider-session-recovery-declaration.schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/provider-session-recovery-declaration/v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "organizationId", "workspaceId", "repositoryBindingId", "endpointId", "membershipId", "deviceId", "bindingId", "provider", "sessionId", "toolHash", "recordedAt"],
+  "properties": {
+    "schema": {"const": "dharma.provider-session-recovery-declaration/v1"},
+    "organizationId": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$"},
+    "workspaceId": {"type": "string", "format": "uuid"},
+    "repositoryBindingId": {"type": "string", "format": "uuid"},
+    "endpointId": {"type": "string", "format": "uuid"},
+    "membershipId": {"type": "string", "format": "uuid"},
+    "deviceId": {"type": "string", "format": "uuid"},
+    "bindingId": {"type": "string", "format": "uuid"},
+    "provider": {"const": "codex"},
+    "sessionId": {"type": "string", "pattern": "^[A-Za-z0-9_-]{1,128}$"},
+    "toolHash": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$"},
+    "recordedAt": {"type": "string", "format": "date-time"}
+  }
+}

package/dist/signingMaintenanceCohort.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signingMaintenanceCohort.test.d.ts.map

package/dist/signingMaintenanceCohort.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signingMaintenanceCohort.test.d.ts","sourceRoot":"","sources":["../src/signingMaintenanceCohort.test.ts"],"names":[],"mappings":""}

package/dist/signingMaintenanceCohort.test.js

@@ -0,0 +1,55 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { posix } from 'node:path';
+import { compileFunction } from 'node:vm';
+import test from 'node:test';
+import ts from 'typescript';
+async function caller(overrides = {}) {
+    const source = await readFile(new URL('../src/index.ts', import.meta.url), 'utf8');
+    const ast = ts.createSourceFile('index.ts', source, ts.ScriptTarget.Latest, true);
+    const node = ast.statements.find(value => ts.isFunctionDeclaration(value) && value.name?.text === 'assertSigningMaintenanceManagedCohort');
+    assert.ok(node, 'the real CLI must verify the installed managed cohort before maintenance');
+    const compiled = ts.transpileModule(node.getText(ast), { compilerOptions: { target: ts.ScriptTarget.ES2023, module: ts.ModuleKind.CommonJS } });
+    const startup = { version: '0.2.210', workspace: '/fixture/repo', launcher: '/fixture/repo/.dharma/bin/dharma', policy: '/fixture/repo/.dharma/approved-policy.json' };
+    const calls = [], deps = { VERSION: '0.2.210', process: { platform: 'linux' }, resolve: posix.resolve,
+        realpath: async (path) => path,
+        lstat: async () => ({ isFile: () => true, isSymbolicLink: () => false, size: 10, ino: 1, dev: 1, mtimeMs: 1, ctimeMs: 1 }),
+        inspectOwnedRelayAutostart: async () => { calls.push('inspect'); return startup; },
+        readFile: async (path) => { calls.push(path); return path.endsWith('dharma.cmd') ? 'windows' : 'shell'; },
+        verifyRecordedRepositoryLaunchers: async (version, launchers) => {
+            assert.equal(version, '0.2.210');
+            assert.deepEqual(launchers, { shell: 'shell', windows: 'windows' });
+            calls.push('verify');
+            return true;
+        },
+        sha256: (value) => value, ...overrides };
+    const run = compileFunction(compiled.outputText + '\nreturn assertSigningMaintenanceManagedCohort;', ['exports', ...Object.keys(deps)])({}, ...Object.values(deps));
+    return { run, startup, calls };
+}
+test('actual CLI rejects an older or mismatched managed startup before accepting maintenance authority', async () => {
+    for (const field of ['version', 'workspace', 'launcher', 'policy']) {
+        const f = await caller();
+        f.startup[field] = 'old-or-foreign';
+        await assert.rejects(f.run('/fixture/home', '/fixture/repo'), /managed_cohort_upgrade_required/);
+        assert.deepEqual(f.calls, ['inspect']);
+    }
+});
+test('actual CLI requires recorded current-version launcher parity rather than version metadata alone', async () => {
+    const f = await caller({ verifyRecordedRepositoryLaunchers: async () => false });
+    await assert.rejects(f.run('/fixture/home', '/fixture/repo'), /managed_cohort_upgrade_required/);
+});
+test('actual CLI returns a non-secret cohort digest only after owned startup and launcher verification', async () => {
+    const f = await caller();
+    assert.equal(typeof await f.run('/fixture/home', '/fixture/repo'), 'string');
+    assert.equal(f.calls.at(-1), 'verify');
+});
+test('actual CLI refuses symlink, oversized or changing launcher files before accepting the cohort', async () => {
+    for (const kind of ['symlink', 'oversized', 'changed']) {
+        let reads = 0;
+        const f = await caller({ lstat: async () => ({ isFile: () => true, isSymbolicLink: () => kind === 'symlink',
+                size: kind === 'oversized' ? 65537 : 10, ino: kind === 'changed' ? ++reads : 1, dev: 1, mtimeMs: 1, ctimeMs: 1 }) });
+        await assert.rejects(f.run('/fixture/home', '/fixture/repo'), /managed_cohort_upgrade_required/);
+        assert.equal(f.calls.includes('verify'), false);
+    }
+});
+//# sourceMappingURL=signingMaintenanceCohort.test.js.map

package/dist/signingMaintenanceCohort.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signingMaintenanceCohort.test.js","sourceRoot":"","sources":["../src/signingMaintenanceCohort.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAC,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAC,KAAK,EAAC,MAAM,WAAW,CAAC;AAChC,OAAO,EAAC,eAAe,EAAC,MAAM,SAAS,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,KAAK,UAAU,MAAM,CAAC,YAAiC,EAAE;IACvD,MAAM,MAAM,GAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAC,MAAM,EAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAE,KAAK,CAAC,IAAI,EAAE,IAAI,KAAG,uCAAuC,CAAC,CAAC;IACnI,MAAM,CAAC,EAAE,CAAC,IAAI,EAAC,0EAA0E,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAC,EAAC,eAAe,EAAC,EAAC,MAAM,EAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAC,MAAM,EAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAC,EAAC,CAAC,CAAC;IACrI,MAAM,OAAO,GAAC,EAAC,OAAO,EAAC,SAAS,EAAC,SAAS,EAAC,eAAe,EAAC,QAAQ,EAAC,kCAAkC,EAAC,MAAM,EAAC,4CAA4C,EAAC,CAAC;IAC5J,MAAM,KAAK,GAAU,EAAE,EAAC,IAAI,GAAwB,EAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,EAAC,OAAO,EAAC,KAAK,CAAC,OAAO;QACrH,QAAQ,EAAC,KAAK,EAAC,IAAW,EAAC,EAAE,CAAA,IAAI;QACjC,KAAK,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,MAAM,EAAC,GAAE,EAAE,CAAA,IAAI,EAAC,cAAc,EAAC,GAAE,EAAE,CAAA,KAAK,EAAC,IAAI,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,GAAG,EAAC,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,CAAC;QACnG,0BAA0B,EAAC,KAAK,IAAE,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA,OAAO,OAAO,CAAC,CAAA,CAAC;QAC3E,QAAQ,EAAC,KAAK,EAAC,IAAW,EAAC,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,OAAO,CAAC,CAAA,CAAC;QACrG,iCAAiC,EAAC,KAAK,EAAC,OAAc,EAAC,SAAiB,EAAC,EAAE;YACzE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAC,SAAS,CAAC,CAAC;YAAA,MAAM,CAAC,SAAS,CAAC,SAAS,EAAC,EAAC,KAAK,EAAC,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,CAAC,CAAC;YAAA,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;QAClI,MAAM,EAAC,CAAC,KAAY,EAAC,EAAE,CAAA,KAAK,EAAC,GAAG,SAAS,EAAC,CAAC;IAC7C,MAAM,GAAG,GAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,GAAC,iDAAiD,EAC7F,CAAC,SAAS,EAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAoD,CAAC;IAClH,OAAO,EAAC,GAAG,EAAC,OAAO,EAAC,KAAK,EAAC,CAAC;AAC7B,CAAC;AACD,IAAI,CAAC,kGAAkG,EAAC,KAAK,IAAE,EAAE;IAC/G,KAAI,MAAM,KAAK,IAAI,CAAC,SAAS,EAAC,WAAW,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAC,CAAC;QAC9D,MAAM,CAAC,GAAC,MAAM,MAAM,EAAE,CAAC;QAAC,CAAC,CAAC,OAAiC,CAAC,KAAK,CAAC,GAAC,gBAAgB,CAAC;QACpF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAC,eAAe,CAAC,EAAC,iCAAiC,CAAC,CAAC;QAC/F,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,iGAAiG,EAAC,KAAK,IAAE,EAAE;IAC9G,MAAM,CAAC,GAAC,MAAM,MAAM,CAAC,EAAC,iCAAiC,EAAC,KAAK,IAAE,EAAE,CAAA,KAAK,EAAC,CAAC,CAAC;IACzE,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAC,eAAe,CAAC,EAAC,iCAAiC,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,kGAAkG,EAAC,KAAK,IAAE,EAAE;IAC/G,MAAM,CAAC,GAAC,MAAM,MAAM,EAAE,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,eAAe,EAAC,eAAe,CAAC,EAAC,QAAQ,CAAC,CAAC;IAClG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAC,QAAQ,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,8FAA8F,EAAC,KAAK,IAAE,EAAE;IAC3G,KAAI,MAAM,IAAI,IAAI,CAAC,SAAS,EAAC,WAAW,EAAC,SAAS,CAAC,EAAC,CAAC;QACnD,IAAI,KAAK,GAAC,CAAC,CAAC;QACZ,MAAM,CAAC,GAAC,MAAM,MAAM,CAAC,EAAC,KAAK,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,MAAM,EAAC,GAAE,EAAE,CAAA,IAAI,EAAC,cAAc,EAAC,GAAE,EAAE,CAAA,IAAI,KAAG,SAAS;gBACxF,IAAI,EAAC,IAAI,KAAG,WAAW,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,EAAE,EAAC,GAAG,EAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,KAAK,CAAA,CAAC,CAAA,CAAC,EAAC,GAAG,EAAC,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,CAAC;QAChG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAC,eAAe,CAAC,EAAC,iCAAiC,CAAC,CAAC;QAC/F,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAC,KAAK,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/usage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS,QAKyY,CAAC"}
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS,QAM46B,CAAC"}

package/dist/usage.js

@@ -1,8 +1,9 @@
-const COMMAND_USAGE = 'Usage: dharma <bootstrap|onboard|login|status|sessions start|sessions status|sessions readiness|sessions work|sessions stop|sessions audit|demo connect|demo transport-connect|demo status|demo package|demo package-status|demo watch|demo watch-enable|demo watch-status|demo watch-disable|demo role|demo peers|demo ask|demo reply|demo inbox|demo ack|demo resume|demo signing-client-proof|demo signing-owner-proof|providers list|repositories discover|repositories connect|repositories list|repositories status|repositories snapshot|repositories recover-installer|repositories role-register|repositories role-discover|repositories ask|repositories reply|workspace add|workspace sync|workspace recover-registry|evidence preview|evidence capture|evidence capture-batch|evidence sync|evidence run-request|relay container-entrypoint|relay probe|relay start|relay stop|relay upgrade|relay autostart status|relay autostart disable|assistant chat|assistant history|assistant status|assistant approve|assistant reject|organization status|agents list|agents bind-runtime|evaluations validate|evaluations launch|evaluations status|evaluations results|experiments list|experiments run|failures list|remediations list|remediations act|tasks list|tasks dispatch|handoffs list|skills list|skills release|skills rollout|skills rollback|skills sync|skills status|skills verify|usage list> [options]';
+const COMMAND_USAGE = 'Usage: dharma <bootstrap|onboard|login|status|signing-recovery|sessions start|sessions status|sessions readiness|sessions work|sessions stop|sessions audit|demo connect|demo transport-connect|demo status|demo package|demo package-status|demo watch|demo watch-enable|demo watch-status|demo watch-disable|demo role|demo peers|demo ask|demo reply|demo inbox|demo ack|demo resume|demo signing-client-proof|demo signing-owner-proof|providers list|repositories discover|repositories connect|repositories list|repositories status|repositories snapshot|repositories recover-installer|repositories role-register|repositories role-discover|repositories ask|repositories reply|workspace add|workspace sync|workspace recover-registry|evidence preview|evidence capture|evidence capture-batch|evidence sync|evidence run-request|relay container-entrypoint|relay probe|relay start|relay stop|relay upgrade|relay autostart status|relay autostart disable|assistant chat|assistant history|assistant status|assistant approve|assistant reject|organization status|agents list|agents bind-runtime|evaluations validate|evaluations launch|evaluations status|evaluations results|experiments list|experiments run|failures list|remediations list|remediations act|tasks list|tasks dispatch|handoffs list|skills list|skills release|skills rollout|skills rollback|skills sync|skills status|skills verify|usage list> [options]';
 export const CLI_USAGE = COMMAND_USAGE + '\n\nLinux named-Codex setup entry: setup codex --portal-context-sha256 <copied-context-hash> --portal-prompt-sha256 <copied-public-prompt-checksum> --portal-url <origin> --organization-id <org> --setup-reference <public-reference> --workspace <checkout> [--maximum-provider-cost-cents <1..25>] [--dry-run]. Fetches and verifies canonical public portal instructions; this is not attestation of the enclosing human message. Alternatively, legacy --stdin requires the entire original public prompt and cannot combine with either portal hash. No file, secret or human terminal entry. Requires the intended qualified private DHARMA_HOME and existing CODEX_HOME. This starts an owned named setup session with the bound tool; it does not attach to an existing desktop chat. Matching-recipient browser device approval remains required. A refused/expired/interrupted attempt is not retried. Dry-run verifies only public preparation, not execution admission or readiness. The local reservation is conservative unresolved exposure, not an invoice cap.\n\nAgent setup compatibility: bootstrap --setup-reference <public-reference> --setup-recipient-membership-id <membership> --setup-scope-digest <sha256> --setup-contract-digest <sha256> --complete [exact source/portal options]. Run inside the coding agent; approve the exact device in the browser. No terminal secret input. --dry-run produces a grant-free plan. Reference setup cannot combine with --grant, --grant-prompt, --resume, replacement, join or disabled relay startup. Legacy private setup: bootstrap --grant-prompt [exact portal options], with USER-only private terminal entry. Enrolled recovery: bootstrap --resume --complete [exact scoped options], with no grant/reference.'
     + '\n\nReturning device: login --unattended opts in to reuse the approved identity; login --no-unattended disables automatic selection; --dry-run plans either change. login --resume connects once without opting in. login --reauthenticate explicitly requests fresh browser approval for the original protected identity to recover its enrollment anchor; it never replaces keys or configuration. Opted-in bootstrap --complete can omit grants only for the same registered repository and approved policy revision. A compatible membership-guarded server admission response is required. Device admission does not sign in a provider or establish repository readiness. Standing relay lifecycle remains controlled by relay autostart commands.'
     + '\n\nRepository source conflicts: repositories source-resolve --workspace-id <workspace> [--dry-run | --prepare | --apply --plan-hash <sha256> --choose-reviewed-local]. Default is a read-only plan. Review and merge authorized source before preparation; approval is exact-input, expires after 15 minutes and does not publish. Existing relay/evaluation/signing gates remain required.'
     + '\n\nAfter a clear-baseline rollback: repositories restore --workspace-id <workspace> --dry-run reads a current-policy stable signed catalog and plans a fresh candidate. With the owned relay stopped, --apply --plan-hash <reviewed-hash> submits that exact plan through normal evaluation/signing. It never reactivates an archived release, changes enrollment or resets history. Resume the owned relay only after submission; readiness and activation remain separate checks.'
     + '\n\nFor an unresolved restoration upload, an empty lookup is not cancellation. With the owned relay stopped, --apply --plan-hash <original-hash> --fence-upload requests metadata-only fencing under current authority. An admitted operation is returned for ordinary recovery; only a terminal server fence permits checkpoint archival and a new dry-run plan. Fencing does not upload source or activate a release.'
-    + '\n\nRead-only named-session diagnosis: sessions readiness --name <registered-name> --workspace-id <workspace> --diagnostic. Uses the existing owner and unchanged readiness request; never starts a session, runs a model turn or grants access. A closed local failure receipt exits 2 and is not native readiness or permission to retry/restart. No passwords, socket paths or arbitrary remote errors are returned.';
+    + '\n\nRead-only named-session diagnosis: sessions readiness --name <registered-name> --workspace-id <workspace> --diagnostic. Uses the existing owner and unchanged readiness request; never starts a session, runs a model turn or grants access. A closed local failure receipt exits 2 and is not native readiness or permission to retry/restart. No passwords, socket paths or arbitrary remote errors are returned.'
+    + '\n\nDevice signing-trust maintenance: signing-recovery --name <original-name> --workspace-id <workspace> plans without protected-store or network access. --apply --operation-id <fresh-public-UUID> requires the same disabled/stopped original session, protected device and binding, an exclusive device signing-control lease, current source, and fresh recipient plus organization-owner browser consent. The agent controls its existing process with bounded JSONL frames: {"schema":"dharma.device-signing-maintenance-control/v1","operationId":"<same-public-UUID>","action":"progress|complete|status|cancel"}. Use complete only after the exact browser publication receipt. No password, grant, provider login, task, session enable or service restart is accepted. An uncertain action is not automatically retried. Successful trust installation still reports ready:false and nativeContinuationAuthorized:false; ordinary native/task qualification remains separate.';
 //# sourceMappingURL=usage.js.map

package/dist/usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"usage.js","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,m2CAAm2C,CAAC;AAE13C,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,GAAG,+rDAA+rD;MACpuD,0tBAA0tB;MACxtB,8XAA8X;MAC9X,sdAAsd;MACtd,yZAAyZ;MACzZ,yZAAyZ,CAAC"}
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,o3CAAo3C,CAAC;AAE34C,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,GAAG,+rDAA+rD;MACpuD,0tBAA0tB;MACxtB,8XAA8X;MAC9X,sdAAsd;MACtd,yZAAyZ;MACzZ,yZAAyZ;MACzZ,47BAA47B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dharma-ai-labs/agent-fabric",
-  "version": "0.2.208",
+  "version": "0.2.210",
   "description": "Local-first CLI for connecting coding agents to Dharma evaluation, orchestration, and signed Skill delivery",
   "license": "MIT",
   "homepage": "https://github.com/dharma-ai-labs/dharma-agent-fabric/tree/main/packages/cli#readme",
@@ -34,12 +34,12 @@
     "test": "node --test --test-reporter=spec dist/*.test.js"
   },
   "dependencies": {
-    "@dharma-ai-labs/agent-fabric-contracts": "0.1.16",
+    "@dharma-ai-labs/agent-fabric-contracts": "0.1.18",
     "@dharma-ai-labs/agent-fabric-evidence-reduction": "0.2.35",
-    "@dharma-ai-labs/agent-fabric-local-vault": "0.1.31",
+    "@dharma-ai-labs/agent-fabric-local-vault": "0.1.32",
     "@dharma-ai-labs/agent-fabric-policy": "0.1.4",
     "@dharma-ai-labs/agent-fabric-provider-adapters": "0.1.36",
-    "@dharma-ai-labs/agent-fabric-relay-client": "0.2.33",
+    "@dharma-ai-labs/agent-fabric-relay-client": "0.2.34",
     "@dharma-ai-labs/agent-fabric-sdk": "0.1.10",
     "@dharma-ai-labs/agent-fabric-secure-store": "0.1.10",
     "@dharma-ai-labs/agent-fabric-skill-manager": "0.2.11",