@quantiya/codevibe-codex-plugin 2.0.64 → 2.0.66

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-prompt-resolution.d.ts

@@ -0,0 +1,38 @@
+type PromptOwner = {
+    sessionId: string;
+    promptId: string;
+} & ({
+    producerKind: 'PLUGIN_APPROVAL';
+    ownerToken: string;
+} | {
+    producerKind: 'CORE_OFFER';
+    sessionGenerationId: string;
+    expectedSessionKeyGen: string;
+});
+export type ResolveDesktopSyncPromptInput = PromptOwner & {
+    clientOperationId: string;
+};
+export interface SyncPromptResolutionReceipt {
+    sessionId: string;
+    promptId: string;
+    state: 'RESOLVED';
+    controlClass: 'PROMPT_OWNERSHIP';
+}
+export interface PromptResolutionRecord {
+    schemaVersion: 1;
+    kind: 'PROMPT_RESOLUTION';
+    operationId: string;
+    input: ResolveDesktopSyncPromptInput;
+}
+/** Closed, flat ownership profiles. No content, Event source or caller proof.
+ * Copy only own data properties before any account/key/network await. */
+export declare function snapshotSyncPromptResolution(value: unknown): ResolveDesktopSyncPromptInput;
+/** Exact ownership deletion is idempotent by canonical marker absence. Keep a
+ * stable control identity across retries; never mint a new visible occurrence.
+ * This does not itself persist the owner's outstanding resolution intent. */
+export declare function makeSyncPromptResolutionInput(userId: string, owner: PromptOwner): ResolveDesktopSyncPromptInput;
+/** Encrypted local recovery record, containing ownership only, never content or
+ * a fresh signature. The original creator key signs anew at each retry. */
+export declare function decodePromptResolution(value: unknown, userId: string, invalidRecord: () => never): PromptResolutionRecord;
+export declare function parseSyncPromptResolutionReceipt(value: unknown, expected: ResolveDesktopSyncPromptInput): SyncPromptResolutionReceipt;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-prompt-retention.d.ts

@@ -0,0 +1,99 @@
+import { z } from 'zod';
+import { type SyncPromptRetentionReceipt } from './sync-event-client';
+declare const schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"PROMPT_RETENTION">;
+    operationId: z.ZodString;
+    sessionId: z.ZodString;
+    sessionGenerationId: z.ZodString;
+    cursor: z.ZodNullable<z.ZodString>;
+    entries: z.ZodArray<z.ZodUnion<[z.ZodObject<{
+        promptId: z.ZodString;
+        status: z.ZodLiteral<"REFRESHED">;
+        checkedAt: z.ZodNumber;
+        checkAfter: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        promptId: string;
+        status: "REFRESHED";
+        expiresAt: number;
+        checkedAt: number;
+        checkAfter: number;
+    }, {
+        promptId: string;
+        status: "REFRESHED";
+        expiresAt: number;
+        checkedAt: number;
+        checkAfter: number;
+    }>, z.ZodObject<{
+        promptId: z.ZodString;
+        status: z.ZodLiteral<"RERAISE_REQUIRED">;
+        reRaiseToken: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        promptId: string;
+        status: "RERAISE_REQUIRED";
+        reRaiseToken: string;
+    }, {
+        promptId: string;
+        status: "RERAISE_REQUIRED";
+        reRaiseToken: string;
+    }>]>, "many">;
+}, "strict", z.ZodTypeAny, {
+    kind: "PROMPT_RETENTION";
+    entries: ({
+        promptId: string;
+        status: "REFRESHED";
+        expiresAt: number;
+        checkedAt: number;
+        checkAfter: number;
+    } | {
+        promptId: string;
+        status: "RERAISE_REQUIRED";
+        reRaiseToken: string;
+    })[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    operationId: string;
+    cursor: string | null;
+}, {
+    kind: "PROMPT_RETENTION";
+    entries: ({
+        promptId: string;
+        status: "REFRESHED";
+        expiresAt: number;
+        checkedAt: number;
+        checkAfter: number;
+    } | {
+        promptId: string;
+        status: "RERAISE_REQUIRED";
+        reRaiseToken: string;
+    })[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    operationId: string;
+    cursor: string | null;
+}>;
+export type PromptRetentionRecord = z.infer<typeof schema>;
+export type PromptReRaiseDisposition = 'RERAISED' | 'CLOSED' | 'OMITTED' | 'RETRY';
+export declare function decodePromptRetention(value: unknown): PromptRetentionRecord;
+export interface PromptRetentionJournal {
+    run(promptIds: readonly string[], refresh: (promptId: string) => Promise<SyncPromptRetentionReceipt>, reRaise: (promptId: string, reRaiseToken: string) => Promise<PromptReRaiseDisposition>, now?: () => number): Promise<void>;
+    /** Only after the exact session is canonically INACTIVE and work is joined. */
+    remove(): Promise<void>;
+}
+interface Store {
+    read(): Promise<PromptRetentionRecord>;
+    write(row: PromptRetentionRecord): Promise<void>;
+    remove(): Promise<void>;
+    runExclusive<T>(fn: (fence: () => Promise<void>) => Promise<T>): Promise<T>;
+}
+/** One bounded encrypted record per session incarnation. Cursor advances BEFORE
+ * network I/O; a failed target cannot monopolize each subsequent batch. Absence
+ * is persisted BEFORE re-raise, and cleared only after its idempotent producer
+ * acknowledges success or confirms closure. Unknown/temporarily missing local
+ * prompts are not resurrected. Their absence receipts wait for owner recovery.
+ */
+export declare function createPromptRetentionJournal(store: Store): PromptRetentionJournal;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-read-client.d.ts

@@ -0,0 +1,131 @@
+import { type DeviceSigningKey } from '../local-executor/class-a-sign';
+import type { DesktopSyncSessionScope } from './sync-operation-journal';
+import { type SyncResolutionScope, type SyncResolutionResult } from './sync-resolution-recovery';
+export declare class SyncReadClientError extends Error {
+    readonly code: 'INVALID_SYNC_READ_INPUT' | 'INVALID_SYNC_READ_RESPONSE' | 'SYNC_READ_UNAVAILABLE';
+    readonly backendCode?: string | undefined;
+    readonly retryAfterMs?: number | undefined;
+    constructor(code: 'INVALID_SYNC_READ_INPUT' | 'INVALID_SYNC_READ_RESPONSE' | 'SYNC_READ_UNAVAILABLE', backendCode?: string | undefined, retryAfterMs?: number | undefined);
+}
+/** Shared closed error envelope for HTTP and authenticated socket receipts. */
+export declare function syncReadResponseError(value: unknown): SyncReadClientError;
+export interface DesktopSyncRegistrationAttempt {
+    clientOperationId: string;
+    issuedAtEpochMs: number;
+}
+export interface DesktopSyncReadCredential extends DesktopSyncSessionScope {
+    credential: string;
+    expiresAtEpochMs: number;
+}
+/** Stored encrypted Event shape, NOT the decrypted GraphQL/UI Event shape. */
+export type SyncReadEvent = Readonly<Record<string, unknown> & {
+    eventId: string;
+    sessionId: string;
+    sessionGenerationId: string;
+    timestamp: string;
+    type: string;
+    source: 'DESKTOP' | 'MOBILE';
+}>;
+export interface SyncHistoryPage extends DesktopSyncSessionScope {
+    version: 1;
+    items: readonly SyncReadEvent[];
+    nextToken: string | null;
+}
+export interface SyncInputCoordinate {
+    eventId: string;
+    timestamp: string;
+}
+export interface SyncPendingInputsPage extends DesktopSyncSessionScope {
+    version: 1;
+    kind: 'PENDING_INPUTS';
+    items: readonly Readonly<SyncInputCoordinate>[];
+    nextToken: string | null;
+}
+export interface SyncLegacyPendingInputsPage extends DesktopSyncSessionScope {
+    version: 1;
+    kind: 'LEGACY_PENDING_INPUTS';
+    items: readonly Readonly<SyncInputCoordinate>[];
+    nextToken: string | null;
+}
+export interface SyncRecoveryTarget {
+    eventId: string;
+    timestamp: string;
+    eventRevision: string;
+    eventSha256: string;
+}
+export interface SyncExecutedInput extends DesktopSyncSessionScope {
+    eventId: string;
+    timestamp: string;
+    source: 'MOBILE';
+    type: string;
+    deliveryStatus: 'EXECUTED';
+}
+export interface DesktopSyncSocketProof {
+    input: Readonly<Record<string, unknown>>;
+    headers?: Readonly<Record<string, string>>;
+}
+/** One explicit request per operation: never auto-page, auto-register, retry an
+ * exact-fetch capability, or fall back to unmetered AppSync history. The caller
+ * owns durable registration intent and credential lifetime. Endpoints come
+ * from deployment configuration, not Event/notification/customer payloads. */
+export declare class DesktopSyncReadClient {
+    private readonly deps;
+    private readonly endpoint;
+    private readonly scope;
+    constructor(deps: {
+        endpoint: string;
+        userId: string;
+        sessionScope: DesktopSyncSessionScope;
+        assertAccount(): void;
+        getToken(signal?: AbortSignal): Promise<string>;
+        getSigningKey(): Promise<DeviceSigningKey>;
+        fetch?: typeof globalThis.fetch;
+        now?: () => number;
+        resolutionQuery?(input: SyncResolutionScope & {
+            desktopProof: string;
+        }, signal?: AbortSignal): Promise<unknown>;
+    });
+    private now;
+    private fence;
+    private credential;
+    private event;
+    private request;
+    /** Same pinned identity as HTTP. CONNECT alone carries the current JWT;
+     * HELLO/HEARTBEAT are signed for the already authorized socket. */
+    socketProof(action: 'CONNECT' | 'HELLO' | 'HEARTBEAT', value: DesktopSyncReadCredential, connectionGeneration?: number, signal?: AbortSignal): Promise<DesktopSyncSocketProof>;
+    /** Persist clientOperationId BEFORE calling. A lost response retries that
+     * exact intent with a fresh signed proof time; never remint the operation. */
+    register(attempt: DesktopSyncRegistrationAttempt, signal?: AbortSignal): Promise<DesktopSyncReadCredential>;
+    history(value: DesktopSyncReadCredential, nextToken?: string, signal?: AbortSignal): Promise<SyncHistoryPage>;
+    exact(value: DesktopSyncReadCredential, target: {
+        eventId: string;
+        capability: string;
+        eventSha256: string;
+    }, signal?: AbortSignal): Promise<SyncReadEvent>;
+    /** One authenticated control query, then exactly one paid body request. A
+     * lost exact response is NOT retried: the next explicit recovery query sees
+     * a claimed capability and uses the known-coordinate history path instead. */
+    gateResolution(value: DesktopSyncReadCredential, promptId: string, signal?: AbortSignal): Promise<SyncResolutionResult>;
+    /** Discover at most 32 unexecuted input coordinates. This never reads or
+     * dispatches conversation history; each coordinate needs a fresh status read. */
+    pendingInputs(value: DesktopSyncReadCredential, nextToken?: string, signal?: AbortSignal): Promise<SyncPendingInputsPage>;
+    /** A one-time per-connection scan of old mobile prompt coordinates. Empty
+     * pages may have a cursor because the bounded server scan can evaluate 32
+     * non-input/already-executed Events without returning any handoff body. */
+    legacyPendingInputs(value: DesktopSyncReadCredential, nextToken?: string, signal?: AbortSignal): Promise<SyncLegacyPendingInputsPage>;
+    /** Current authenticated input only. DELIVERED is not permission to replay;
+     * the inbound journal determines whether this host ever began a handoff. */
+    pendingInput(value: DesktopSyncReadCredential, target: SyncInputCoordinate, signal?: AbortSignal): Promise<SyncReadEvent | null>;
+    /** A separate charged history request for ONE known coordinate. No reused
+     * capability, recursive page drain or dispatch of unrelated mobile inputs. */
+    recoverExact(value: DesktopSyncReadCredential, target: SyncRecoveryTarget, signal?: AbortSignal): Promise<SyncReadEvent>;
+    /** Fresh exact-coordinate authority. A newer revision is not corruption;
+     * callers still decide whether the durable handoff boundary permits replay. */
+    recoverCurrent(value: DesktopSyncReadCredential, target: SyncRecoveryTarget, signal?: AbortSignal): Promise<SyncReadEvent | null>;
+    /** A lost execution acknowledgement must NOT replay the input. Read its
+     * current canonical status via the same bounded, charged coordinate query.
+     * Return no payload: newer content can never enter the provider callback. */
+    executionReceipt(value: DesktopSyncReadCredential, target: SyncRecoveryTarget, signal?: AbortSignal): Promise<SyncExecutedInput | null>;
+    private targetedEvent;
+    private coordinateEvent;
+}

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-resolution-recovery.d.ts

@@ -0,0 +1,29 @@
+import type { Event } from '../types/events';
+export interface SyncResolutionScope {
+    sessionId: string;
+    sessionGenerationId: string;
+    promptId: string;
+}
+export interface SyncResolutionReceipt extends SyncResolutionScope {
+    state: 'NOT_FOUND' | 'CLAIMED' | 'RESOLVED';
+    actionable: false;
+    decisionClaimId: string | null;
+    resolutionEventId: string | null;
+    resolutionTimestamp: string | null;
+    resolutionEventDigest: string | null;
+    exactFetchCapability: string | null;
+}
+export type SyncResolutionResult = Readonly<Pick<SyncResolutionReceipt, 'sessionId' | 'promptId' | 'state' | 'actionable' | 'decisionClaimId' | 'resolutionEventId' | 'resolutionTimestamp'> & {
+    resolutionEvent: Event | null;
+}>;
+/** Keep the existing strict dispatch contract; transport credentials and digest
+ * are consumed by verification, never forwarded as new effect authority. */
+export declare function syncResolutionResult(receipt: SyncResolutionReceipt, resolutionEvent: Event | null): SyncResolutionResult;
+export declare function validateSyncResolutionScope(scope: SyncResolutionScope, invalid: () => never): void;
+/** A V2 control receipt contains no Event. Never accept an embedded payload or
+ * infer generation from a mutable Session lookup during cold-start recovery. */
+export declare function parseSyncResolutionReceipt(value: unknown, scope: SyncResolutionScope, invalid: () => never): Readonly<SyncResolutionReceipt>;
+/** Verify immutable decision fields BEFORE decoding metadata. Mutable
+ * publication/accounting/index state is never part of this wire document.
+ * Legacy native rows may omit authority stamps; none are synthesized. */
+export declare function verifySyncResolutionDocument(value: unknown, receipt: SyncResolutionReceipt, invalid: () => never): Event;

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-security-posture.d.ts

@@ -0,0 +1,32 @@
+export type SyncSecurityPosture = 'ISOLATION_OFF' | 'COARSE_EGRESS';
+export type SyncSecurityPostureInput = {
+    clientOperationId: string;
+    sessionId: string;
+    sessionGenerationId: string;
+    expectedSessionKeyGen: string;
+    posture: SyncSecurityPosture;
+};
+export interface SyncSecurityPostureReceipt {
+    schemaVersion: 1;
+    kind: 'SECURITY_POSTURE';
+    state: 'RECORDED';
+    sessionId: string;
+    sessionGenerationId: string;
+    posture: SyncSecurityPosture;
+    noticeId: string;
+    delivery: {
+        state: 'ATTEMPTED' | 'REPLAY_NO_SEND';
+        outcomes: Array<{
+            installationId: string;
+            outcome: 'SUBMITTED' | 'STALE_RECIPIENT' | 'ATTEMPT_UNCONFIRMED';
+        }>;
+    };
+}
+/** Stable signed fact, not an Event or a client-controlled notice body. The
+ * canonical server identity ignores operation-ID changes within this posture. */
+export declare function makeSyncSecurityPostureInput(userId: string, scope: Omit<SyncSecurityPostureInput, 'clientOperationId'>): SyncSecurityPostureInput;
+export declare function syncSecurityPostureNoticeId(input: Pick<SyncSecurityPostureInput, 'sessionId' | 'sessionGenerationId' | 'posture'>): string;
+/** RECORDED proves canonical persistence only. SUBMITTED is transport
+ * acceptance, never a phone/render acknowledgment. An ambiguous delivery or
+ * replay remains explicitly visible in the returned receipt, not retried. */
+export declare function parseSyncSecurityPostureReceipt(value: unknown, expected: SyncSecurityPostureInput): SyncSecurityPostureReceipt;

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-session-retirement.d.ts

@@ -0,0 +1,30 @@
+export type ConfirmDesktopSyncRetirementInput = {
+    clientOperationId: string;
+    sessionId: string;
+    sessionGenerationId: string;
+    expectedSessionKeyGen: string;
+};
+export type SyncSessionRetirementReceipt = ConfirmDesktopSyncRetirementInput & {
+    state: 'RETIRED';
+    controlClass: 'SESSION_RETIREMENT';
+};
+export interface ToolSyncRetirementLocation {
+    agent: 'codex' | 'claude';
+    root: string;
+}
+export interface SessionRetirementRecord {
+    schemaVersion: 1;
+    kind: 'SESSION_RETIREMENT';
+    operationId: string;
+    input: ConfirmDesktopSyncRetirementInput;
+    toolOutbox: ToolSyncRetirementLocation | null;
+}
+export declare function snapshotSyncSessionRetirement(value: unknown): ConfirmDesktopSyncRetirementInput;
+/** Stable proof-request identity only: this is not an Event operation ID and
+ * cannot settle, refund or relabel an Event's delivery outcome. */
+export declare function makeSyncSessionRetirementInput(userId: string, scope: Omit<ConfirmDesktopSyncRetirementInput, 'clientOperationId'>): ConfirmDesktopSyncRetirementInput;
+export declare function parseSyncSessionRetirementReceipt(value: unknown, expected: ConfirmDesktopSyncRetirementInput): SyncSessionRetirementReceipt;
+/** The terminal owner writes this encrypted intent only AFTER stop/join. It is
+ * discovery/ordering state, not cached permission: every recovery still needs
+ * fresh cloud retirement proof before deleting source payload. */
+export declare function decodeSessionRetirement(value: unknown, userId: string, bad: () => never): SessionRetirementRecord;

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-shell-source.d.ts

@@ -0,0 +1,151 @@
+import { z } from 'zod';
+import { type CreateDesktopSyncEventInput } from './sync-event-client';
+import type { DesktopSyncSessionScope, DurableSyncResult } from './sync-operation-journal';
+declare const ticketSchema: z.ZodObject<{
+    sourceId: z.ZodString;
+    sequence: z.ZodNumber;
+    operationId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    operationId: string;
+    sourceId: string;
+    sequence: number;
+}, {
+    operationId: string;
+    sourceId: string;
+    sequence: number;
+}>;
+declare const schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"SHELL_SOURCE">;
+    operationId: z.ZodString;
+    sessionId: z.ZodString;
+    sessionGenerationId: z.ZodString;
+    nextSequence: z.ZodNumber;
+    settledThrough: z.ZodNumber;
+    entries: z.ZodArray<z.ZodDiscriminatedUnion<"state", [z.ZodObject<{
+        sequence: z.ZodNumber;
+        operationId: z.ZodString;
+        state: z.ZodLiteral<"STAGED">;
+        input: z.ZodUnknown;
+    }, "strict", z.ZodTypeAny, {
+        state: "STAGED";
+        operationId: string;
+        sequence: number;
+        input?: unknown;
+    }, {
+        state: "STAGED";
+        operationId: string;
+        sequence: number;
+        input?: unknown;
+    }>, z.ZodObject<{
+        sequence: z.ZodNumber;
+        operationId: z.ZodString;
+        state: z.ZodLiteral<"OMITTED">;
+        fingerprint: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        state: "OMITTED";
+        fingerprint: string;
+        operationId: string;
+        sequence: number;
+    }, {
+        state: "OMITTED";
+        fingerprint: string;
+        operationId: string;
+        sequence: number;
+    }>, z.ZodObject<{
+        sequence: z.ZodNumber;
+        operationId: z.ZodString;
+        state: z.ZodLiteral<"SETTLED">;
+    }, "strict", z.ZodTypeAny, {
+        state: "SETTLED";
+        operationId: string;
+        sequence: number;
+    }, {
+        state: "SETTLED";
+        operationId: string;
+        sequence: number;
+    }>]>, "many">;
+}, "strict", z.ZodTypeAny, {
+    kind: "SHELL_SOURCE";
+    entries: ({
+        state: "STAGED";
+        operationId: string;
+        sequence: number;
+        input?: unknown;
+    } | {
+        state: "OMITTED";
+        fingerprint: string;
+        operationId: string;
+        sequence: number;
+    } | {
+        state: "SETTLED";
+        operationId: string;
+        sequence: number;
+    })[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    operationId: string;
+    nextSequence: number;
+    settledThrough: number;
+}, {
+    kind: "SHELL_SOURCE";
+    entries: ({
+        state: "STAGED";
+        operationId: string;
+        sequence: number;
+        input?: unknown;
+    } | {
+        state: "OMITTED";
+        fingerprint: string;
+        operationId: string;
+        sequence: number;
+    } | {
+        state: "SETTLED";
+        operationId: string;
+        sequence: number;
+    })[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    operationId: string;
+    nextSequence: number;
+    settledThrough: number;
+}>;
+export type ShellSyncSourceRecord = z.infer<typeof schema>;
+export type ShellSyncTicket = z.infer<typeof ticketSchema>;
+export type ShellSyncSourceInventory = DesktopSyncSessionScope & {
+    sourceId: string;
+    pendingCount: number;
+};
+/** The source is the fsynced prepared event, not a volatile conversation entry.
+ * Each append is a NEW occurrence. Retrying that occurrence uses its ticket,
+ * never append(), re-encryption, or a hash of customer text as an event ID.
+ * A compact monotonic settlement cursor prevents old tickets being reminted.
+ */
+export interface ShellSyncSource {
+    append(input: CreateDesktopSyncEventInput): Promise<ShellSyncTicket>;
+    /** Complete an already-durable settlement/ack, without any cloud send. */
+    recover(): Promise<void>;
+    /** Null means this ticket was already durably settled, not a delivery claim. */
+    deliver(ticket: ShellSyncTicket, signal?: AbortSignal): Promise<DurableSyncResult | null>;
+    drain(maximum?: number, signal?: AbortSignal): Promise<number>;
+}
+export declare function decodeShellSyncSource(value: unknown, invalid: () => never): ShellSyncSourceRecord;
+/** Persistence and locks are supplied by the existing bounded encrypted account store. */
+export declare function createShellSyncSource(options: {
+    id: string;
+    scope: Readonly<DesktopSyncSessionScope>;
+    invalid(): never;
+    full(): never;
+    collision(): never;
+    locked<T>(fn: (assertOwnership: () => Promise<void>) => Promise<T>): Promise<T>;
+    drainLocked<T>(fn: () => Promise<T>): Promise<T>;
+    read(): Promise<ShellSyncSourceRecord | null>;
+    write(row: ShellSyncSourceRecord): Promise<void>;
+    prepare(input: CreateDesktopSyncEventInput): Promise<string>;
+    omitNewPayload?(): Promise<boolean>;
+    retry(id: string, signal?: AbortSignal): Promise<DurableSyncResult>;
+    acknowledge(id: string): Promise<void>;
+}): ShellSyncSource;
+export {};