@moxt-ai/mobius 0.0.4 → 0.0.6

package/dist/agent-installation/managed-adapter-installer.js

@@ -0,0 +1,159 @@
+import { mkdir, mkdtemp, open, realpath, rename, rm, stat, } from "node:fs/promises";
+import { delimiter, dirname, join, relative } from "node:path";
+import { findExecutableOnPath, resolveExecutablePath, runBoundedProcess, } from "../process/executable.js";
+const ADAPTER_INSTALL_TIMEOUT_MILLISECONDS = 2 * 60 * 1_000;
+const PACKAGE_METADATA_LIMIT_BYTES = 64 * 1024;
+export class ManagedAdapterInstallError extends Error {
+    code;
+    constructor(code, message, options = {}) {
+        super(message, options);
+        this.code = code;
+        this.name = "ManagedAdapterInstallError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function packagePath(root, packageName) {
+    return join(root, "node_modules", ...packageName.split("/"));
+}
+async function readPackageJson(path) {
+    const handle = await open(path, "r");
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() || metadata.size > PACKAGE_METADATA_LIMIT_BYTES) {
+            throw new ManagedAdapterInstallError("adapter_verification_failed", "The managed adapter package metadata is invalid");
+        }
+        const value = JSON.parse(await handle.readFile({ encoding: "utf8" }));
+        if (!isRecord(value)) {
+            throw new ManagedAdapterInstallError("adapter_verification_failed", "The managed adapter package metadata is invalid");
+        }
+        return value;
+    }
+    finally {
+        await handle.close();
+    }
+}
+function readBinPath(packageMetadata, executableName) {
+    const bin = packageMetadata["bin"];
+    if (typeof bin === "string") {
+        return bin;
+    }
+    if (isRecord(bin) && typeof bin[executableName] === "string") {
+        return bin[executableName];
+    }
+    throw new ManagedAdapterInstallError("adapter_verification_failed", "The managed adapter executable declaration is invalid");
+}
+export async function validateManagedAdapter(root, specification) {
+    const rootPath = await realpath(root);
+    const packageRoot = await realpath(packagePath(rootPath, specification.adapterPackage));
+    const packageDifference = relative(rootPath, packageRoot);
+    if (packageDifference.startsWith("..") || packageDifference.length === 0) {
+        throw new ManagedAdapterInstallError("adapter_verification_failed", "The managed adapter package escaped its private cache");
+    }
+    const metadata = await readPackageJson(join(packageRoot, "package.json"));
+    if (metadata["name"] !== specification.adapterPackage ||
+        metadata["version"] !== specification.adapterVersion) {
+        throw new ManagedAdapterInstallError("adapter_verification_failed", "The managed adapter package identity is invalid");
+    }
+    const declaredBin = readBinPath(metadata, specification.adapterExecutable);
+    const executable = await resolveExecutablePath(join(packageRoot, declaredBin));
+    if (executable === null) {
+        throw new ManagedAdapterInstallError("adapter_verification_failed", "The managed adapter executable is invalid");
+    }
+    const executableDifference = relative(rootPath, executable.path);
+    if (executableDifference.startsWith("..") ||
+        executableDifference.length === 0) {
+        throw new ManagedAdapterInstallError("adapter_verification_failed", "The managed adapter executable escaped its private cache");
+    }
+    return executable;
+}
+export class ManagedAdapterInstaller {
+    #environment;
+    #stateDirectory;
+    constructor(options) {
+        this.#environment = options.environment;
+        this.#stateDirectory = options.stateDirectory;
+    }
+    install = async (specification, signal) => {
+        signal.throwIfAborted();
+        const agentCache = join(this.#stateDirectory, "adapters", specification.id);
+        const published = join(agentCache, specification.adapterVersion);
+        try {
+            const metadata = await stat(published);
+            if (metadata.isDirectory()) {
+                return await validateManagedAdapter(published, specification);
+            }
+        }
+        catch (error) {
+            if (!(error instanceof Error) ||
+                !("code" in error) ||
+                error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+        await mkdir(agentCache, { mode: 0o700, recursive: true });
+        const staging = await mkdtemp(join(agentCache, `.${specification.adapterVersion}.staging-`));
+        try {
+            const npm = await findExecutableOnPath(process.platform === "win32" ? "npm.cmd" : "npm", this.#environment);
+            if (npm === null) {
+                throw new ManagedAdapterInstallError("package_manager_not_found", "A supported npm executable is required to install the ACP adapter");
+            }
+            await runBoundedProcess({
+                arguments: [
+                    "install",
+                    "--prefix",
+                    staging,
+                    "--omit=optional",
+                    "--ignore-scripts",
+                    "--no-audit",
+                    "--no-fund",
+                    "--package-lock=false",
+                    "--save=false",
+                    "--registry=https://registry.npmjs.org/",
+                    `${specification.adapterPackage}@${specification.adapterVersion}`,
+                ],
+                command: npm.path,
+                cwd: staging,
+                environment: {
+                    HOME: join(staging, "home"),
+                    NPM_CONFIG_AUDIT: "false",
+                    NPM_CONFIG_FUND: "false",
+                    NPM_CONFIG_IGNORE_SCRIPTS: "true",
+                    NPM_CONFIG_OMIT: "optional",
+                    NPM_CONFIG_REGISTRY: "https://registry.npmjs.org/",
+                    PATH: `${dirname(process.execPath)}${delimiter}/usr/bin${delimiter}/bin`,
+                },
+                outputLimitBytes: 64 * 1024,
+                signal,
+                timeoutMilliseconds: ADAPTER_INSTALL_TIMEOUT_MILLISECONDS,
+            });
+            await validateManagedAdapter(staging, specification);
+            try {
+                await rename(staging, published);
+            }
+            catch (error) {
+                try {
+                    return await validateManagedAdapter(published, specification);
+                }
+                catch {
+                    throw new ManagedAdapterInstallError("adapter_publish_failed", "The managed adapter could not be published", { cause: error });
+                }
+            }
+            return await validateManagedAdapter(published, specification);
+        }
+        catch (error) {
+            if (signal.aborted) {
+                signal.throwIfAborted();
+            }
+            if (error instanceof ManagedAdapterInstallError) {
+                throw error;
+            }
+            throw new ManagedAdapterInstallError("adapter_install_failed", "The pinned ACP adapter could not be installed", { cause: error });
+        }
+        finally {
+            await rm(staging, { force: true, recursive: true });
+        }
+    };
+}
+//# sourceMappingURL=managed-adapter-installer.js.map

package/dist/agent-installation/managed-adapter-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-adapter-installer.js","sourceRoot":"","sources":["../../src/agent-installation/managed-adapter-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,EAAE,EACF,IAAI,GACL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG/D,OAAO,EACL,oBAAoB,EAEpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAElC,MAAM,oCAAoC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AAC5D,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe,EAAE,OAAO,GAAiB,EAAE;QACnE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,WAAmB;IACpD,OAAO,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,4BAA4B,EAAE,CAAC;YACvE,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAC/B,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAC5C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,eAAkD,EAClD,cAAsB;IAEtB,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,aAAsC;IAEtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CACpD,CAAC;IACF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC1E,IACE,QAAQ,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,cAAc;QACjD,QAAQ,CAAC,SAAS,CAAC,KAAK,aAAa,CAAC,cAAc,EACpD,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAC5C,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAC/B,CAAC;IACF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACjE,IACE,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC;QACrC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAcD,MAAM,OAAO,uBAAuB;IACzB,YAAY,CAA8B;IAC1C,eAAe,CAAS;IAEjC,YAAY,OAAuC;QACjD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAChD,CAAC;IAEQ,OAAO,GAAG,KAAK,EACtB,aAAsC,EACtC,MAAmB,EACU,EAAE;QAC/B,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC3B,OAAO,MAAM,sBAAsB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;gBACzB,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;gBAClB,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,CAAC,UAAU,EAAE,IAAI,aAAa,CAAC,cAAc,WAAW,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAChD,IAAI,CAAC,YAAY,CAClB,CAAC;YACF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,0BAA0B,CAClC,2BAA2B,EAC3B,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,CAAC;gBACtB,SAAS,EAAE;oBACT,SAAS;oBACT,UAAU;oBACV,OAAO;oBACP,iBAAiB;oBACjB,kBAAkB;oBAClB,YAAY;oBACZ,WAAW;oBACX,sBAAsB;oBACtB,cAAc;oBACd,wCAAwC;oBACxC,GAAG,aAAa,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc,EAAE;iBAClE;gBACD,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,GAAG,EAAE,OAAO;gBACZ,WAAW,EAAE;oBACX,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;oBAC3B,gBAAgB,EAAE,OAAO;oBACzB,eAAe,EAAE,OAAO;oBACxB,yBAAyB,EAAE,MAAM;oBACjC,eAAe,EAAE,UAAU;oBAC3B,mBAAmB,EAAE,6BAA6B;oBAClD,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,WAAW,SAAS,MAAM;iBACzE;gBACD,gBAAgB,EAAE,EAAE,GAAG,IAAI;gBAC3B,MAAM;gBACN,mBAAmB,EAAE,oCAAoC;aAC1D,CAAC,CAAC;YACH,MAAM,sBAAsB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,OAAO,MAAM,sBAAsB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,4CAA4C,EAC5C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,MAAM,sBAAsB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,+CAA+C,EAC/C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;CACH"}

package/dist/agent-installation/verified-download.d.ts

@@ -0,0 +1,24 @@
+import { type Response } from "undici";
+export declare class InstallerDownloadError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string, options?: ErrorOptions);
+}
+export declare class VerifiedDownload {
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly url: URL;
+    constructor(url: URL, bytes: number, sha256: string);
+}
+export interface VerifiedDownloadOptions {
+    readonly allowedHosts: ReadonlySet<string>;
+    readonly destination: string;
+    readonly maximumBytes: number;
+    readonly signal: AbortSignal;
+    readonly timeoutMilliseconds: number;
+    readonly url: URL;
+}
+export interface InstallerDownloadTransport {
+    readonly get: (url: URL, signal: AbortSignal) => Promise<Response>;
+}
+export declare function downloadVerifiedFile(options: VerifiedDownloadOptions, transport?: InstallerDownloadTransport): Promise<VerifiedDownload>;
+//# sourceMappingURL=verified-download.d.ts.map

package/dist/agent-installation/verified-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-download.d.ts","sourceRoot":"","sources":["../../src/agent-installation/verified-download.ts"],"names":[],"mappings":"AAGA,OAAO,EAAS,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAO9C,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,EAIpE;CACF;AAED,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAElB,YAAY,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAIlD;CACF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACpE;AA0GD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,uBAAuB,EAChC,SAAS,GAAE,0BAAmE,GAC7E,OAAO,CAAC,gBAAgB,CAAC,CA2F3B"}

package/dist/agent-installation/verified-download.js

@@ -0,0 +1,158 @@
+import { createHash } from "node:crypto";
+import { open, unlink } from "node:fs/promises";
+import { fetch } from "undici";
+import { environmentProxyDispatcher } from "../network/environment-proxy.js";
+const MAX_REDIRECTS = 4;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+export class InstallerDownloadError extends Error {
+    code;
+    constructor(code, message, options = {}) {
+        super(message, options);
+        this.code = code;
+        this.name = "InstallerDownloadError";
+    }
+}
+export class VerifiedDownload {
+    bytes;
+    sha256;
+    url;
+    constructor(url, bytes, sha256) {
+        this.bytes = bytes;
+        this.sha256 = sha256;
+        this.url = url;
+    }
+}
+class UndiciInstallerDownloadTransport {
+    get = async (url, signal) => await fetch(url, {
+        dispatcher: environmentProxyDispatcher,
+        headers: {
+            accept: "text/plain, application/octet-stream;q=0.9",
+            "user-agent": "Mobius-Agent-Installer/0.0.3",
+        },
+        method: "GET",
+        redirect: "manual",
+        signal,
+    });
+}
+function validateUrl(url, allowedHosts) {
+    if (url.protocol !== "https:" ||
+        url.username.length > 0 ||
+        url.password.length > 0 ||
+        url.port.length > 0 ||
+        !allowedHosts.has(url.hostname)) {
+        throw new InstallerDownloadError("installer_host_not_allowed", "The installer download target is not allowed");
+    }
+}
+async function fetchInstaller(options, signal, transport) {
+    let url = new URL(options.url);
+    for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount += 1) {
+        validateUrl(url, options.allowedHosts);
+        const response = await transport.get(url, signal);
+        if (!REDIRECT_STATUSES.has(response.status)) {
+            return { response, url };
+        }
+        await response.body?.cancel();
+        const location = response.headers.get("location");
+        if (location === null || redirectCount === MAX_REDIRECTS) {
+            throw new InstallerDownloadError("installer_redirect_invalid", "The installer returned an invalid redirect");
+        }
+        let redirected;
+        try {
+            redirected = new URL(location, url);
+        }
+        catch (error) {
+            throw new InstallerDownloadError("installer_redirect_invalid", "The installer returned an invalid redirect", { cause: error });
+        }
+        try {
+            validateUrl(redirected, options.allowedHosts);
+        }
+        catch (error) {
+            throw new InstallerDownloadError("installer_redirect_not_allowed", "The installer redirect left the approved host allowlist", { cause: error });
+        }
+        url = redirected;
+    }
+    throw new InstallerDownloadError("installer_redirect_invalid", "The installer returned too many redirects");
+}
+async function writeCompleteChunk(handle, chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+        const written = await handle.write(chunk, offset, chunk.byteLength - offset);
+        if (written.bytesWritten < 1) {
+            throw new InstallerDownloadError("installer_write_failed", "The verified installer could not be stored");
+        }
+        offset += written.bytesWritten;
+    }
+}
+export async function downloadVerifiedFile(options, transport = new UndiciInstallerDownloadTransport()) {
+    options.signal.throwIfAborted();
+    const timeoutSignal = AbortSignal.timeout(options.timeoutMilliseconds);
+    const signal = AbortSignal.any([options.signal, timeoutSignal]);
+    let handle = null;
+    let responseBody = null;
+    try {
+        const fetched = await fetchInstaller(options, signal, transport);
+        responseBody = fetched.response.body;
+        if (!fetched.response.ok || fetched.response.body === null) {
+            throw new InstallerDownloadError("installer_download_failed", "The approved installer could not be downloaded");
+        }
+        const contentLength = fetched.response.headers.get("content-length");
+        if (contentLength !== null) {
+            const declaredLength = Number(contentLength);
+            if (!Number.isSafeInteger(declaredLength) ||
+                declaredLength < 1 ||
+                declaredLength > options.maximumBytes) {
+                throw new InstallerDownloadError("installer_size_invalid", "The installer size is outside the approved limit");
+            }
+        }
+        handle = await open(options.destination, "wx", 0o600);
+        const digest = createHash("sha256");
+        const reader = fetched.response.body.getReader();
+        let bytes = 0;
+        try {
+            while (true) {
+                signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done) {
+                    break;
+                }
+                bytes += chunk.value.byteLength;
+                if (bytes > options.maximumBytes) {
+                    throw new InstallerDownloadError("installer_size_invalid", "The installer exceeded the approved size limit");
+                }
+                digest.update(chunk.value);
+                await writeCompleteChunk(handle, chunk.value);
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+            reader.releaseLock();
+        }
+        if (bytes === 0) {
+            throw new InstallerDownloadError("installer_verification_failed", "The downloaded installer is empty");
+        }
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        return new VerifiedDownload(fetched.url, bytes, digest.digest("hex"));
+    }
+    catch (error) {
+        if (handle !== null) {
+            await handle.close().catch(() => undefined);
+        }
+        await unlink(options.destination).catch(() => undefined);
+        if (options.signal.aborted) {
+            options.signal.throwIfAborted();
+        }
+        if (timeoutSignal.aborted) {
+            throw new InstallerDownloadError("installer_download_timeout", "The installer download timed out", { cause: error });
+        }
+        if (error instanceof InstallerDownloadError) {
+            throw error;
+        }
+        throw new InstallerDownloadError("installer_download_failed", "The approved installer could not be downloaded", { cause: error });
+    }
+    finally {
+        await responseBody?.cancel().catch(() => undefined);
+    }
+}
+//# sourceMappingURL=verified-download.js.map

package/dist/agent-installation/verified-download.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-download.js","sourceRoot":"","sources":["../../src/agent-installation/verified-download.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,KAAK,EAAiB,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe,EAAE,OAAO,GAAiB,EAAE;QACnE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAS;IACd,MAAM,CAAS;IACf,GAAG,CAAM;IAElB,YAAY,GAAQ,EAAE,KAAa,EAAE,MAAc;QACjD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAeD,MAAM,gCAAgC;IAC3B,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,MAAmB,EAAqB,EAAE,CACxE,MAAM,KAAK,CAAC,GAAG,EAAE;QACf,UAAU,EAAE,0BAA0B;QACtC,OAAO,EAAE;YACP,MAAM,EAAE,4CAA4C;YACpD,YAAY,EAAE,8BAA8B;SAC7C;QACD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,QAAQ;QAClB,MAAM;KACP,CAAC,CAAC;CACN;AAED,SAAS,WAAW,CAAC,GAAQ,EAAE,YAAiC;IAC9D,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,sBAAsB,CAC9B,4BAA4B,EAC5B,8CAA8C,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgC,EAChC,MAAmB,EACnB,SAAqC;IAKrC,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,KACE,IAAI,aAAa,GAAG,CAAC,EACrB,aAAa,IAAI,aAAa,EAC9B,aAAa,IAAI,CAAC,EAClB,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,IAAI,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAsB,CAC9B,4BAA4B,EAC5B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAsB,CAC9B,4BAA4B,EAC5B,4CAA4C,EAC5C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAsB,CAC9B,gCAAgC,EAChC,yDAAyD,EACzD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,sBAAsB,CAC9B,4BAA4B,EAC5B,2CAA2C,CAC5C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAwC,EACxC,KAAiB;IAEjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,KAAK,EACL,MAAM,EACN,KAAK,CAAC,UAAU,GAAG,MAAM,CAC1B,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,sBAAsB,CAC9B,wBAAwB,EACxB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgC,EAChC,SAAS,GAA+B,IAAI,gCAAgC,EAAE;IAE9E,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,GAA4C,IAAI,CAAC;IAC3D,IAAI,YAAY,GAAqB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACjE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,IAAI,sBAAsB,CAC9B,2BAA2B,EAC3B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACrE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;YAC7C,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC;gBACrC,cAAc,GAAG,CAAC;gBAClB,cAAc,GAAG,OAAO,CAAC,YAAY,EACrC,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAC9B,wBAAwB,EACxB,kDAAkD,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,MAAM;gBACR,CAAC;gBACD,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;gBAChC,IAAI,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;oBACjC,MAAM,IAAI,sBAAsB,CAC9B,wBAAwB,EACxB,gDAAgD,CACjD,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,sBAAsB,CAC9B,+BAA+B,EAC/B,mCAAmC,CACpC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,sBAAsB,CAC9B,4BAA4B,EAC5B,kCAAkC,EAClC,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,sBAAsB,CAC9B,2BAA2B,EAC3B,gDAAgD,EAChD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,YAAY,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/audit/audit-store.d.ts

@@ -1,5 +1,6 @@
 export interface AuditRecord {
     readonly commandId: string;
+    readonly details?: Readonly<Record<string, string>>;
     readonly event: string;
     readonly sessionId: string;
 }

package/dist/audit/audit-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-store.d.ts","sourceRoot":"","sources":["../../src/audit/audit-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IAExC,YAAY,IAAI,EAAE,MAAM,EAYvB;IAED,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAkBhC;IAED,KAAK,IAAI,IAAI,CAEZ;CACF"}
+{"version":3,"file":"audit-store.d.ts","sourceRoot":"","sources":["../../src/audit/audit-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IAExC,YAAY,IAAI,EAAE,MAAM,EAuBvB;IAED,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAoBhC;IAED,KAAK,IAAI,IAAI,CAEZ;CACF"}

package/dist/audit/audit-store.js

@@ -12,9 +12,16 @@ export class AuditStore {
         recorded_at TEXT NOT NULL,
         event TEXT NOT NULL,
         command_id TEXT NOT NULL,
-        session_id TEXT NOT NULL
+        session_id TEXT NOT NULL,
+        details_json TEXT NOT NULL DEFAULT '{}'
       ) STRICT
     `);
+        const columns = this.database
+            .prepare("PRAGMA table_info(audit_events)")
+            .all();
+        if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
+            this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
+        }
     }
     record(record) {
         this.database
@@ -23,10 +30,11 @@ export class AuditStore {
             recorded_at,
             event,
             command_id,
-            session_id
-          ) VALUES (?, ?, ?, ?)
+            session_id,
+            details_json
+          ) VALUES (?, ?, ?, ?, ?)
         `)
-            .run(new Date().toISOString(), record.event, record.commandId, record.sessionId);
+            .run(new Date().toISOString(), record.event, record.commandId, record.sessionId, JSON.stringify(record.details ?? {}));
     }
     close() {
         this.database.close();

package/dist/audit/audit-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-store.js","sourceRoot":"","sources":["../../src/audit/audit-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,MAAM,OAAO,UAAU;IACJ,QAAQ,CAAe;IAExC,YAAY,IAAY;QACtB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;;;;;;;;KAQlB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAmB;QACxB,IAAI,CAAC,QAAQ;aACV,OAAO,CACN;;;;;;;SAOC,CACF;aACA,GAAG,CACF,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB,CAAC;IACN,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"audit-store.js","sourceRoot":"","sources":["../../src/audit/audit-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,OAAO,UAAU;IACJ,QAAQ,CAAe;IAExC,YAAY,IAAY;QACtB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;KASlB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;aAC1B,OAAO,CAAC,iCAAiC,CAAC;aAC1C,GAAG,EAAE,CAAC;QACT,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,cAAc,CAAC,EACzE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,6EAA6E,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAmB;QACxB,IAAI,CAAC,QAAQ;aACV,OAAO,CACN;;;;;;;;SAQC,CACF;aACA,GAAG,CACF,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CACrC,CAAC;IACN,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/authorization/local-authorization-error.d.ts

@@ -0,0 +1,5 @@
+export declare class LocalAuthorizationError extends Error {
+    readonly code = "local_authorization_failed";
+    constructor(message: string, options?: ErrorOptions);
+}
+//# sourceMappingURL=local-authorization-error.d.ts.map

package/dist/authorization/local-authorization-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-authorization-error.d.ts","sourceRoot":"","sources":["../../src/authorization/local-authorization-error.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,gCAAgC;IAE7C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,EAGtD;CACF"}

package/dist/authorization/local-authorization-error.js

@@ -0,0 +1,8 @@
+export class LocalAuthorizationError extends Error {
+    code = "local_authorization_failed";
+    constructor(message, options = {}) {
+        super(message, options);
+        this.name = "LocalAuthorizationError";
+    }
+}
+//# sourceMappingURL=local-authorization-error.js.map

package/dist/authorization/local-authorization-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-authorization-error.js","sourceRoot":"","sources":["../../src/authorization/local-authorization-error.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,4BAA4B,CAAC;IAE7C,YAAY,OAAe,EAAE,OAAO,GAAiB,EAAE;QACrD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF"}

package/dist/authorization/workspace-directory.d.ts

@@ -6,12 +6,23 @@ export declare class WorkspaceDirectoryListing {
     readonly parentDirectoryId: string;
     constructor(directoryId: string, directoryLabel: string, entries: readonly WorkspaceEntry[], parentDirectoryId: string);
 }
+/** Pairing authorizes the machine. Directory identifiers select a working
+ * directory; they do not grant additional filesystem capabilities. */
 export declare class WorkspaceDirectoryService {
     #private;
-    constructor(approvedBindingId: string, approvedRoot: string);
-    readonly resolve: (requestedBindingId: string, requestedDirectoryId: string) => Promise<string>;
-    readonly list: (requestedBindingId: string, requestedDirectoryId: string) => Promise<WorkspaceDirectoryListing>;
-    readonly resolveMany: (requestedBindingId: string, directoryIds: readonly string[]) => Promise<readonly string[]>;
-    readonly resolveRoot: () => Promise<string>;
+    constructor(bindingId: string, defaultWorkspace: string);
+    private readonly authorizeMachine;
+    private readonly requestedPath;
+    private readonly resolvePath;
+    private readonly label;
+    readonly identify: (bindingId: string, requestedPath: string, signal: AbortSignal) => Promise<{
+        readonly path: string;
+        readonly directoryId: string;
+        readonly name: string;
+        readonly label: string;
+    }>;
+    readonly resolve: (bindingId: string, id: string, signal: AbortSignal) => Promise<string>;
+    readonly list: (bindingId: string, id: string, signal: AbortSignal) => Promise<WorkspaceDirectoryListing>;
+    readonly resolveMany: (bindingId: string, ids: readonly string[], signal: AbortSignal) => Promise<readonly string[]>;
 }
 //# sourceMappingURL=workspace-directory.d.ts.map

package/dist/authorization/workspace-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-directory.d.ts","sourceRoot":"","sources":["../../src/authorization/workspace-directory.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAQ/D,qBAAa,yBAAyB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,YACE,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,iBAAiB,EAAE,MAAM,EAM1B;CACF;AAmDD,qBAAa,yBAAyB;;IAIpC,YAAY,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAG1D;IAED,QAAQ,CAAC,OAAO,uBACM,MAAM,wBACJ,MAAM,KAC3B,OAAO,CAAC,MAAM,CAAC,CA0BhB;IAEF,QAAQ,CAAC,IAAI,uBACS,MAAM,wBACJ,MAAM,KAC3B,OAAO,CAAC,yBAAyB,CAAC,CAqDnC;IAEF,QAAQ,CAAC,WAAW,uBACE,MAAM,gBACZ,SAAS,MAAM,EAAE,KAC9B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAc3B;IAEF,QAAQ,CAAC,WAAW,QAAa,OAAO,CAAC,MAAM,CAAC,CAqB9C;CACH"}
+{"version":3,"file":"workspace-directory.d.ts","sourceRoot":"","sources":["../../src/authorization/workspace-directory.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,qBAAa,yBAAyB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,YACE,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,iBAAiB,EAAE,MAAM,EAM1B;CACF;AA8BD;sEACsE;AACtE,qBAAa,yBAAyB;;IAIpC,YAAY,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAGtD;IAED,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAK/B;IAEF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAQ5B;IAEF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAiC1B;IAEF,OAAO,CAAC,QAAQ,CAAC,KAAK,CASpB;IAEF,QAAQ,CAAC,QAAQ,cACJ,MAAM,iBACF,MAAM,UACb,WAAW,KAClB,OAAO,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC,CASA;IAEF,QAAQ,CAAC,OAAO,cACH,MAAM,MACb,MAAM,UACF,WAAW,KAClB,OAAO,CAAC,MAAM,CAAC,CAGhB;IAEF,QAAQ,CAAC,IAAI,cACA,MAAM,MACb,MAAM,UACF,WAAW,KAClB,OAAO,CAAC,yBAAyB,CAAC,CAyCnC;IAEF,QAAQ,CAAC,WAAW,cACP,MAAM,OACZ,SAAS,MAAM,EAAE,UACd,WAAW,KAClB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAI3B;CACH"}