@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/access-grant.js

@@ -0,0 +1,199 @@
+import { DEFAULT_IROH_REMOTE_ALLOW_TOOLS, normalizeIrohRemoteAllowTools } from "./protocol.js";
+export const IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION = 1;
+export const IROH_REMOTE_RPC_CAPABILITIES = [
+    "conversation.observe.v1",
+    "conversation.control.v1",
+    "model.select.v1",
+    "integrations.manage.v1",
+    "worktrees.manage.v1",
+    "host.manage.v1",
+    "workspace.manage.v1",
+    "diagnostics.upload.v1",
+];
+export const IROH_REMOTE_ACCESS_PRESET_NAMES = ["coding", "review", "chat", "full"];
+const STANDARD_CAPABILITIES = Object.freeze([
+    "conversation.observe.v1",
+    "conversation.control.v1",
+    "model.select.v1",
+]);
+export const IROH_REMOTE_ACCESS_PRESETS = Object.freeze({
+    coding: Object.freeze({
+        name: "coding",
+        allowedTools: DEFAULT_IROH_REMOTE_ALLOW_TOOLS,
+        capabilities: STANDARD_CAPABILITIES,
+    }),
+    review: Object.freeze({
+        name: "review",
+        allowedTools: "read,grep,find,ls",
+        capabilities: STANDARD_CAPABILITIES,
+    }),
+    chat: Object.freeze({ name: "chat", allowedTools: "", capabilities: STANDARD_CAPABILITIES }),
+    full: Object.freeze({
+        name: "full",
+        allowedTools: DEFAULT_IROH_REMOTE_ALLOW_TOOLS,
+        capabilities: Object.freeze([...IROH_REMOTE_RPC_CAPABILITIES]),
+    }),
+});
+const CAPABILITY_SET = new Set(IROH_REMOTE_RPC_CAPABILITIES);
+const PRESET_NAME_SET = new Set(IROH_REMOTE_ACCESS_PRESET_NAMES);
+export function isIrohRemoteAccessPresetName(value) {
+    return typeof value === "string" && PRESET_NAME_SET.has(value);
+}
+export function getIrohRemoteAccessPreset(name) {
+    return IROH_REMOTE_ACCESS_PRESETS[name];
+}
+export function createIrohRemoteRpcGrant(capabilities, revision = 1) {
+    return parseIrohRemoteRpcGrant({
+        schemaVersion: IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION,
+        revision,
+        capabilities: [...capabilities],
+    });
+}
+export function createIrohRemotePresetAccess(name, revision = 1) {
+    const preset = getIrohRemoteAccessPreset(name);
+    return {
+        allowedTools: preset.allowedTools,
+        rpcGrant: createIrohRemoteRpcGrant(preset.capabilities, revision),
+    };
+}
+export function createIrohRemoteExplicitAccess(allowedTools, rpcCapabilities, revision = 1) {
+    return {
+        allowedTools: normalizeIrohRemoteAllowTools(allowedTools.join(",")),
+        rpcGrant: createIrohRemoteRpcGrant(rpcCapabilities, revision),
+    };
+}
+export function parseIrohRemoteRpcCapabilities(value, label = "rpc capabilities") {
+    if (!Array.isArray(value)) {
+        throw new Error(`${label} must be an array`);
+    }
+    const capabilities = [];
+    const seen = new Set();
+    for (const entry of value) {
+        if (typeof entry !== "string" || !CAPABILITY_SET.has(entry)) {
+            throw new Error(`${label} contains unknown capability: ${String(entry)}`);
+        }
+        if (seen.has(entry)) {
+            throw new Error(`${label} must not contain duplicates: ${entry}`);
+        }
+        seen.add(entry);
+        capabilities.push(entry);
+    }
+    return capabilities;
+}
+export function parseIrohRemoteRpcGrant(value, label = "rpc grant") {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    const grant = value;
+    if (grant.schemaVersion !== IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION) {
+        throw new Error(`${label} schemaVersion must be ${IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION}`);
+    }
+    if (typeof grant.revision !== "number" || !Number.isSafeInteger(grant.revision) || grant.revision < 1) {
+        throw new Error(`${label} revision must be a safe integer greater than or equal to 1`);
+    }
+    return {
+        schemaVersion: IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION,
+        revision: grant.revision,
+        capabilities: parseIrohRemoteRpcCapabilities(grant.capabilities, `${label} capabilities`),
+    };
+}
+export function cloneIrohRemoteRpcGrant(grant) {
+    return { schemaVersion: 1, revision: grant.revision, capabilities: [...grant.capabilities] };
+}
+const BASELINE_COMMANDS = new Set(["register_push_target", "register_live_activity", "unregister_live_activity"]);
+const OBSERVE_COMMANDS = new Set([
+    "get_state",
+    "get_transcript",
+    "get_message_images",
+    "get_ui_capabilities",
+    "get_ui_actions",
+    "get_ui_action_completions",
+    "list_sessions",
+    "list_worktrees",
+    "list_workspace_directories",
+    "get_keep_awake",
+]);
+const CONTROL_COMMANDS = new Set([
+    "prompt",
+    "steer",
+    "follow_up",
+    "abort",
+    "new_session",
+    "switch_session_by_id",
+    "invoke_ui_action",
+    "extension_ui_response",
+]);
+const MCP_COMMANDS = new Set([
+    "get_mcp_capabilities",
+    "list_mcp_servers",
+    "get_mcp_server",
+    "connect_mcp_server",
+    "refresh_mcp_server",
+    "set_mcp_server_enabled",
+    "list_mcp_recent_calls",
+    "list_mcp_tools",
+    "get_mcp_tool",
+    "list_mcp_resources",
+    "read_mcp_resource",
+    "list_mcp_prompts",
+    "get_mcp_prompt",
+    "disconnect_mcp_server",
+    "start_mcp_server_auth",
+    "poll_mcp_server_auth",
+    "cancel_mcp_server_auth",
+    "logout_mcp_server",
+    "set_web_search_key",
+    "get_web_search_status",
+]);
+const HOST_COMMANDS = new Set(["get_pending_host_actions", "host_action_response", "set_keep_awake"]);
+export function getIrohRemoteRpcCommandCapabilities(command) {
+    if (command.type === "set_client_capabilities") {
+        return Array.isArray(command.features) && command.features.includes("host_action_requests.v1")
+            ? ["host.manage.v1"]
+            : [];
+    }
+    if (BASELINE_COMMANDS.has(command.type))
+        return [];
+    if (OBSERVE_COMMANDS.has(command.type))
+        return ["conversation.observe.v1"];
+    if (CONTROL_COMMANDS.has(command.type))
+        return ["conversation.control.v1"];
+    if (MCP_COMMANDS.has(command.type))
+        return ["integrations.manage.v1"];
+    if (HOST_COMMANDS.has(command.type))
+        return ["host.manage.v1"];
+    if (command.type === "get_available_models")
+        return ["model.select.v1"];
+    if (command.type === "set_model" || command.type === "set_thinking_level") {
+        return command.persistDefault === false ? ["model.select.v1"] : ["model.select.v1", "host.manage.v1"];
+    }
+    if (command.type === "create_worktree" || command.type === "remove_worktree") {
+        return ["worktrees.manage.v1"];
+    }
+    if (command.type === "unregister_workspace")
+        return ["workspace.manage.v1"];
+    if (command.type === "upload_device_logs")
+        return ["diagnostics.upload.v1"];
+    return undefined;
+}
+export function getIrohRemoteStreamCapability(options) {
+    if (options.mode === "conversation")
+        return "conversation.observe.v1";
+    if (options.mode === "workspaceDiscovery")
+        return "conversation.observe.v1";
+    // manage_worktrees is command-sensitive: listing requires observe while
+    // create/remove require worktrees.manage, so the stream itself has no wider gate.
+    if (options.purpose === "manage_worktrees")
+        return undefined;
+    if (options.purpose === "unregister_workspace")
+        return "workspace.manage.v1";
+    return undefined;
+}
+export function getMissingIrohRemoteRpcCapability(grant, required) {
+    const granted = new Set(grant.capabilities);
+    return required.find((capability) => !granted.has(capability));
+}
+export function hasIrohRemoteRpcCapability(grant, capability) {
+    return grant.capabilities.includes(capability);
+}
+//# sourceMappingURL=access-grant.js.map

package/dist/core/remote/iroh/access-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grant.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/access-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAE/F,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAU,CAAC;AAE/D,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC3C,yBAAyB;IACzB,yBAAyB;IACzB,iBAAiB;IACjB,wBAAwB;IACxB,qBAAqB;IACrB,gBAAgB;IAChB,qBAAqB;IACrB,uBAAuB;CACd,CAAC;AAUX,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAS7F,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAA4B;IACtE,yBAAyB;IACzB,yBAAyB;IACzB,iBAAiB;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GACtC,MAAM,CAAC,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,+BAA+B;QAC7C,YAAY,EAAE,qBAAqB;KACnC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,mBAAmB;QACjC,YAAY,EAAE,qBAAqB;KACnC,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAC5F,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM;QACZ,YAAY,EAAE,+BAA+B;QAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,4BAA4B,CAAC,CAAC;KAC9D,CAAC;CACF,CAAC,CAAC;AAEJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;AACrE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,+BAA+B,CAAC,CAAC;AAEzE,MAAM,UAAU,4BAA4B,CAAC,KAAc,EAAuC;IACjG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAAA,CAC/D;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAgC,EAA0B;IACnG,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC;AAAA,CACxC;AAED,MAAM,UAAU,wBAAwB,CACvC,YAAgD,EAChD,QAAQ,GAAG,CAAC,EACS;IACrB,OAAO,uBAAuB,CAAC;QAC9B,aAAa,EAAE,oCAAoC;QACnD,QAAQ;QACR,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAC/B,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,4BAA4B,CAC3C,IAAgC,EAChC,QAAQ,GAAG,CAAC,EAC6C;IACzD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO;QACN,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC;KACjE,CAAC;AAAA,CACF;AAED,MAAM,UAAU,8BAA8B,CAC7C,YAA+B,EAC/B,eAAmD,EACnD,QAAQ,GAAG,CAAC,EAC6C;IACzD,OAAO;QACN,YAAY,EAAE,6BAA6B,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,QAAQ,EAAE,wBAAwB,CAAC,eAAe,EAAE,QAAQ,CAAC;KAC7D,CAAC;AAAA,CACF;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc,EAAE,KAAK,GAAG,kBAAkB,EAA6B;IACrH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,YAAY,GAA8B,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,YAAY,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,YAAY,CAAC;AAAA,CACpB;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,KAAK,GAAG,WAAW,EAAsB;IAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,KAAK,CAAC,aAAa,KAAK,oCAAoC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,oCAAoC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6DAA6D,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACN,aAAa,EAAE,oCAAoC;QACnD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,8BAA8B,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC;KACzF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAyB,EAAsB;IACtF,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;AAAA,CAC7F;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAClH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,gBAAgB;IAChB,oBAAoB;IACpB,qBAAqB;IACrB,gBAAgB;IAChB,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,4BAA4B;IAC5B,gBAAgB;CAChB,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAChC,QAAQ;IACR,OAAO;IACP,WAAW;IACX,OAAO;IACP,aAAa;IACb,sBAAsB;IACtB,kBAAkB;IAClB,uBAAuB;CACvB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC5B,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;IACxB,uBAAuB;IACvB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,wBAAwB;IACxB,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;CACvB,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEtG,MAAM,UAAU,mCAAmC,CAClD,OAAmD,EACF;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAC7F,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACpB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC3E,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC3E,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB;QAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC3E,OAAO,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC9E,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB;QAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,6BAA6B,CAAC,OAG7C,EAAuC;IACvC,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,yBAAyB,CAAC;IACtE,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,yBAAyB,CAAC;IAC5E,wEAAwE;IACxE,kFAAkF;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,sBAAsB;QAAE,OAAO,qBAAqB,CAAC;IAC7E,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,iCAAiC,CAChD,KAAyB,EACzB,QAA4C,EACN;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAAA,CAC/D;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAyB,EAAE,UAAmC,EAAW;IACnH,OAAO,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAAA,CAC/C","sourcesContent":["import { DEFAULT_IROH_REMOTE_ALLOW_TOOLS, normalizeIrohRemoteAllowTools } from \"./protocol.ts\";\n\nexport const IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION = 1 as const;\n\nexport const IROH_REMOTE_RPC_CAPABILITIES = [\n\t\"conversation.observe.v1\",\n\t\"conversation.control.v1\",\n\t\"model.select.v1\",\n\t\"integrations.manage.v1\",\n\t\"worktrees.manage.v1\",\n\t\"host.manage.v1\",\n\t\"workspace.manage.v1\",\n\t\"diagnostics.upload.v1\",\n] as const;\n\nexport type IrohRemoteRpcCapability = (typeof IROH_REMOTE_RPC_CAPABILITIES)[number];\n\nexport interface IrohRemoteRpcGrant {\n\tschemaVersion: typeof IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION;\n\trevision: number;\n\tcapabilities: IrohRemoteRpcCapability[];\n}\n\nexport const IROH_REMOTE_ACCESS_PRESET_NAMES = [\"coding\", \"review\", \"chat\", \"full\"] as const;\nexport type IrohRemoteAccessPresetName = (typeof IROH_REMOTE_ACCESS_PRESET_NAMES)[number];\n\nexport interface IrohRemoteAccessPreset {\n\treadonly name: IrohRemoteAccessPresetName;\n\treadonly allowedTools: string;\n\treadonly capabilities: readonly IrohRemoteRpcCapability[];\n}\n\nconst STANDARD_CAPABILITIES = Object.freeze<IrohRemoteRpcCapability[]>([\n\t\"conversation.observe.v1\",\n\t\"conversation.control.v1\",\n\t\"model.select.v1\",\n]);\n\nexport const IROH_REMOTE_ACCESS_PRESETS: Readonly<Record<IrohRemoteAccessPresetName, IrohRemoteAccessPreset>> =\n\tObject.freeze({\n\t\tcoding: Object.freeze({\n\t\t\tname: \"coding\",\n\t\t\tallowedTools: DEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\t\t\tcapabilities: STANDARD_CAPABILITIES,\n\t\t}),\n\t\treview: Object.freeze({\n\t\t\tname: \"review\",\n\t\t\tallowedTools: \"read,grep,find,ls\",\n\t\t\tcapabilities: STANDARD_CAPABILITIES,\n\t\t}),\n\t\tchat: Object.freeze({ name: \"chat\", allowedTools: \"\", capabilities: STANDARD_CAPABILITIES }),\n\t\tfull: Object.freeze({\n\t\t\tname: \"full\",\n\t\t\tallowedTools: DEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\t\t\tcapabilities: Object.freeze([...IROH_REMOTE_RPC_CAPABILITIES]),\n\t\t}),\n\t});\n\nconst CAPABILITY_SET = new Set<string>(IROH_REMOTE_RPC_CAPABILITIES);\nconst PRESET_NAME_SET = new Set<string>(IROH_REMOTE_ACCESS_PRESET_NAMES);\n\nexport function isIrohRemoteAccessPresetName(value: unknown): value is IrohRemoteAccessPresetName {\n\treturn typeof value === \"string\" && PRESET_NAME_SET.has(value);\n}\n\nexport function getIrohRemoteAccessPreset(name: IrohRemoteAccessPresetName): IrohRemoteAccessPreset {\n\treturn IROH_REMOTE_ACCESS_PRESETS[name];\n}\n\nexport function createIrohRemoteRpcGrant(\n\tcapabilities: readonly IrohRemoteRpcCapability[],\n\trevision = 1,\n): IrohRemoteRpcGrant {\n\treturn parseIrohRemoteRpcGrant({\n\t\tschemaVersion: IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION,\n\t\trevision,\n\t\tcapabilities: [...capabilities],\n\t});\n}\n\nexport function createIrohRemotePresetAccess(\n\tname: IrohRemoteAccessPresetName,\n\trevision = 1,\n): { allowedTools: string; rpcGrant: IrohRemoteRpcGrant } {\n\tconst preset = getIrohRemoteAccessPreset(name);\n\treturn {\n\t\tallowedTools: preset.allowedTools,\n\t\trpcGrant: createIrohRemoteRpcGrant(preset.capabilities, revision),\n\t};\n}\n\nexport function createIrohRemoteExplicitAccess(\n\tallowedTools: readonly string[],\n\trpcCapabilities: readonly IrohRemoteRpcCapability[],\n\trevision = 1,\n): { allowedTools: string; rpcGrant: IrohRemoteRpcGrant } {\n\treturn {\n\t\tallowedTools: normalizeIrohRemoteAllowTools(allowedTools.join(\",\")),\n\t\trpcGrant: createIrohRemoteRpcGrant(rpcCapabilities, revision),\n\t};\n}\n\nexport function parseIrohRemoteRpcCapabilities(value: unknown, label = \"rpc capabilities\"): IrohRemoteRpcCapability[] {\n\tif (!Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an array`);\n\t}\n\tconst capabilities: IrohRemoteRpcCapability[] = [];\n\tconst seen = new Set<string>();\n\tfor (const entry of value) {\n\t\tif (typeof entry !== \"string\" || !CAPABILITY_SET.has(entry)) {\n\t\t\tthrow new Error(`${label} contains unknown capability: ${String(entry)}`);\n\t\t}\n\t\tif (seen.has(entry)) {\n\t\t\tthrow new Error(`${label} must not contain duplicates: ${entry}`);\n\t\t}\n\t\tseen.add(entry);\n\t\tcapabilities.push(entry as IrohRemoteRpcCapability);\n\t}\n\treturn capabilities;\n}\n\nexport function parseIrohRemoteRpcGrant(value: unknown, label = \"rpc grant\"): IrohRemoteRpcGrant {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an object`);\n\t}\n\tconst grant = value as Record<string, unknown>;\n\tif (grant.schemaVersion !== IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION) {\n\t\tthrow new Error(`${label} schemaVersion must be ${IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION}`);\n\t}\n\tif (typeof grant.revision !== \"number\" || !Number.isSafeInteger(grant.revision) || grant.revision < 1) {\n\t\tthrow new Error(`${label} revision must be a safe integer greater than or equal to 1`);\n\t}\n\treturn {\n\t\tschemaVersion: IROH_REMOTE_RPC_GRANT_SCHEMA_VERSION,\n\t\trevision: grant.revision,\n\t\tcapabilities: parseIrohRemoteRpcCapabilities(grant.capabilities, `${label} capabilities`),\n\t};\n}\n\nexport function cloneIrohRemoteRpcGrant(grant: IrohRemoteRpcGrant): IrohRemoteRpcGrant {\n\treturn { schemaVersion: 1, revision: grant.revision, capabilities: [...grant.capabilities] };\n}\n\nconst BASELINE_COMMANDS = new Set([\"register_push_target\", \"register_live_activity\", \"unregister_live_activity\"]);\nconst OBSERVE_COMMANDS = new Set([\n\t\"get_state\",\n\t\"get_transcript\",\n\t\"get_message_images\",\n\t\"get_ui_capabilities\",\n\t\"get_ui_actions\",\n\t\"get_ui_action_completions\",\n\t\"list_sessions\",\n\t\"list_worktrees\",\n\t\"list_workspace_directories\",\n\t\"get_keep_awake\",\n]);\nconst CONTROL_COMMANDS = new Set([\n\t\"prompt\",\n\t\"steer\",\n\t\"follow_up\",\n\t\"abort\",\n\t\"new_session\",\n\t\"switch_session_by_id\",\n\t\"invoke_ui_action\",\n\t\"extension_ui_response\",\n]);\nconst MCP_COMMANDS = new Set([\n\t\"get_mcp_capabilities\",\n\t\"list_mcp_servers\",\n\t\"get_mcp_server\",\n\t\"connect_mcp_server\",\n\t\"refresh_mcp_server\",\n\t\"set_mcp_server_enabled\",\n\t\"list_mcp_recent_calls\",\n\t\"list_mcp_tools\",\n\t\"get_mcp_tool\",\n\t\"list_mcp_resources\",\n\t\"read_mcp_resource\",\n\t\"list_mcp_prompts\",\n\t\"get_mcp_prompt\",\n\t\"disconnect_mcp_server\",\n\t\"start_mcp_server_auth\",\n\t\"poll_mcp_server_auth\",\n\t\"cancel_mcp_server_auth\",\n\t\"logout_mcp_server\",\n\t\"set_web_search_key\",\n\t\"get_web_search_status\",\n]);\nconst HOST_COMMANDS = new Set([\"get_pending_host_actions\", \"host_action_response\", \"set_keep_awake\"]);\n\nexport function getIrohRemoteRpcCommandCapabilities(\n\tcommand: Record<string, unknown> & { type: string },\n): readonly IrohRemoteRpcCapability[] | undefined {\n\tif (command.type === \"set_client_capabilities\") {\n\t\treturn Array.isArray(command.features) && command.features.includes(\"host_action_requests.v1\")\n\t\t\t? [\"host.manage.v1\"]\n\t\t\t: [];\n\t}\n\tif (BASELINE_COMMANDS.has(command.type)) return [];\n\tif (OBSERVE_COMMANDS.has(command.type)) return [\"conversation.observe.v1\"];\n\tif (CONTROL_COMMANDS.has(command.type)) return [\"conversation.control.v1\"];\n\tif (MCP_COMMANDS.has(command.type)) return [\"integrations.manage.v1\"];\n\tif (HOST_COMMANDS.has(command.type)) return [\"host.manage.v1\"];\n\tif (command.type === \"get_available_models\") return [\"model.select.v1\"];\n\tif (command.type === \"set_model\" || command.type === \"set_thinking_level\") {\n\t\treturn command.persistDefault === false ? [\"model.select.v1\"] : [\"model.select.v1\", \"host.manage.v1\"];\n\t}\n\tif (command.type === \"create_worktree\" || command.type === \"remove_worktree\") {\n\t\treturn [\"worktrees.manage.v1\"];\n\t}\n\tif (command.type === \"unregister_workspace\") return [\"workspace.manage.v1\"];\n\tif (command.type === \"upload_device_logs\") return [\"diagnostics.upload.v1\"];\n\treturn undefined;\n}\n\nexport function getIrohRemoteStreamCapability(options: {\n\tmode: \"conversation\" | \"workspaceDiscovery\" | \"workspaceManagement\";\n\tpurpose?: string;\n}): IrohRemoteRpcCapability | undefined {\n\tif (options.mode === \"conversation\") return \"conversation.observe.v1\";\n\tif (options.mode === \"workspaceDiscovery\") return \"conversation.observe.v1\";\n\t// manage_worktrees is command-sensitive: listing requires observe while\n\t// create/remove require worktrees.manage, so the stream itself has no wider gate.\n\tif (options.purpose === \"manage_worktrees\") return undefined;\n\tif (options.purpose === \"unregister_workspace\") return \"workspace.manage.v1\";\n\treturn undefined;\n}\n\nexport function getMissingIrohRemoteRpcCapability(\n\tgrant: IrohRemoteRpcGrant,\n\trequired: readonly IrohRemoteRpcCapability[],\n): IrohRemoteRpcCapability | undefined {\n\tconst granted = new Set(grant.capabilities);\n\treturn required.find((capability) => !granted.has(capability));\n}\n\nexport function hasIrohRemoteRpcCapability(grant: IrohRemoteRpcGrant, capability: IrohRemoteRpcCapability): boolean {\n\treturn grant.capabilities.includes(capability);\n}\n"]}

package/dist/core/remote/iroh/active-stream-registry.d.ts

@@ -0,0 +1,39 @@
+export interface IrohRemoteActiveStreamEntry {
+    readonly clientNodeId: string;
+    readonly workspaceName: string;
+    sessionId: string;
+    readonly connectionId: string;
+    readonly streamId: string;
+    /** Feature strings from the client's last set_client_capabilities. */
+    capabilities?: Set<string>;
+    close(reason: string): Promise<void> | void;
+    write?(value: object): Promise<void> | void;
+    closeConnection?(reason: string): Promise<void> | void;
+}
+export declare class IrohRemoteActiveStreamRegistry {
+    private readonly entriesByClientNodeId;
+    private readonly entriesByConnectionId;
+    get size(): number;
+    register(entry: IrohRemoteActiveStreamEntry): () => void;
+    unregister(entry: IrohRemoteActiveStreamEntry): boolean;
+    entriesForClientNodeId(clientNodeId: string): IrohRemoteActiveStreamEntry[];
+    allEntries(): IrohRemoteActiveStreamEntry[];
+    entriesForWorkspace(clientNodeId: string, workspaceName: string): IrohRemoteActiveStreamEntry[];
+    entriesForWorkspaceName(workspaceName: string): IrohRemoteActiveStreamEntry[];
+    entriesForConversation(clientNodeId: string, workspaceName: string, sessionId: string): IrohRemoteActiveStreamEntry[];
+    /**
+     * All streams bound to (workspaceName, sessionId) regardless of client node id.
+     * A single conversation runtime is shared by co-attached devices, so cross-device
+     * fan-out (e.g. live workflow events) must span every client's bucket, not just
+     * the runtime creator's.
+     */
+    entriesForConversationKey(workspaceName: string, sessionId: string): IrohRemoteActiveStreamEntry[];
+    takeEntriesForConversation(clientNodeId: string, workspaceName: string, sessionId: string): IrohRemoteActiveStreamEntry[];
+    takeEntriesForConversationOnOtherConnections(clientNodeId: string, workspaceName: string, sessionId: string, connectionId: string): IrohRemoteActiveStreamEntry[];
+    entriesForConnection(connectionId: string): IrohRemoteActiveStreamEntry[];
+    hasWorkspaceOnConnection(clientNodeId: string, workspaceName: string, connectionId: string): boolean;
+    hasConversationOnConnection(clientNodeId: string, workspaceName: string, sessionId: string, connectionId: string): boolean;
+    private addToMap;
+    private deleteFromMap;
+}
+//# sourceMappingURL=active-stream-registry.d.ts.map

package/dist/core/remote/iroh/active-stream-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-stream-registry.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/active-stream-registry.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACvD;AAED,qBAAa,8BAA8B;IAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuD;IAC7F,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuD;IAE7F,IAAI,IAAI,IAAI,MAAM,CAMjB;IAED,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAG,MAAM,IAAI,CAWvD;IAED,UAAU,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAItD;IAED,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAE1E;IAED,UAAU,IAAI,2BAA2B,EAAE,CAM1C;IAED,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAE9F;IAED,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAU5E;IAED,sBAAsB,CACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GACf,2BAA2B,EAAE,CAE/B;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAEjG;IAED,0BAA0B,CACzB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GACf,2BAA2B,EAAE,CAM/B;IAED,4CAA4C,CAC3C,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GAClB,2BAA2B,EAAE,CAQ/B;IAED,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAExE;IAED,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAInG;IAED,2BAA2B,CAC1B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GAClB,OAAO,CAOT;IAED,OAAO,CAAC,QAAQ;IAahB,OAAO,CAAC,aAAa;CAerB","sourcesContent":["export interface IrohRemoteActiveStreamEntry {\n\treadonly clientNodeId: string;\n\treadonly workspaceName: string;\n\tsessionId: string;\n\treadonly connectionId: string;\n\treadonly streamId: string;\n\t/** Feature strings from the client's last set_client_capabilities. */\n\tcapabilities?: Set<string>;\n\tclose(reason: string): Promise<void> | void;\n\twrite?(value: object): Promise<void> | void;\n\tcloseConnection?(reason: string): Promise<void> | void;\n}\n\nexport class IrohRemoteActiveStreamRegistry {\n\tprivate readonly entriesByClientNodeId = new Map<string, Set<IrohRemoteActiveStreamEntry>>();\n\tprivate readonly entriesByConnectionId = new Map<string, Set<IrohRemoteActiveStreamEntry>>();\n\n\tget size(): number {\n\t\tlet count = 0;\n\t\tfor (const entries of this.entriesByClientNodeId.values()) {\n\t\t\tcount += entries.size;\n\t\t}\n\t\treturn count;\n\t}\n\n\tregister(entry: IrohRemoteActiveStreamEntry): () => void {\n\t\tlet removed = false;\n\t\tthis.addToMap(this.entriesByClientNodeId, entry.clientNodeId, entry);\n\t\tthis.addToMap(this.entriesByConnectionId, entry.connectionId, entry);\n\t\treturn () => {\n\t\t\tif (removed) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tremoved = true;\n\t\t\tthis.unregister(entry);\n\t\t};\n\t}\n\n\tunregister(entry: IrohRemoteActiveStreamEntry): boolean {\n\t\tconst removedFromClient = this.deleteFromMap(this.entriesByClientNodeId, entry.clientNodeId, entry);\n\t\tconst removedFromConnection = this.deleteFromMap(this.entriesByConnectionId, entry.connectionId, entry);\n\t\treturn removedFromClient || removedFromConnection;\n\t}\n\n\tentriesForClientNodeId(clientNodeId: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn Array.from(this.entriesByClientNodeId.get(clientNodeId) ?? []);\n\t}\n\n\tallEntries(): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries: IrohRemoteActiveStreamEntry[] = [];\n\t\tfor (const clientEntries of this.entriesByClientNodeId.values()) {\n\t\t\tentries.push(...clientEntries);\n\t\t}\n\t\treturn entries;\n\t}\n\n\tentriesForWorkspace(clientNodeId: string, workspaceName: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn this.entriesForClientNodeId(clientNodeId).filter((entry) => entry.workspaceName === workspaceName);\n\t}\n\n\tentriesForWorkspaceName(workspaceName: string): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries: IrohRemoteActiveStreamEntry[] = [];\n\t\tfor (const clientEntries of this.entriesByClientNodeId.values()) {\n\t\t\tfor (const entry of clientEntries) {\n\t\t\t\tif (entry.workspaceName === workspaceName) {\n\t\t\t\t\tentries.push(entry);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn entries;\n\t}\n\n\tentriesForConversation(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t): IrohRemoteActiveStreamEntry[] {\n\t\treturn this.entriesForWorkspace(clientNodeId, workspaceName).filter((entry) => entry.sessionId === sessionId);\n\t}\n\n\t/**\n\t * All streams bound to (workspaceName, sessionId) regardless of client node id.\n\t * A single conversation runtime is shared by co-attached devices, so cross-device\n\t * fan-out (e.g. live workflow events) must span every client's bucket, not just\n\t * the runtime creator's.\n\t */\n\tentriesForConversationKey(workspaceName: string, sessionId: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn this.entriesForWorkspaceName(workspaceName).filter((entry) => entry.sessionId === sessionId);\n\t}\n\n\ttakeEntriesForConversation(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries = this.entriesForConversation(clientNodeId, workspaceName, sessionId);\n\t\tfor (const entry of entries) {\n\t\t\tthis.unregister(entry);\n\t\t}\n\t\treturn entries;\n\t}\n\n\ttakeEntriesForConversationOnOtherConnections(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t\tconnectionId: string,\n\t): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries = this.entriesForConversation(clientNodeId, workspaceName, sessionId).filter(\n\t\t\t(entry) => entry.connectionId !== connectionId,\n\t\t);\n\t\tfor (const entry of entries) {\n\t\t\tthis.unregister(entry);\n\t\t}\n\t\treturn entries;\n\t}\n\n\tentriesForConnection(connectionId: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn Array.from(this.entriesByConnectionId.get(connectionId) ?? []);\n\t}\n\n\thasWorkspaceOnConnection(clientNodeId: string, workspaceName: string, connectionId: string): boolean {\n\t\treturn this.entriesForConnection(connectionId).some(\n\t\t\t(entry) => entry.clientNodeId === clientNodeId && entry.workspaceName === workspaceName,\n\t\t);\n\t}\n\n\thasConversationOnConnection(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t\tconnectionId: string,\n\t): boolean {\n\t\treturn this.entriesForConnection(connectionId).some(\n\t\t\t(entry) =>\n\t\t\t\tentry.clientNodeId === clientNodeId &&\n\t\t\t\tentry.workspaceName === workspaceName &&\n\t\t\t\tentry.sessionId === sessionId,\n\t\t);\n\t}\n\n\tprivate addToMap(\n\t\tmap: Map<string, Set<IrohRemoteActiveStreamEntry>>,\n\t\tkey: string,\n\t\tentry: IrohRemoteActiveStreamEntry,\n\t): void {\n\t\tlet entries = map.get(key);\n\t\tif (!entries) {\n\t\t\tentries = new Set();\n\t\t\tmap.set(key, entries);\n\t\t}\n\t\tentries.add(entry);\n\t}\n\n\tprivate deleteFromMap(\n\t\tmap: Map<string, Set<IrohRemoteActiveStreamEntry>>,\n\t\tkey: string,\n\t\tentry: IrohRemoteActiveStreamEntry,\n\t): boolean {\n\t\tconst entries = map.get(key);\n\t\tif (!entries) {\n\t\t\treturn false;\n\t\t}\n\t\tconst removed = entries.delete(entry);\n\t\tif (entries.size === 0) {\n\t\t\tmap.delete(key);\n\t\t}\n\t\treturn removed;\n\t}\n}\n"]}

package/dist/core/remote/iroh/active-stream-registry.js

@@ -0,0 +1,109 @@
+export class IrohRemoteActiveStreamRegistry {
+    entriesByClientNodeId = new Map();
+    entriesByConnectionId = new Map();
+    get size() {
+        let count = 0;
+        for (const entries of this.entriesByClientNodeId.values()) {
+            count += entries.size;
+        }
+        return count;
+    }
+    register(entry) {
+        let removed = false;
+        this.addToMap(this.entriesByClientNodeId, entry.clientNodeId, entry);
+        this.addToMap(this.entriesByConnectionId, entry.connectionId, entry);
+        return () => {
+            if (removed) {
+                return;
+            }
+            removed = true;
+            this.unregister(entry);
+        };
+    }
+    unregister(entry) {
+        const removedFromClient = this.deleteFromMap(this.entriesByClientNodeId, entry.clientNodeId, entry);
+        const removedFromConnection = this.deleteFromMap(this.entriesByConnectionId, entry.connectionId, entry);
+        return removedFromClient || removedFromConnection;
+    }
+    entriesForClientNodeId(clientNodeId) {
+        return Array.from(this.entriesByClientNodeId.get(clientNodeId) ?? []);
+    }
+    allEntries() {
+        const entries = [];
+        for (const clientEntries of this.entriesByClientNodeId.values()) {
+            entries.push(...clientEntries);
+        }
+        return entries;
+    }
+    entriesForWorkspace(clientNodeId, workspaceName) {
+        return this.entriesForClientNodeId(clientNodeId).filter((entry) => entry.workspaceName === workspaceName);
+    }
+    entriesForWorkspaceName(workspaceName) {
+        const entries = [];
+        for (const clientEntries of this.entriesByClientNodeId.values()) {
+            for (const entry of clientEntries) {
+                if (entry.workspaceName === workspaceName) {
+                    entries.push(entry);
+                }
+            }
+        }
+        return entries;
+    }
+    entriesForConversation(clientNodeId, workspaceName, sessionId) {
+        return this.entriesForWorkspace(clientNodeId, workspaceName).filter((entry) => entry.sessionId === sessionId);
+    }
+    /**
+     * All streams bound to (workspaceName, sessionId) regardless of client node id.
+     * A single conversation runtime is shared by co-attached devices, so cross-device
+     * fan-out (e.g. live workflow events) must span every client's bucket, not just
+     * the runtime creator's.
+     */
+    entriesForConversationKey(workspaceName, sessionId) {
+        return this.entriesForWorkspaceName(workspaceName).filter((entry) => entry.sessionId === sessionId);
+    }
+    takeEntriesForConversation(clientNodeId, workspaceName, sessionId) {
+        const entries = this.entriesForConversation(clientNodeId, workspaceName, sessionId);
+        for (const entry of entries) {
+            this.unregister(entry);
+        }
+        return entries;
+    }
+    takeEntriesForConversationOnOtherConnections(clientNodeId, workspaceName, sessionId, connectionId) {
+        const entries = this.entriesForConversation(clientNodeId, workspaceName, sessionId).filter((entry) => entry.connectionId !== connectionId);
+        for (const entry of entries) {
+            this.unregister(entry);
+        }
+        return entries;
+    }
+    entriesForConnection(connectionId) {
+        return Array.from(this.entriesByConnectionId.get(connectionId) ?? []);
+    }
+    hasWorkspaceOnConnection(clientNodeId, workspaceName, connectionId) {
+        return this.entriesForConnection(connectionId).some((entry) => entry.clientNodeId === clientNodeId && entry.workspaceName === workspaceName);
+    }
+    hasConversationOnConnection(clientNodeId, workspaceName, sessionId, connectionId) {
+        return this.entriesForConnection(connectionId).some((entry) => entry.clientNodeId === clientNodeId &&
+            entry.workspaceName === workspaceName &&
+            entry.sessionId === sessionId);
+    }
+    addToMap(map, key, entry) {
+        let entries = map.get(key);
+        if (!entries) {
+            entries = new Set();
+            map.set(key, entries);
+        }
+        entries.add(entry);
+    }
+    deleteFromMap(map, key, entry) {
+        const entries = map.get(key);
+        if (!entries) {
+            return false;
+        }
+        const removed = entries.delete(entry);
+        if (entries.size === 0) {
+            map.delete(key);
+        }
+        return removed;
+    }
+}
+//# sourceMappingURL=active-stream-registry.js.map

package/dist/core/remote/iroh/active-stream-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-stream-registry.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/active-stream-registry.ts"],"names":[],"mappings":"AAaA,MAAM,OAAO,8BAA8B;IACzB,qBAAqB,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC5E,qBAAqB,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE7F,IAAI,IAAI,GAAW;QAClB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,OAAO,KAAK,CAAC;IAAA,CACb;IAED,QAAQ,CAAC,KAAkC,EAAc;QACxD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,GAAG,EAAE,CAAC;YACZ,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAA,CACvB,CAAC;IAAA,CACF;IAED,UAAU,CAAC,KAAkC,EAAW;QACvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACpG,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACxG,OAAO,iBAAiB,IAAI,qBAAqB,CAAC;IAAA,CAClD;IAED,sBAAsB,CAAC,YAAoB,EAAiC;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAAA,CACtE;IAED,UAAU,GAAkC;QAC3C,MAAM,OAAO,GAAkC,EAAE,CAAC;QAClD,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf;IAED,mBAAmB,CAAC,YAAoB,EAAE,aAAqB,EAAiC;QAC/F,OAAO,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC;IAAA,CAC1G;IAED,uBAAuB,CAAC,aAAqB,EAAiC;QAC7E,MAAM,OAAO,GAAkC,EAAE,CAAC;QAClD,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC;YACjE,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACnC,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;oBAC3C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf;IAED,sBAAsB,CACrB,YAAoB,EACpB,aAAqB,EACrB,SAAiB,EACe;QAChC,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAAA,CAC9G;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,aAAqB,EAAE,SAAiB,EAAiC;QAClG,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAAA,CACpG;IAED,0BAA0B,CACzB,YAAoB,EACpB,aAAqB,EACrB,SAAiB,EACe;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf;IAED,4CAA4C,CAC3C,YAAoB,EACpB,aAAqB,EACrB,SAAiB,EACjB,YAAoB,EACY;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,MAAM,CACzF,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,CAC9C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf;IAED,oBAAoB,CAAC,YAAoB,EAAiC;QACzE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAAA,CACtE;IAED,wBAAwB,CAAC,YAAoB,EAAE,aAAqB,EAAE,YAAoB,EAAW;QACpG,OAAO,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,IAAI,CAClD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,CACvF,CAAC;IAAA,CACF;IAED,2BAA2B,CAC1B,YAAoB,EACpB,aAAqB,EACrB,SAAiB,EACjB,YAAoB,EACV;QACV,OAAO,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,IAAI,CAClD,CAAC,KAAK,EAAE,EAAE,CACT,KAAK,CAAC,YAAY,KAAK,YAAY;YACnC,KAAK,CAAC,aAAa,KAAK,aAAa;YACrC,KAAK,CAAC,SAAS,KAAK,SAAS,CAC9B,CAAC;IAAA,CACF;IAEO,QAAQ,CACf,GAAkD,EAClD,GAAW,EACX,KAAkC,EAC3B;QACP,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAAA,CACnB;IAEO,aAAa,CACpB,GAAkD,EAClD,GAAW,EACX,KAAkC,EACxB;QACV,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf;CACD","sourcesContent":["export interface IrohRemoteActiveStreamEntry {\n\treadonly clientNodeId: string;\n\treadonly workspaceName: string;\n\tsessionId: string;\n\treadonly connectionId: string;\n\treadonly streamId: string;\n\t/** Feature strings from the client's last set_client_capabilities. */\n\tcapabilities?: Set<string>;\n\tclose(reason: string): Promise<void> | void;\n\twrite?(value: object): Promise<void> | void;\n\tcloseConnection?(reason: string): Promise<void> | void;\n}\n\nexport class IrohRemoteActiveStreamRegistry {\n\tprivate readonly entriesByClientNodeId = new Map<string, Set<IrohRemoteActiveStreamEntry>>();\n\tprivate readonly entriesByConnectionId = new Map<string, Set<IrohRemoteActiveStreamEntry>>();\n\n\tget size(): number {\n\t\tlet count = 0;\n\t\tfor (const entries of this.entriesByClientNodeId.values()) {\n\t\t\tcount += entries.size;\n\t\t}\n\t\treturn count;\n\t}\n\n\tregister(entry: IrohRemoteActiveStreamEntry): () => void {\n\t\tlet removed = false;\n\t\tthis.addToMap(this.entriesByClientNodeId, entry.clientNodeId, entry);\n\t\tthis.addToMap(this.entriesByConnectionId, entry.connectionId, entry);\n\t\treturn () => {\n\t\t\tif (removed) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tremoved = true;\n\t\t\tthis.unregister(entry);\n\t\t};\n\t}\n\n\tunregister(entry: IrohRemoteActiveStreamEntry): boolean {\n\t\tconst removedFromClient = this.deleteFromMap(this.entriesByClientNodeId, entry.clientNodeId, entry);\n\t\tconst removedFromConnection = this.deleteFromMap(this.entriesByConnectionId, entry.connectionId, entry);\n\t\treturn removedFromClient || removedFromConnection;\n\t}\n\n\tentriesForClientNodeId(clientNodeId: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn Array.from(this.entriesByClientNodeId.get(clientNodeId) ?? []);\n\t}\n\n\tallEntries(): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries: IrohRemoteActiveStreamEntry[] = [];\n\t\tfor (const clientEntries of this.entriesByClientNodeId.values()) {\n\t\t\tentries.push(...clientEntries);\n\t\t}\n\t\treturn entries;\n\t}\n\n\tentriesForWorkspace(clientNodeId: string, workspaceName: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn this.entriesForClientNodeId(clientNodeId).filter((entry) => entry.workspaceName === workspaceName);\n\t}\n\n\tentriesForWorkspaceName(workspaceName: string): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries: IrohRemoteActiveStreamEntry[] = [];\n\t\tfor (const clientEntries of this.entriesByClientNodeId.values()) {\n\t\t\tfor (const entry of clientEntries) {\n\t\t\t\tif (entry.workspaceName === workspaceName) {\n\t\t\t\t\tentries.push(entry);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn entries;\n\t}\n\n\tentriesForConversation(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t): IrohRemoteActiveStreamEntry[] {\n\t\treturn this.entriesForWorkspace(clientNodeId, workspaceName).filter((entry) => entry.sessionId === sessionId);\n\t}\n\n\t/**\n\t * All streams bound to (workspaceName, sessionId) regardless of client node id.\n\t * A single conversation runtime is shared by co-attached devices, so cross-device\n\t * fan-out (e.g. live workflow events) must span every client's bucket, not just\n\t * the runtime creator's.\n\t */\n\tentriesForConversationKey(workspaceName: string, sessionId: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn this.entriesForWorkspaceName(workspaceName).filter((entry) => entry.sessionId === sessionId);\n\t}\n\n\ttakeEntriesForConversation(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries = this.entriesForConversation(clientNodeId, workspaceName, sessionId);\n\t\tfor (const entry of entries) {\n\t\t\tthis.unregister(entry);\n\t\t}\n\t\treturn entries;\n\t}\n\n\ttakeEntriesForConversationOnOtherConnections(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t\tconnectionId: string,\n\t): IrohRemoteActiveStreamEntry[] {\n\t\tconst entries = this.entriesForConversation(clientNodeId, workspaceName, sessionId).filter(\n\t\t\t(entry) => entry.connectionId !== connectionId,\n\t\t);\n\t\tfor (const entry of entries) {\n\t\t\tthis.unregister(entry);\n\t\t}\n\t\treturn entries;\n\t}\n\n\tentriesForConnection(connectionId: string): IrohRemoteActiveStreamEntry[] {\n\t\treturn Array.from(this.entriesByConnectionId.get(connectionId) ?? []);\n\t}\n\n\thasWorkspaceOnConnection(clientNodeId: string, workspaceName: string, connectionId: string): boolean {\n\t\treturn this.entriesForConnection(connectionId).some(\n\t\t\t(entry) => entry.clientNodeId === clientNodeId && entry.workspaceName === workspaceName,\n\t\t);\n\t}\n\n\thasConversationOnConnection(\n\t\tclientNodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t\tconnectionId: string,\n\t): boolean {\n\t\treturn this.entriesForConnection(connectionId).some(\n\t\t\t(entry) =>\n\t\t\t\tentry.clientNodeId === clientNodeId &&\n\t\t\t\tentry.workspaceName === workspaceName &&\n\t\t\t\tentry.sessionId === sessionId,\n\t\t);\n\t}\n\n\tprivate addToMap(\n\t\tmap: Map<string, Set<IrohRemoteActiveStreamEntry>>,\n\t\tkey: string,\n\t\tentry: IrohRemoteActiveStreamEntry,\n\t): void {\n\t\tlet entries = map.get(key);\n\t\tif (!entries) {\n\t\t\tentries = new Set();\n\t\t\tmap.set(key, entries);\n\t\t}\n\t\tentries.add(entry);\n\t}\n\n\tprivate deleteFromMap(\n\t\tmap: Map<string, Set<IrohRemoteActiveStreamEntry>>,\n\t\tkey: string,\n\t\tentry: IrohRemoteActiveStreamEntry,\n\t): boolean {\n\t\tconst entries = map.get(key);\n\t\tif (!entries) {\n\t\t\treturn false;\n\t\t}\n\t\tconst removed = entries.delete(entry);\n\t\tif (entries.size === 0) {\n\t\t\tmap.delete(key);\n\t\t}\n\t\treturn removed;\n\t}\n}\n"]}

package/dist/core/remote/iroh/audit.d.ts

@@ -0,0 +1,67 @@
+export declare const DEFAULT_IROH_REMOTE_AUDIT_MAX_FILE_BYTES: number;
+export declare const DEFAULT_IROH_REMOTE_AUDIT_MAX_BACKUP_FILES = 2;
+export declare const DEFAULT_IROH_REMOTE_AUDIT_MAX_ENTRY_BYTES: number;
+export declare const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_WINDOW_MS = 60000;
+export declare const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_BURST = 4;
+export interface IrohRemoteAuditEvent {
+    type: string;
+    timestamp: number;
+    clientNodeId?: string;
+    workspace?: string;
+    success?: boolean;
+    error?: string;
+    details?: Record<string, unknown>;
+}
+export type IrohRemoteAuditEventInput = Omit<IrohRemoteAuditEvent, "timestamp"> & {
+    timestamp?: number;
+};
+export interface IrohRemoteAuditSink {
+    write(event: IrohRemoteAuditEvent): void | Promise<void>;
+}
+export interface IrohRemoteSecurityAuditRateLimitOptions {
+    maxEventsPerWindow?: number;
+    windowMs?: number;
+}
+export interface IrohRemoteAuditLoggerOptions {
+    path?: string;
+    sink?: IrohRemoteAuditSink;
+    now?: () => number;
+    maxFileBytes?: number;
+    maxBackupFiles?: number;
+    maxEntryBytes?: number;
+    /** Path-backed daemon logs enable the default limiter unless explicitly disabled. */
+    securityEventRateLimit?: false | IrohRemoteSecurityAuditRateLimitOptions;
+}
+/**
+ * Serialized, owner-only JSONL audit persistence with bounded files. Rejected
+ * unauthenticated traffic is burst-sampled and then represented by aggregate
+ * records so hostile handshakes cannot turn the audit trail into a disk DoS.
+ */
+export declare class IrohRemoteAuditLogger {
+    private readonly path;
+    private readonly sink;
+    private readonly now;
+    private readonly maxFileBytes;
+    private readonly maxBackupFiles;
+    private readonly maxEntryBytes;
+    private readonly securityRateLimit;
+    private readonly securityBuckets;
+    private writeQueue;
+    constructor(options?: IrohRemoteAuditLoggerOptions);
+    log(event: IrohRemoteAuditEventInput): Promise<void>;
+    /** Flush rate-limit summaries and all queued file writes. */
+    flush(): Promise<void>;
+    private applySecurityRateLimit;
+    private scheduleSecurityBucketFlush;
+    private flushExpiredSecurityBucket;
+    private createSuppressionSummary;
+    private enqueue;
+    private write;
+    private serialize;
+    private ensurePrivateParent;
+    private inspectCurrentFile;
+    private rotate;
+    private renameIfRegular;
+    private appendPrivate;
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/core/remote/iroh/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/audit.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,wCAAwC,QAAkB,CAAC;AACxE,eAAO,MAAM,0CAA0C,IAAI,CAAC;AAC5D,eAAO,MAAM,yCAAyC,QAAY,CAAC;AACnE,eAAO,MAAM,4CAA4C,QAAS,CAAC;AACnE,eAAO,MAAM,wCAAwC,IAAI,CAAC;AAgB1D,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,uCAAuC;IACvD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,KAAK,GAAG,uCAAuC,CAAC;CACzE;AA2BD;;;;GAIG;AACH,qBAAa,qBAAqB;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkC;IACvD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6C;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,UAAU,CAAoC;IAEtD,YAAY,OAAO,GAAE,4BAAiC,EAsBrD;IAEK,GAAG,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CASzD;IAED,6DAA6D;IACvD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAY3B;IAED,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,2BAA2B;YAUrB,0BAA0B;IAexC,OAAO,CAAC,wBAAwB;IAqBhC,OAAO,CAAC,OAAO;YAMD,KAAK;IAanB,OAAO,CAAC,SAAS;YAaH,mBAAmB;YAWnB,kBAAkB;YAelB,MAAM;YAaN,eAAe;YAef,aAAa;CAmB3B","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport { constants } from \"node:fs\";\nimport { chmod, lstat, mkdir, open, rename, rm } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nexport const DEFAULT_IROH_REMOTE_AUDIT_MAX_FILE_BYTES = 8 * 1024 * 1024;\nexport const DEFAULT_IROH_REMOTE_AUDIT_MAX_BACKUP_FILES = 2;\nexport const DEFAULT_IROH_REMOTE_AUDIT_MAX_ENTRY_BYTES = 64 * 1024;\nexport const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_WINDOW_MS = 60_000;\nexport const DEFAULT_IROH_REMOTE_SECURITY_AUDIT_BURST = 4;\n\nconst PRIVATE_DIRECTORY_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\nconst MINIMUM_AUDIT_FILE_BYTES = 1024;\nconst RATE_LIMITED_SECURITY_EVENT_TYPES = new Set([\n\t\"client_rejected\",\n\t\"handshake_rejected\",\n\t\"iroh_security_connection_limit\",\n\t\"iroh_security_unauthenticated_connection_limit\",\n\t\"iroh_security_stream_limit\",\n\t\"iroh_security_handshake_limit\",\n\t\"iroh_security_handshake_timeout\",\n\t\"iroh_security_transport_rejected\",\n]);\n\nexport interface IrohRemoteAuditEvent {\n\ttype: string;\n\ttimestamp: number;\n\tclientNodeId?: string;\n\tworkspace?: string;\n\tsuccess?: boolean;\n\terror?: string;\n\tdetails?: Record<string, unknown>;\n}\n\nexport type IrohRemoteAuditEventInput = Omit<IrohRemoteAuditEvent, \"timestamp\"> & { timestamp?: number };\n\nexport interface IrohRemoteAuditSink {\n\twrite(event: IrohRemoteAuditEvent): void | Promise<void>;\n}\n\nexport interface IrohRemoteSecurityAuditRateLimitOptions {\n\tmaxEventsPerWindow?: number;\n\twindowMs?: number;\n}\n\nexport interface IrohRemoteAuditLoggerOptions {\n\tpath?: string;\n\tsink?: IrohRemoteAuditSink;\n\tnow?: () => number;\n\tmaxFileBytes?: number;\n\tmaxBackupFiles?: number;\n\tmaxEntryBytes?: number;\n\t/** Path-backed daemon logs enable the default limiter unless explicitly disabled. */\n\tsecurityEventRateLimit?: false | IrohRemoteSecurityAuditRateLimitOptions;\n}\n\ninterface SecurityAuditBucket {\n\twindowStartedAt: number;\n\temitted: number;\n\tsuppressed: number;\n\tfirstSuppressedAt?: number;\n\tlastSuppressedAt?: number;\n\ttimer?: NodeJS.Timeout;\n}\n\ninterface ResolvedSecurityAuditRateLimit {\n\tmaxEventsPerWindow: number;\n\twindowMs: number;\n}\n\nfunction getErrorCode(error: unknown): string | undefined {\n\tif (typeof error !== \"object\" || error === null || !(\"code\" in error)) return undefined;\n\treturn typeof error.code === \"string\" ? error.code : undefined;\n}\n\nfunction assertIntegerAtLeast(value: number, minimum: number, name: string): void {\n\tif (!Number.isSafeInteger(value) || value < minimum) {\n\t\tthrow new Error(`${name} must be an integer of at least ${minimum}`);\n\t}\n}\n\n/**\n * Serialized, owner-only JSONL audit persistence with bounded files. Rejected\n * unauthenticated traffic is burst-sampled and then represented by aggregate\n * records so hostile handshakes cannot turn the audit trail into a disk DoS.\n */\nexport class IrohRemoteAuditLogger {\n\tprivate readonly path: string | undefined;\n\tprivate readonly sink: IrohRemoteAuditSink | undefined;\n\tprivate readonly now: () => number;\n\tprivate readonly maxFileBytes: number;\n\tprivate readonly maxBackupFiles: number;\n\tprivate readonly maxEntryBytes: number;\n\tprivate readonly securityRateLimit: ResolvedSecurityAuditRateLimit | undefined;\n\tprivate readonly securityBuckets = new Map<string, SecurityAuditBucket>();\n\tprivate writeQueue: Promise<void> = Promise.resolve();\n\n\tconstructor(options: IrohRemoteAuditLoggerOptions = {}) {\n\t\tthis.path = options.path;\n\t\tthis.sink = options.sink;\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.maxFileBytes = options.maxFileBytes ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_FILE_BYTES;\n\t\tthis.maxBackupFiles = options.maxBackupFiles ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_BACKUP_FILES;\n\t\tthis.maxEntryBytes = options.maxEntryBytes ?? DEFAULT_IROH_REMOTE_AUDIT_MAX_ENTRY_BYTES;\n\t\tassertIntegerAtLeast(this.maxFileBytes, MINIMUM_AUDIT_FILE_BYTES, \"maxFileBytes\");\n\t\tassertIntegerAtLeast(this.maxBackupFiles, 0, \"maxBackupFiles\");\n\t\tassertIntegerAtLeast(this.maxEntryBytes, MINIMUM_AUDIT_FILE_BYTES, \"maxEntryBytes\");\n\t\tif (this.maxEntryBytes > this.maxFileBytes) {\n\t\t\tthrow new Error(\"maxEntryBytes must not exceed maxFileBytes\");\n\t\t}\n\n\t\tconst rateLimit = options.securityEventRateLimit;\n\t\tif (rateLimit !== false && (rateLimit !== undefined || this.path !== undefined)) {\n\t\t\tconst maxEventsPerWindow = rateLimit?.maxEventsPerWindow ?? DEFAULT_IROH_REMOTE_SECURITY_AUDIT_BURST;\n\t\t\tconst windowMs = rateLimit?.windowMs ?? DEFAULT_IROH_REMOTE_SECURITY_AUDIT_WINDOW_MS;\n\t\t\tassertIntegerAtLeast(maxEventsPerWindow, 1, \"securityEventRateLimit.maxEventsPerWindow\");\n\t\t\tassertIntegerAtLeast(windowMs, 1, \"securityEventRateLimit.windowMs\");\n\t\t\tthis.securityRateLimit = { maxEventsPerWindow, windowMs };\n\t\t}\n\t}\n\n\tasync log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\tconst auditEvent: IrohRemoteAuditEvent = {\n\t\t\t...event,\n\t\t\ttimestamp: event.timestamp ?? this.now(),\n\t\t};\n\t\tconst events = this.applySecurityRateLimit(auditEvent);\n\t\tfor (const eventToWrite of events) {\n\t\t\tawait this.enqueue(eventToWrite);\n\t\t}\n\t}\n\n\t/** Flush rate-limit summaries and all queued file writes. */\n\tasync flush(): Promise<void> {\n\t\tconst observedAt = this.now();\n\t\tconst summaries: IrohRemoteAuditEvent[] = [];\n\t\tfor (const [eventType, bucket] of this.securityBuckets) {\n\t\t\tif (bucket.timer !== undefined) clearTimeout(bucket.timer);\n\t\t\tconst summary = this.createSuppressionSummary(eventType, bucket, observedAt);\n\t\t\tif (summary !== undefined) summaries.push(summary);\n\t\t}\n\t\tthis.securityBuckets.clear();\n\t\tconst summaryWrites = summaries.map((summary) => this.enqueue(summary));\n\t\tawait Promise.all(summaryWrites);\n\t\tawait this.writeQueue;\n\t}\n\n\tprivate applySecurityRateLimit(event: IrohRemoteAuditEvent): IrohRemoteAuditEvent[] {\n\t\tconst rateLimit = this.securityRateLimit;\n\t\tif (rateLimit === undefined || !RATE_LIMITED_SECURITY_EVENT_TYPES.has(event.type)) return [event];\n\n\t\tconst observedAt = this.now();\n\t\tlet bucket = this.securityBuckets.get(event.type);\n\t\tconst events: IrohRemoteAuditEvent[] = [];\n\t\tif (bucket === undefined || observedAt - bucket.windowStartedAt >= rateLimit.windowMs) {\n\t\t\tif (bucket !== undefined) {\n\t\t\t\tif (bucket.timer !== undefined) clearTimeout(bucket.timer);\n\t\t\t\tconst summary = this.createSuppressionSummary(event.type, bucket, observedAt);\n\t\t\t\tif (summary !== undefined) events.push(summary);\n\t\t\t}\n\t\t\tbucket = { windowStartedAt: observedAt, emitted: 0, suppressed: 0 };\n\t\t\tthis.securityBuckets.set(event.type, bucket);\n\t\t}\n\n\t\tif (bucket.emitted < rateLimit.maxEventsPerWindow) {\n\t\t\tbucket.emitted++;\n\t\t\tevents.push(event);\n\t\t\treturn events;\n\t\t}\n\n\t\tbucket.suppressed++;\n\t\tbucket.firstSuppressedAt ??= observedAt;\n\t\tbucket.lastSuppressedAt = observedAt;\n\t\tthis.scheduleSecurityBucketFlush(event.type, bucket);\n\t\treturn events;\n\t}\n\n\tprivate scheduleSecurityBucketFlush(eventType: string, bucket: SecurityAuditBucket): void {\n\t\tconst rateLimit = this.securityRateLimit;\n\t\tif (rateLimit === undefined || bucket.timer !== undefined) return;\n\t\tconst delayMs = Math.max(1, bucket.windowStartedAt + rateLimit.windowMs - this.now());\n\t\tbucket.timer = setTimeout(() => {\n\t\t\tvoid this.flushExpiredSecurityBucket(eventType).catch(() => {});\n\t\t}, delayMs);\n\t\tbucket.timer.unref?.();\n\t}\n\n\tprivate async flushExpiredSecurityBucket(eventType: string): Promise<void> {\n\t\tconst rateLimit = this.securityRateLimit;\n\t\tconst bucket = this.securityBuckets.get(eventType);\n\t\tif (rateLimit === undefined || bucket === undefined) return;\n\t\tbucket.timer = undefined;\n\t\tconst observedAt = this.now();\n\t\tif (observedAt - bucket.windowStartedAt < rateLimit.windowMs) {\n\t\t\tthis.scheduleSecurityBucketFlush(eventType, bucket);\n\t\t\treturn;\n\t\t}\n\t\tconst summary = this.createSuppressionSummary(eventType, bucket, observedAt);\n\t\tthis.securityBuckets.set(eventType, { windowStartedAt: observedAt, emitted: 0, suppressed: 0 });\n\t\tif (summary !== undefined) await this.enqueue(summary);\n\t}\n\n\tprivate createSuppressionSummary(\n\t\teventType: string,\n\t\tbucket: SecurityAuditBucket,\n\t\tobservedAt: number,\n\t): IrohRemoteAuditEvent | undefined {\n\t\tif (bucket.suppressed === 0) return undefined;\n\t\treturn {\n\t\t\ttype: \"security_events_rate_limited\",\n\t\t\ttimestamp: observedAt,\n\t\t\tsuccess: false,\n\t\t\tdetails: {\n\t\t\t\teventType,\n\t\t\t\tsampledCount: bucket.emitted,\n\t\t\t\tsuppressedCount: bucket.suppressed,\n\t\t\t\twindowStartedAt: bucket.windowStartedAt,\n\t\t\t\tfirstSuppressedAt: bucket.firstSuppressedAt,\n\t\t\t\tlastSuppressedAt: bucket.lastSuppressedAt,\n\t\t\t},\n\t\t};\n\t}\n\n\tprivate enqueue(event: IrohRemoteAuditEvent): Promise<void> {\n\t\tconst operation = this.writeQueue.then(() => this.write(event));\n\t\tthis.writeQueue = operation.catch(() => {});\n\t\treturn operation;\n\t}\n\n\tprivate async write(auditEvent: IrohRemoteAuditEvent): Promise<void> {\n\t\tif (this.sink) await this.sink.write(auditEvent);\n\t\tif (!this.path) return;\n\n\t\tconst line = this.serialize(auditEvent);\n\t\tawait this.ensurePrivateParent();\n\t\tconst existingSize = await this.inspectCurrentFile();\n\t\tif (existingSize > 0 && existingSize + Buffer.byteLength(line, \"utf8\") > this.maxFileBytes) {\n\t\t\tawait this.rotate();\n\t\t}\n\t\tawait this.appendPrivate(line);\n\t}\n\n\tprivate serialize(auditEvent: IrohRemoteAuditEvent): string {\n\t\tconst serialized = `${JSON.stringify(auditEvent)}\\n`;\n\t\tconst originalBytes = Buffer.byteLength(serialized, \"utf8\");\n\t\tif (originalBytes <= this.maxEntryBytes) return serialized;\n\t\treturn `${JSON.stringify({\n\t\t\ttype: \"audit_event_truncated\",\n\t\t\ttimestamp: auditEvent.timestamp,\n\t\t\tsuccess: false,\n\t\t\terror: \"audit event exceeded maximum serialized size\",\n\t\t\tdetails: { originalBytes, originalType: auditEvent.type.slice(0, 128) },\n\t\t} satisfies IrohRemoteAuditEvent)}\\n`;\n\t}\n\n\tprivate async ensurePrivateParent(): Promise<void> {\n\t\tif (this.path === undefined) return;\n\t\tconst parentPath = dirname(this.path);\n\t\tawait mkdir(parentPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });\n\t\tconst parentStat = await lstat(parentPath);\n\t\tif (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {\n\t\t\tthrow new Error(`Refusing to use non-directory audit path: ${parentPath}`);\n\t\t}\n\t\tawait chmod(parentPath, PRIVATE_DIRECTORY_MODE);\n\t}\n\n\tprivate async inspectCurrentFile(): Promise<number> {\n\t\tif (this.path === undefined) return 0;\n\t\ttry {\n\t\t\tconst fileStat = await lstat(this.path);\n\t\t\tif (fileStat.isSymbolicLink() || !fileStat.isFile() || fileStat.nlink !== 1) {\n\t\t\t\tthrow new Error(`Refusing to use non-regular audit file: ${this.path}`);\n\t\t\t}\n\t\t\tawait chmod(this.path, PRIVATE_FILE_MODE);\n\t\t\treturn fileStat.size;\n\t\t} catch (error) {\n\t\t\tif (getErrorCode(error) === \"ENOENT\") return 0;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async rotate(): Promise<void> {\n\t\tif (this.path === undefined) return;\n\t\tif (this.maxBackupFiles === 0) {\n\t\t\tawait rm(this.path, { force: true });\n\t\t\treturn;\n\t\t}\n\t\tawait rm(`${this.path}.${this.maxBackupFiles}`, { force: true });\n\t\tfor (let index = this.maxBackupFiles - 1; index >= 1; index--) {\n\t\t\tawait this.renameIfRegular(`${this.path}.${index}`, `${this.path}.${index + 1}`);\n\t\t}\n\t\tawait rename(this.path, `${this.path}.1`);\n\t}\n\n\tprivate async renameIfRegular(source: string, destination: string): Promise<void> {\n\t\ttry {\n\t\t\tconst sourceStat = await lstat(source);\n\t\t\tif (sourceStat.isSymbolicLink() || !sourceStat.isFile() || sourceStat.nlink !== 1) {\n\t\t\t\tawait rm(source, { force: true });\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait chmod(source, PRIVATE_FILE_MODE);\n\t\t\tawait rm(destination, { force: true });\n\t\t\tawait rename(source, destination);\n\t\t} catch (error) {\n\t\t\tif (getErrorCode(error) !== \"ENOENT\") throw error;\n\t\t}\n\t}\n\n\tprivate async appendPrivate(line: string): Promise<void> {\n\t\tif (this.path === undefined) return;\n\t\tconst noFollow = typeof constants.O_NOFOLLOW === \"number\" ? constants.O_NOFOLLOW : 0;\n\t\tconst handle = await open(\n\t\t\tthis.path,\n\t\t\tconstants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | noFollow,\n\t\t\tPRIVATE_FILE_MODE,\n\t\t);\n\t\ttry {\n\t\t\tconst fileStat = await handle.stat();\n\t\t\tif (!fileStat.isFile() || fileStat.nlink !== 1) {\n\t\t\t\tthrow new Error(`Refusing to use non-regular audit file: ${this.path}`);\n\t\t\t}\n\t\t\tawait handle.chmod(PRIVATE_FILE_MODE);\n\t\t\tawait handle.writeFile(line, \"utf8\");\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t}\n}\n"]}