@kynver-app/runtime 0.2.53 → 0.2.55

package/README.md

@@ -75,7 +75,7 @@ doctor runner-install | node-runtime | local-store | context-envelope | runtime-
 report-bug [--json] [--message TEXT] [--skip-doctor]
 ```
 
-Run `kynver help` for the full flag-level usage. `scripts/opus-harness.mjs` is a compatibility shim that delegates to this package.
+Run `kynver help` for the full flag-level usage.
 
 ## Worker providers
 
@@ -97,8 +97,7 @@ Website chat (delegated turns claimed by `kynver daemon`) follows `chatProvider`
 
 ## Contributing
 
-Development against a Kynver monorepo checkout — explicit harness verbs,
-targeted dispatch, and the test suite — is documented in the monorepo at
-`docs/runbooks/runtime-monorepo-development.md`.
+Development against a Kynver monorepo checkout is documented for
+contributors inside the Kynver repository.
 
 Bug reports: see [Report a bug](#report-a-bug) above.

package/dist/chat/command-auth-proof.js

@@ -1 +1 @@
-import{createHash as g,createPrivateKey as d,createPublicKey as y,randomBytes as m,sign as h,verify as b}from"node:crypto";function s(e){return JSON.stringify(c(e))}function c(e){if(Array.isArray(e))return e.map(c);if(e&&typeof e=="object"){let n={};for(let r of Object.keys(e).sort())n[r]=c(e[r]);return n}return e}function u(e){if(!e)return null;let n=e.trim();if(!n)return null;if(/^[0-9a-fA-F]{64}$/.test(n))return new Uint8Array(n.match(/.{2}/g).map(r=>parseInt(r,16)));try{let r=Buffer.from(n,"base64");if(r.length===32)return new Uint8Array(r)}catch{}return null}function p(e=process.env){if(e.NODE_ENV==="production")return!1;let n=e.KYNVER_ALLOW_DEV_SIGNING_KEYS?.trim().toLowerCase();return n==="1"||n==="true"||n==="yes"||n==="on"?!0:e.NODE_ENV==="test"||e.VITEST==="true"}var k=120,S=Buffer.from("302a300506032b6570032100","hex"),l=Buffer.from("302e020100300506032b657004220420","hex"),x="c0021e9312b0a479dbd2eb8dec0deedbe0dd6445eff431e372fa49fa21d42ffa",A="ca-6297fb8e1773",v={[A]:"16ae5cb2a61f8c94cf1b86e8258f9c2f2ff6aba5e6136250a422209b6e866881","ca-456fd128f3b3":"f29cbd559410c2578d7f9732ccd86570073355ccdb36af0d1b7dff15908466e7"};function I(e){return`ca-${g("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function P(e,n=process.env){let r=u(n.KYNVER_COMMAND_AUTH_PUBLIC_KEY);if(r)return I(r)!==e?null:r;let t=v[e];return!t||e===A&&!p(n)?null:u(t)}function K(e){return y({key:Buffer.concat([S,Buffer.from(e)]),format:"der",type:"spki"})}function _(e,n){return!Array.isArray(e)||e.length!==n.length?!1:e.every((r,t)=>typeof r=="string"&&r===n[t])}function B(e){if(!e||typeof e!="object")return!1;let n=e;if(typeof n.signature!="string"||!n.signature||typeof n.publicKeyId!="string"||!n.publicKeyId)return!1;let r=n.payload;return!(!r||typeof r!="object"||r.v!==1||typeof r.agentOsId!="string"||!r.agentOsId||!Array.isArray(r.argv)||r.argv.some(t=>typeof t!="string")||typeof r.userId!="string"||!r.userId||typeof r.exp!="number"||!Number.isFinite(r.exp)||typeof r.nonce!="string"||!r.nonce)}function U(e,n,r=process.env,t=Math.floor(Date.now()/1e3)){if(!B(e))return{ok:!1,reason:"malformed command authorization proof"};if(e.payload.agentOsId!==n.agentOsId)return{ok:!1,reason:"agentOsId mismatch"};if(!_(e.payload.argv,n.argv))return{ok:!1,reason:"argv mismatch"};if(e.payload.exp<=t)return{ok:!1,reason:"proof expired"};let o=P(e.publicKeyId,r);if(!o)return{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}"`};let i;try{i=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(i.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let a=Buffer.from(s(e.payload),"utf8");return b(null,a,K(o),i)?{ok:!0,payload:e.payload}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(a){return{ok:!1,reason:`signature verification failed: ${a.message}`}}}function w(e){let n=d({key:Buffer.concat([l,Buffer.from(e)]),format:"der",type:"pkcs8"}),r=y(n).export({format:"der",type:"spki"});return new Uint8Array(r.subarray(r.length-32))}function C(e=process.env){let n=u(e.KYNVER_COMMAND_AUTH_KEY);if(!n&&e.NODE_ENV==="production")throw new Error("KYNVER_COMMAND_AUTH_KEY must be set in production; refusing to sign command proofs with the committed dev key.");let r=n??u(x),t=w(r);return{seed:r,rawPublicKey:t,publicKeyId:I(t),usingDevFallbackKey:!n}}function E(e,n){let r=d({key:Buffer.concat([l,Buffer.from(n.seed)]),format:"der",type:"pkcs8"}),t=Buffer.from(s(e),"utf8");return{payload:e,signature:h(null,t,r).toString("base64url"),publicKeyId:n.publicKeyId}}function L(e){let n=e.env??process.env,r=e.nowSec??Math.floor(Date.now()/1e3),t=e.ttlSec??k,o={v:1,agentOsId:e.agentOsId,argv:[...e.argv],userId:e.userId,exp:r+t,nonce:m(16).toString("base64url")};return E(o,C(n))}function V(e){return g("sha256").update(Buffer.from(e.rawPublicKey)).digest("hex").slice(0,16)}var O=120;function R(e){if(!e||typeof e!="object")return!1;let n=e;if(typeof n.signature!="string"||!n.signature||typeof n.publicKeyId!="string"||!n.publicKeyId)return!1;let r=n.payload;return!(!r||typeof r!="object"||r.v!==1||r.kind!=="chat"||typeof r.agentOsId!="string"||!r.agentOsId||typeof r.exp!="number"||!Number.isFinite(r.exp)||typeof r.nonce!="string"||!r.nonce)}function z(e){let n=e.env??process.env,r=e.nowSec??Math.floor(Date.now()/1e3),t=e.ttlSec??O,o={v:1,kind:"chat",agentOsId:e.agentOsId,exp:r+t,nonce:m(16).toString("base64url")},i=C(n),a=d({key:Buffer.concat([l,Buffer.from(i.seed)]),format:"der",type:"pkcs8"}),f=Buffer.from(s(o),"utf8");return{payload:o,signature:h(null,f,a).toString("base64url"),publicKeyId:i.publicKeyId}}function M(e,n,r=process.env,t=Math.floor(Date.now()/1e3)){if(!R(e))return{ok:!1,reason:"malformed chat-turn authorization proof"};if(e.payload.agentOsId!==n.agentOsId)return{ok:!1,reason:"agentOsId mismatch"};if(e.payload.exp<=t)return{ok:!1,reason:"proof expired"};let o=P(e.publicKeyId,r);if(!o)return{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}"`};let i;try{i=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(i.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let a=Buffer.from(s(e.payload),"utf8");return b(null,a,K(o),i)?{ok:!0,payload:e.payload}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(a){return{ok:!1,reason:`signature verification failed: ${a.message}`}}}export{O as CHAT_TURN_AUTH_PROOF_TTL_SEC,A as COMMAND_AUTH_DEV_FALLBACK_PUBLIC_KEY_ID,k as COMMAND_AUTH_PROOF_TTL_SEC,v as PINNED_COMMAND_AUTH_PUBLIC_KEYS,_ as argvMatchesProof,V as commandAuthProofKeyFingerprint,I as deriveCommandAuthKeyId,R as isSignedChatTurnAuthProofShape,B as isSignedCommandAuthProofShape,z as issueChatTurnAuthorizationProof,L as issueCommandAuthorizationProof,P as resolveCommandAuthPublicKey,C as resolveCommandAuthSigningKey,M as verifyChatTurnAuthorizationProof,U as verifyCommandAuthorizationProof};
+import{createHash as m,createPublicKey as h,verify as d}from"node:crypto";function u(e){return JSON.stringify(s(e))}function s(e){if(Array.isArray(e))return e.map(s);if(e&&typeof e=="object"){let n={};for(let r of Object.keys(e).sort())n[r]=s(e[r]);return n}return e}function f(e){if(!e)return null;let n=e.trim();if(!n)return null;if(/^[0-9a-fA-F]{64}$/.test(n))return new Uint8Array(n.match(/.{2}/g).map(r=>parseInt(r,16)));try{let r=Buffer.from(n,"base64");if(r.length===32)return new Uint8Array(r)}catch{}return null}function l(e=process.env){if(e.NODE_ENV==="production")return!1;let n=e.KYNVER_ALLOW_DEV_SIGNING_KEYS?.trim().toLowerCase();return n==="1"||n==="true"||n==="yes"||n==="on"?!0:e.NODE_ENV==="test"||e.VITEST==="true"}var K=120,b=Buffer.from("302a300506032b6570032100","hex"),c="ca-6297fb8e1773",I={[c]:"16ae5cb2a61f8c94cf1b86e8258f9c2f2ff6aba5e6136250a422209b6e866881","ca-456fd128f3b3":"f29cbd559410c2578d7f9732ccd86570073355ccdb36af0d1b7dff15908466e7"};function A(e){return`ca-${m("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function p(e,n=process.env){let r=f(n.KYNVER_COMMAND_AUTH_PUBLIC_KEY);if(r)return A(r)!==e?null:r;let t=I[e];return!t||e===c&&!l(n)?null:f(t)}function g(e){return h({key:Buffer.concat([b,Buffer.from(e)]),format:"der",type:"spki"})}function P(e,n){return!Array.isArray(e)||e.length!==n.length?!1:e.every((r,t)=>typeof r=="string"&&r===n[t])}function k(e){if(!e||typeof e!="object")return!1;let n=e;if(typeof n.signature!="string"||!n.signature||typeof n.publicKeyId!="string"||!n.publicKeyId)return!1;let r=n.payload;return!(!r||typeof r!="object"||r.v!==1||typeof r.agentOsId!="string"||!r.agentOsId||!Array.isArray(r.argv)||r.argv.some(t=>typeof t!="string")||typeof r.userId!="string"||!r.userId||typeof r.exp!="number"||!Number.isFinite(r.exp)||typeof r.nonce!="string"||!r.nonce)}function O(e,n,r=process.env,t=Math.floor(Date.now()/1e3)){if(!k(e))return{ok:!1,reason:"malformed command authorization proof"};if(e.payload.agentOsId!==n.agentOsId)return{ok:!1,reason:"agentOsId mismatch"};if(!P(e.payload.argv,n.argv))return{ok:!1,reason:"argv mismatch"};if(e.payload.exp<=t)return{ok:!1,reason:"proof expired"};let a=p(e.publicKeyId,r);if(!a)return{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}"`};let o;try{o=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(o.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let i=Buffer.from(u(e.payload),"utf8");return d(null,i,g(a),o)?{ok:!0,payload:e.payload}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(i){return{ok:!1,reason:`signature verification failed: ${i.message}`}}}var S=120;function x(e){if(!e||typeof e!="object")return!1;let n=e;if(typeof n.signature!="string"||!n.signature||typeof n.publicKeyId!="string"||!n.publicKeyId)return!1;let r=n.payload;return!(!r||typeof r!="object"||r.v!==1||r.kind!=="chat"||typeof r.agentOsId!="string"||!r.agentOsId||typeof r.exp!="number"||!Number.isFinite(r.exp)||typeof r.nonce!="string"||!r.nonce)}function T(e,n,r=process.env,t=Math.floor(Date.now()/1e3)){if(!x(e))return{ok:!1,reason:"malformed chat-turn authorization proof"};if(e.payload.agentOsId!==n.agentOsId)return{ok:!1,reason:"agentOsId mismatch"};if(e.payload.exp<=t)return{ok:!1,reason:"proof expired"};let a=p(e.publicKeyId,r);if(!a)return{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}"`};let o;try{o=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(o.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let i=Buffer.from(u(e.payload),"utf8");return d(null,i,g(a),o)?{ok:!0,payload:e.payload}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(i){return{ok:!1,reason:`signature verification failed: ${i.message}`}}}export{S as CHAT_TURN_AUTH_PROOF_TTL_SEC,c as COMMAND_AUTH_DEV_FALLBACK_PUBLIC_KEY_ID,K as COMMAND_AUTH_PROOF_TTL_SEC,I as PINNED_COMMAND_AUTH_PUBLIC_KEYS,P as argvMatchesProof,A as deriveCommandAuthKeyId,x as isSignedChatTurnAuthProofShape,k as isSignedCommandAuthProofShape,p as resolveCommandAuthPublicKey,T as verifyChatTurnAuthorizationProof,O as verifyCommandAuthorizationProof};