@fungi.computer/truffle 0.0.0-stage → 0.2.0

package/dist/private-fungi-pending-logouts.js

@@ -0,0 +1,135 @@
+import { mkdir, open } from "node:fs/promises";
+import { dirname } from "node:path";
+import { decodeJwt } from "jose";
+import lockfile from "proper-lockfile";
+import writeFileAtomic from "write-file-atomic";
+import { z } from "zod";
+import { logEvent } from "./log-event.js";
+const identitySchema = z.strictObject({
+    issuer: z.url().max(2048),
+    userId: z.string().min(1).max(256),
+    loginId: z.string().min(1).max(256),
+});
+const detachSchema = z.strictObject({
+    teamId: z.string().min(1).max(256),
+    computerId: z.string().min(1).max(256),
+    requestId: z.string().min(1).max(256),
+});
+const recordSchema = identitySchema.extend({
+    revoke: z.boolean(),
+    detaches: z.array(detachSchema).max(16),
+});
+const recordsSchema = z.array(recordSchema).max(128);
+const missingFile = z.object({ code: z.literal("ENOENT") });
+/** Decode only routing metadata. These IDs never authorize a revocation. */
+export function loginIdentity(issuer, access) {
+    try {
+        const claims = decodeJwt(access);
+        return identitySchema.parse({
+            issuer,
+            userId: claims.sub,
+            loginId: claims["https://fungi.computer/oauth/login"],
+        });
+    }
+    catch (cause) {
+        logEvent("fungi-account.pending-revoke-identity", cause);
+        return undefined;
+    }
+}
+function matches(left, right) {
+    return (left.issuer === right.issuer &&
+        left.userId === right.userId &&
+        left.loginId === right.loginId);
+}
+/** Durable logout intent, separate from the credential that logout destroys. */
+export function pendingLogouts(credentialPath) {
+    const path = `${credentialPath}.pending-logouts.json`;
+    async function update(change) {
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        const release = await lockfile.lock(path, {
+            realpath: false,
+            stale: 30_000,
+            update: 10_000,
+            retries: { retries: 20, factor: 1.2, minTimeout: 25, maxTimeout: 100 },
+        });
+        try {
+            let records = [];
+            try {
+                const file = await open(path, "r");
+                try {
+                    if ((await file.stat()).size > 256 * 1024)
+                        throw new Error("Pending revocations exceed the storage limit");
+                    records = recordsSchema.parse(JSON.parse(await file.readFile("utf8")));
+                }
+                finally {
+                    await file.close();
+                }
+            }
+            catch (cause) {
+                if (!missingFile.safeParse(cause).success)
+                    throw cause;
+            }
+            const changed = change(records);
+            const serialized = JSON.stringify(recordsSchema.parse(changed.records));
+            if (Buffer.byteLength(serialized) > 256 * 1024)
+                throw new Error("Pending revocations exceed the storage limit");
+            await writeFileAtomic(path, serialized, {
+                encoding: "utf8",
+                fsync: true,
+                mode: 0o600,
+            });
+            return changed.result;
+        }
+        finally {
+            await release();
+        }
+    }
+    return {
+        remember(identity, detaches) {
+            return update((records) => {
+                const next = [
+                    ...records.filter((record) => !matches(record, identity)),
+                    recordSchema.parse({ ...identity, revoke: true, detaches }),
+                ];
+                let evicted = false;
+                while (next.length > 128 ||
+                    Buffer.byteLength(JSON.stringify(next)) > 256 * 1024) {
+                    next.shift();
+                    evicted = true;
+                }
+                if (evicted)
+                    logEvent("fungi-account.pending-logout-evicted", new Error("Oldest logout intent evicted at storage limit"));
+                return { records: next, result: undefined };
+            });
+        },
+        confirmed(identity, detach) {
+            return update((records) => ({
+                records: records
+                    .map((record) => {
+                    if (!matches(record, identity))
+                        return record;
+                    return detach === undefined
+                        ? { ...record, revoke: false }
+                        : {
+                            ...record,
+                            detaches: record.detaches.filter((item) => item.teamId !== detach.teamId ||
+                                item.computerId !== detach.computerId ||
+                                item.requestId !== detach.requestId),
+                        };
+                })
+                    .filter((record) => record.revoke || record.detaches.length > 0),
+                result: undefined,
+            }));
+        },
+        forAccount(identity) {
+            return update((records) => {
+                const kept = records.filter((record) => record.issuer === identity.issuer &&
+                    record.userId === identity.userId);
+                return {
+                    records: kept,
+                    result: kept,
+                };
+            });
+        },
+    };
+}

package/dist/private-fungi-service-logout.d.ts

@@ -0,0 +1,44 @@
+import type { FetchLike } from "@modelcontextprotocol/client";
+import { z } from "zod";
+export declare const fungiAccountLogoutRequestSchema: z.ZodObject<{
+    credentialPath: z.ZodString;
+    endpoint: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type FungiAccountLogoutRequest = z.infer<typeof fungiAccountLogoutRequestSchema>;
+export declare const fungiAccountLogoutResultSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "not-logged-in": "not-logged-in";
+        removed: "removed";
+        revoked: "revoked";
+    }>;
+    message: z.ZodString;
+    unconfirmedComputers: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** A logout outcome: never a remote-revocation claim the issuer didn't confirm. */
+export type FungiAccountLogoutResult = Readonly<{
+    kind: "not-logged-in" | "removed" | "revoked";
+    message: string;
+    unconfirmedComputers: readonly Readonly<{
+        name: string;
+        url: string;
+    }>[];
+}>;
+/**
+ * Route a logout to the running Local account owner. It never starts,
+ * upgrades, stops or replaces a service. With no service, the caller's own
+ * offline clear runs under the ordinary startup lock, so a service cannot
+ * start between proving its absence and the store mutation. A live owner
+ * that cannot be reached fails closed.
+ */
+export declare function signOutFungiThroughLocalService(endpoint: string | URL | undefined, options: {
+    credentialPath: string;
+    directory: string;
+    fetch?: FetchLike;
+    clearOffline: (endpoint: string | URL | undefined, input: {
+        credentialPath: string;
+        fetch?: FetchLike;
+    }) => Promise<FungiAccountLogoutResult>;
+}): Promise<FungiAccountLogoutResult>;

package/dist/private-fungi-service-logout.js

@@ -0,0 +1,59 @@
+import { newWebSocketRpcSession } from "@fungi.computer/capnweb";
+import { z } from "zod";
+import { acquireServiceLock, readLiveServiceStatus, readServiceRegistration, serviceDirectory, serviceOwnerIsLive, } from "./private-local-service-discovery.js";
+export const fungiAccountLogoutRequestSchema = z.strictObject({
+    credentialPath: z.string().min(1),
+    endpoint: z.string().optional(),
+});
+export const fungiAccountLogoutResultSchema = z.strictObject({
+    kind: z.enum(["not-logged-in", "removed", "revoked"]),
+    message: z.string(),
+    unconfirmedComputers: z.array(z.strictObject({ name: z.string(), url: z.string() })),
+});
+/**
+ * Route a logout to the running Local account owner. It never starts,
+ * upgrades, stops or replaces a service. With no service, the caller's own
+ * offline clear runs under the ordinary startup lock, so a service cannot
+ * start between proving its absence and the store mutation. A live owner
+ * that cannot be reached fails closed.
+ */
+export async function signOutFungiThroughLocalService(endpoint, options) {
+    const { clearOffline, directory: requested, ...input } = options;
+    const directory = await serviceDirectory(requested);
+    const release = await acquireServiceLock(directory, "startup");
+    try {
+        const registration = await readServiceRegistration(directory);
+        const owned = await serviceOwnerIsLive(directory);
+        if (registration?.kind !== "current") {
+            if (owned)
+                throw new Error("The running Local account owner is unavailable");
+            return await clearOffline(endpoint, input);
+        }
+        const probe = await readLiveServiceStatus(registration.record);
+        if (probe.kind !== "running") {
+            if (owned || probe.kind === "unavailable")
+                throw new Error("The running Local account owner is unavailable");
+            return await clearOffline(endpoint, input);
+        }
+        const service = probe.service;
+        const url = new URL(`${service.baseUrl}/service/${service.serviceId}/auth`);
+        url.protocol = "ws:";
+        const socket = new WebSocket(url);
+        const remote = newWebSocketRpcSession(socket);
+        try {
+            const request = {
+                credentialPath: input.credentialPath,
+            };
+            if (endpoint !== undefined)
+                request.endpoint = endpoint.toString();
+            return fungiAccountLogoutResultSchema.parse(await remote.signOutFungi(request));
+        }
+        finally {
+            remote[Symbol.dispose]();
+            socket.close();
+        }
+    }
+    finally {
+        await release();
+    }
+}

package/dist/private-invocation-computer.d.ts

@@ -0,0 +1,58 @@
+import * as ChildProcess from "effect/process/ChildProcess";
+import type { KnapsackComputer } from "@fungi.computer/knapsack";
+import { z } from "zod";
+import { type PrivateLocalProcessScope } from "./private-local-computer-processes.js";
+import type { SandboxCommand } from "./private-local-containment.js";
+/** The host admits each launch; undefined is its explicit unavailable fallback. */
+export type LocalSandboxLaunch = (cwd: string, argv: readonly [string, ...string[]]) => SandboxCommand | undefined;
+declare const execOutput: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    exitCode: z.ZodNumber;
+    stdout: z.ZodString;
+    stderr: z.ZodString;
+    truncated: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+        stream: z.ZodEnum<{
+            stdout: "stdout";
+            stderr: "stderr";
+        }>;
+        keptBytes: z.ZodNumber;
+        totalBytes: z.ZodNumber;
+    }, z.core.$strict>>]>;
+    status: z.ZodEnum<{
+        failed: "failed";
+        completed: "completed";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    exitCode: z.ZodNumber;
+    stdout: z.ZodString;
+    stderr: z.ZodString;
+    truncated: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+        stream: z.ZodEnum<{
+            stdout: "stdout";
+            stderr: "stderr";
+        }>;
+        keptBytes: z.ZodNumber;
+        totalBytes: z.ZodNumber;
+    }, z.core.$strict>>]>;
+    status: z.ZodLiteral<"deadline_exceeded">;
+    timeoutMs: z.ZodNumber;
+    elapsedMs: z.ZodNumber;
+    message: z.ZodString;
+}, z.core.$strict>], "status">;
+export type ExecOutput = z.output<typeof execOutput>;
+/** Shared bounded native process owner; callers supply argv/stdin, never shell interpolation. */
+export declare function runPrivateInvocationProcess(processCommand: ChildProcess.Command, signal: AbortSignal, timeoutMs: number | undefined, describe?: Readonly<{
+    /** The timeout actually requested, before any clamp; defaults to `timeoutMs`. */
+    requestedMs?: number;
+    /** The real command text, for the timeout message; omitted when not meaningful (e.g. a native helper). */
+    describeCommand?: () => string;
+}>): Promise<ExecOutput>;
+/**
+ * Construct one private invocation-root Computer: bounded shell exec, plus the
+ * background-process operations of `processes` when the host supplies a scope.
+ */
+export declare function createPrivateInvocationComputer(invocationRoot: string, executionPath?: string, processes?: PrivateLocalProcessScope, 
+/** Selected host home; standalone callers capture it before any await. */
+home?: string, 
+/** Native Local always supplies its live per-Agent admission callback. */
+sandbox?: LocalSandboxLaunch): Promise<KnapsackComputer>;
+export {};