@sentropic/h2a-cli 0.26.3 → 0.27.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin.js +7 -1
- package/dist/bin.js.map +1 -1
- package/dist/cli.d.ts +18 -0
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +104 -0
- package/dist/cli.js.map +1 -1
- package/dist/index.d.ts +3 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -2
- package/dist/index.js.map +1 -1
- package/dist/runtime/mirror/accept.d.ts +39 -0
- package/dist/runtime/mirror/accept.d.ts.map +1 -0
- package/dist/runtime/mirror/accept.js +49 -0
- package/dist/runtime/mirror/accept.js.map +1 -0
- package/dist/runtime/mirror/build.d.ts +25 -0
- package/dist/runtime/mirror/build.d.ts.map +1 -0
- package/dist/runtime/mirror/build.js +33 -0
- package/dist/runtime/mirror/build.js.map +1 -0
- package/dist/runtime/mirror/index.d.ts +9 -0
- package/dist/runtime/mirror/index.d.ts.map +1 -0
- package/dist/runtime/mirror/index.js +9 -0
- package/dist/runtime/mirror/index.js.map +1 -0
- package/dist/runtime/mirror/serve.d.ts +30 -0
- package/dist/runtime/mirror/serve.d.ts.map +1 -0
- package/dist/runtime/mirror/serve.js +89 -0
- package/dist/runtime/mirror/serve.js.map +1 -0
- package/package.json +2 -2
package/dist/index.d.ts
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import { H2A_CLAUDE_HOST } from "./hosts/claude.js";
|
|
2
|
-
import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe } from "./cli.js";
|
|
2
|
+
import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush } from "./cli.js";
|
|
3
3
|
import { H2A_CODEX_HOST } from "./hosts/codex.js";
|
|
4
4
|
import { H2A_GEMINI_HOST } from "./hosts/gemini.js";
|
|
5
5
|
import { H2A_AGY_HOST } from "./hosts/agy.js";
|
|
6
6
|
import { H2A_CLI_MCP_TOOL_NAMES } from "./mcp.js";
|
|
7
7
|
export type { H2AConfigurableHostDescriptor, H2AHostDescriptor, H2AHostWave, McpHostConfigSnippet, RenderMcpConfigOptions } from "./hosts/codex.js";
|
|
8
|
-
export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe };
|
|
8
|
+
export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush };
|
|
9
9
|
export { H2A_CLI_VERB_CONTRACTS, H2A_CLI_VERB_CONTRACT_BY_VERB, type H2ACliExitCode, type H2ACliOutputShape, type H2ACliVerbContract } from "./cli-contract.js";
|
|
10
10
|
export { H2A_STORE_SCHEMA_FILE, H2A_STORE_SCHEMA_VERSION, LockTimeoutError, StoreSchemaMismatchError, createLocalStore, deletePresence, inboxDir, listPresence, localStorePaths, negotiationDir, negotiationJournalFile, outboxDir, presenceFile, readPresence, safePathSegment, sanitizeStorePaths, updatePresence, withLease, withLeaseSync, withLock, withLockSync, writePresence, type CreateLocalStoreOptions, type H2AKeyEvent, type H2ASubagentAuditEvent, type H2ASubagentStatus, type H2AStoreSchemaSentinel, type LeaseHandle, type LeaseRecord, type ListPresenceOptions, type LocalStore, type LocalStorePaths, type LockOwner, type PresenceWriteResult, type SanitizePathsResult, type SanitizeRenameEntry, type WithLeaseOptions, type WithLockOptions } from "./runtime/local-files/index.js";
|
|
11
11
|
export { H2A_CLI_MCP_TOOL_DESCRIPTORS, NotificationDispatcher, SessionRegistry, createMcpServer, runMcpStdio, type CreateMcpServerOptions, type McpErrorResult, type McpPushNotification, type McpServer, type McpToolDescriptor, type McpToolName, type McpToolResult, type NotificationSink, type OpenSessionRequest, type RunMcpStdioOptions, type SessionRegistryOptions } from "./runtime/mcp/index.js";
|
|
@@ -21,6 +21,7 @@ export { cmdUpgrade, cmdOrg, cmdCoach } from "./cli.js";
|
|
|
21
21
|
export { resolveSysmlElement, hashSysmlElement, verifyEnvelopeSysmlRef, extractSysmlRef, sysmlQueryScope, type SysmlFetchImpl, type SysmlFetchResponse, type ResolveSysmlOptions, type VerifyEnvelopeSysmlOptions, type VerifyEnvelopeSysmlResult, type H2ASysmlQueryScope, type H2ASysmlQueryDetail } from "./runtime/sysml/index.js";
|
|
22
22
|
export { acceptRemoteEnvelope, createRemoteServer, rejectionStatus, remoteServerForStore, sendRemoteEnvelope, type AcceptRemoteOptions, type H2AAcceptRejection, type H2AAcceptResult, type RemoteServerForStoreOptions, type RemoteServerOptions, type SendRemoteOptions, type SendRemoteResult } from "./runtime/remote/index.js";
|
|
23
23
|
export * from "./runtime/mcp-http/index.js";
|
|
24
|
+
export * from "./runtime/mirror/index.js";
|
|
24
25
|
export declare const H2A_CLI_HOSTS: readonly [import("./hosts/codex.js").H2AConfigurableHostDescriptor, import("./hosts/codex.js").H2AConfigurableHostDescriptor, import("./hosts/codex.js").H2AConfigurableHostDescriptor, import("./hosts/codex.js").H2AConfigurableHostDescriptor];
|
|
25
26
|
export declare const H2A_CLI_ADAPTER: {
|
|
26
27
|
readonly packageName: "@sentropic/h2a-cli";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAElD,YAAY,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,CAAC;AAEF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EACf,eAAe,EACf,aAAa,IAAI,qBAAqB,EACtC,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,WAAW,EACX,uBAAuB,EACvB,4BAA4B,EAC5B,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACxC,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,mCAAmC,EACzC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAEnC,cAAc,6BAA6B,CAAC;AAE5C,cAAc,2BAA2B,CAAC;AAE1C,eAAO,MAAM,aAAa,mPAKhB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
import { H2A_CLAUDE_HOST } from "./hosts/claude.js";
|
|
2
|
-
import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe } from "./cli.js";
|
|
2
|
+
import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush } from "./cli.js";
|
|
3
3
|
import { H2A_CODEX_HOST } from "./hosts/codex.js";
|
|
4
4
|
import { H2A_GEMINI_HOST } from "./hosts/gemini.js";
|
|
5
5
|
import { H2A_AGY_HOST } from "./hosts/agy.js";
|
|
6
6
|
import { H2A_CLI_MCP_TOOL_NAMES } from "./mcp.js";
|
|
7
|
-
export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe };
|
|
7
|
+
export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush };
|
|
8
8
|
export { H2A_CLI_VERB_CONTRACTS, H2A_CLI_VERB_CONTRACT_BY_VERB } from "./cli-contract.js";
|
|
9
9
|
export { H2A_STORE_SCHEMA_FILE, H2A_STORE_SCHEMA_VERSION, LockTimeoutError, StoreSchemaMismatchError, createLocalStore, deletePresence, inboxDir, listPresence, localStorePaths, negotiationDir, negotiationJournalFile, outboxDir, presenceFile, readPresence, safePathSegment, sanitizeStorePaths, updatePresence, withLease, withLeaseSync, withLock, withLockSync, writePresence } from "./runtime/local-files/index.js";
|
|
10
10
|
export { H2A_CLI_MCP_TOOL_DESCRIPTORS, NotificationDispatcher, SessionRegistry, createMcpServer, runMcpStdio } from "./runtime/mcp/index.js";
|
|
@@ -20,6 +20,7 @@ export { cmdUpgrade, cmdOrg, cmdCoach } from "./cli.js";
|
|
|
20
20
|
export { resolveSysmlElement, hashSysmlElement, verifyEnvelopeSysmlRef, extractSysmlRef, sysmlQueryScope } from "./runtime/sysml/index.js";
|
|
21
21
|
export { acceptRemoteEnvelope, createRemoteServer, rejectionStatus, remoteServerForStore, sendRemoteEnvelope } from "./runtime/remote/index.js";
|
|
22
22
|
export * from "./runtime/mcp-http/index.js";
|
|
23
|
+
export * from "./runtime/mirror/index.js";
|
|
23
24
|
export const H2A_CLI_HOSTS = [
|
|
24
25
|
H2A_CODEX_HOST,
|
|
25
26
|
H2A_CLAUDE_HOST,
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAUlD,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,CAAC;AAEF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAI9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,aAAa,EAiBd,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,WAAW,EAYZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAGjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,eAAe,EAGhB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EAqBzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EACf,eAAe,EACf,aAAa,IAAI,qBAAqB,EACtC,sBAAsB,EAKvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,WAAW,EACX,uBAAuB,EACvB,4BAA4B,EAC5B,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,4BAA4B,EA0B7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EAIhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,oBAAoB,EAWrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EAKrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EAQhB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAQnB,MAAM,2BAA2B,CAAC;AAEnC,cAAc,6BAA6B,CAAC;AAE5C,cAAc,2BAA2B,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,cAAc;IACd,eAAe;IACf,eAAe;IACf,YAAY;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,oBAAoB;IACjC,eAAe,EAAE,gBAAgB;IACjC,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,aAAa;IACpB,YAAY,EAAE,sBAAsB;CAC5B,CAAC"}
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 P1 — ingestion trust boundary for an instance mirror (DEC-125).
|
|
3
|
+
*
|
|
4
|
+
* Reuses the EVO-11 verification primitives (`verifyEnvelopeSignature` +
|
|
5
|
+
* `H2AReplayGuard`). Authority is **possession of a key the operator enrolled**,
|
|
6
|
+
* never a self-declared instance id and never a shared bearer token (the Opus
|
|
7
|
+
* review rejected both). Two safeguards, both keyed on the VERIFIED signing key:
|
|
8
|
+
* 1. the envelope must verify against a registry key for the signer OR an
|
|
9
|
+
* operator-enrolled key (`enrolledKeys`) — an unknown key is refused (no
|
|
10
|
+
* trust-on-first-use across the remote boundary);
|
|
11
|
+
* 2. a registration is applied only if its `publicKeys` contains the verified
|
|
12
|
+
* key — an agent can mirror ONLY its own identity (no namespace squatting).
|
|
13
|
+
*
|
|
14
|
+
* Never throws on rejection; only the caller-supplied `applyRegistration` may.
|
|
15
|
+
*/
|
|
16
|
+
import { type H2AActorRegistration, type H2AReplayGuard } from "@sentropic/h2a";
|
|
17
|
+
export type H2AMirrorRejection = "malformed" | "not-mirror" | "no-signature" | "unauthorized-key" | "bad-signature" | "invalid-timestamp" | "expired" | "future" | "replayed" | "instance-key-mismatch";
|
|
18
|
+
export type H2AMirrorResult = {
|
|
19
|
+
ok: true;
|
|
20
|
+
applied: string[];
|
|
21
|
+
signer: string;
|
|
22
|
+
} | {
|
|
23
|
+
ok: false;
|
|
24
|
+
reason: H2AMirrorRejection;
|
|
25
|
+
};
|
|
26
|
+
export interface AcceptMirrorOptions {
|
|
27
|
+
/** Active public-key PEMs already registered for the signer (registry + keyring, minus revoked). */
|
|
28
|
+
resolvePublicKeys: (signerInstance: string) => string[];
|
|
29
|
+
/** Operator-enrolled key PEMs allowed to mirror/bootstrap (out-of-band trust, not a wire token). */
|
|
30
|
+
enrolledKeys: readonly string[];
|
|
31
|
+
/** Replay guard (DEC-074) — its freshness window also enforces timestamp checks. */
|
|
32
|
+
guard: H2AReplayGuard;
|
|
33
|
+
/** Apply an authorized registration to the local (remote-side) store. */
|
|
34
|
+
applyRegistration: (registration: H2AActorRegistration) => void;
|
|
35
|
+
/** Reference time (ms epoch) for the guard. Defaults to `Date.now()`. */
|
|
36
|
+
now?: number;
|
|
37
|
+
}
|
|
38
|
+
export declare function acceptMirrorEnvelope(payload: unknown, options: AcceptMirrorOptions): H2AMirrorResult;
|
|
39
|
+
//# sourceMappingURL=accept.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"accept.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAGL,KAAK,oBAAoB,EAGzB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,YAAY,GACZ,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,mBAAmB,GACnB,SAAS,GACT,QAAQ,GACR,UAAU,GACV,uBAAuB,CAAC;AAE5B,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACxD,oGAAoG;IACpG,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,oFAAoF;IACpF,KAAK,EAAE,cAAc,CAAC;IACtB,yEAAyE;IACzE,iBAAiB,EAAE,CAAC,YAAY,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAChE,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,eAAe,CA+BpG"}
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 P1 — ingestion trust boundary for an instance mirror (DEC-125).
|
|
3
|
+
*
|
|
4
|
+
* Reuses the EVO-11 verification primitives (`verifyEnvelopeSignature` +
|
|
5
|
+
* `H2AReplayGuard`). Authority is **possession of a key the operator enrolled**,
|
|
6
|
+
* never a self-declared instance id and never a shared bearer token (the Opus
|
|
7
|
+
* review rejected both). Two safeguards, both keyed on the VERIFIED signing key:
|
|
8
|
+
* 1. the envelope must verify against a registry key for the signer OR an
|
|
9
|
+
* operator-enrolled key (`enrolledKeys`) — an unknown key is refused (no
|
|
10
|
+
* trust-on-first-use across the remote boundary);
|
|
11
|
+
* 2. a registration is applied only if its `publicKeys` contains the verified
|
|
12
|
+
* key — an agent can mirror ONLY its own identity (no namespace squatting).
|
|
13
|
+
*
|
|
14
|
+
* Never throws on rejection; only the caller-supplied `applyRegistration` may.
|
|
15
|
+
*/
|
|
16
|
+
import { isH2AEnvelope, verifyEnvelopeSignature } from "@sentropic/h2a";
|
|
17
|
+
import { H2A_MIRROR_BODY_KIND } from "./build.js";
|
|
18
|
+
export function acceptMirrorEnvelope(payload, options) {
|
|
19
|
+
if (!isH2AEnvelope(payload))
|
|
20
|
+
return { ok: false, reason: "malformed" };
|
|
21
|
+
const envelope = payload;
|
|
22
|
+
const body = envelope.body;
|
|
23
|
+
if (!body || body.kind !== H2A_MIRROR_BODY_KIND || !Array.isArray(body.registrations)) {
|
|
24
|
+
return { ok: false, reason: "not-mirror" };
|
|
25
|
+
}
|
|
26
|
+
const signer = envelope.actor.instance;
|
|
27
|
+
if (!(envelope.signatures ?? []).some((s) => s.by === signer)) {
|
|
28
|
+
return { ok: false, reason: "no-signature" };
|
|
29
|
+
}
|
|
30
|
+
const candidates = Array.from(new Set([...options.resolvePublicKeys(signer), ...options.enrolledKeys]));
|
|
31
|
+
if (candidates.length === 0)
|
|
32
|
+
return { ok: false, reason: "unauthorized-key" };
|
|
33
|
+
const verifiedPem = candidates.find((pem) => verifyEnvelopeSignature(envelope, pem, { by: signer }));
|
|
34
|
+
if (!verifiedPem)
|
|
35
|
+
return { ok: false, reason: "bad-signature" };
|
|
36
|
+
// Namespacing: only registrations whose publicKeys include the verified key —
|
|
37
|
+
// an agent can publish ONLY its own identity. Checked BEFORE the guard so a
|
|
38
|
+
// wholly-unauthorized payload does not consume the envelope id.
|
|
39
|
+
const authorized = body.registrations.filter((reg) => Array.isArray(reg.publicKeys) && reg.publicKeys.includes(verifiedPem));
|
|
40
|
+
if (authorized.length === 0)
|
|
41
|
+
return { ok: false, reason: "instance-key-mismatch" };
|
|
42
|
+
const replay = options.guard.accept(envelope, options.now);
|
|
43
|
+
if (!replay.ok)
|
|
44
|
+
return { ok: false, reason: replay.reason };
|
|
45
|
+
for (const reg of authorized)
|
|
46
|
+
options.applyRegistration(reg);
|
|
47
|
+
return { ok: true, applied: authorized.map((r) => r.instance ?? r.id), signer };
|
|
48
|
+
}
|
|
49
|
+
//# sourceMappingURL=accept.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"accept.js","sourceRoot":"","sources":["../../../src/runtime/mirror/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,aAAa,EACb,uBAAuB,EAKxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAA8B,MAAM,YAAY,CAAC;AA+B9E,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,OAA4B;IACjF,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,OAA6C,CAAC;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;IACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9E,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEhE,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC/E,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAEnF,MAAM,MAAM,GAAmB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAA4B,EAAE,CAAC;IAElF,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAClF,CAAC"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 P1 — build an "instance mirror": the local instance's OWN registration,
|
|
3
|
+
* wrapped in an h2a envelope ready to be signed and pushed to a remote h2a so
|
|
4
|
+
* its read-only surface (`h2a_discover_instances`) reflects this live agent.
|
|
5
|
+
*
|
|
6
|
+
* P1 replicates instances only (registry). Presence (P2) and NHI (P3) extend the
|
|
7
|
+
* same envelope with more event kinds. The private key never leaves the agent;
|
|
8
|
+
* `buildInstanceMirror` returns an UNSIGNED envelope — the caller signs it with
|
|
9
|
+
* `signEnvelope` (DEC-116: possession of the key is the sole authority anchor).
|
|
10
|
+
*/
|
|
11
|
+
import { type H2AActorRegistration, type H2AEnvelope } from "@sentropic/h2a";
|
|
12
|
+
import type { LocalStore } from "../local-files/index.js";
|
|
13
|
+
export declare const H2A_MIRROR_BODY_KIND: "mirror.instances";
|
|
14
|
+
export interface H2AInstanceMirrorBody {
|
|
15
|
+
readonly kind: typeof H2A_MIRROR_BODY_KIND;
|
|
16
|
+
/** Append-only registration events. P1: the sender's own registration only. */
|
|
17
|
+
readonly registrations: H2AActorRegistration[];
|
|
18
|
+
}
|
|
19
|
+
/**
|
|
20
|
+
* Build the unsigned mirror envelope for `instance` from the local store.
|
|
21
|
+
* `nowMs` is injected (epoch ms) so the id + createdAt are deterministic in
|
|
22
|
+
* tests; the CLI verb passes `Date.now()`.
|
|
23
|
+
*/
|
|
24
|
+
export declare function buildInstanceMirror(store: LocalStore, instance: string, nowMs: number): H2AEnvelope<H2AInstanceMirrorBody>;
|
|
25
|
+
//# sourceMappingURL=build.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAA6B,KAAK,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAExG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,eAAO,MAAM,oBAAoB,EAAG,kBAA2B,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAC3C,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,oBAAoB,EAAE,CAAC;CAChD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,WAAW,CAAC,qBAAqB,CAAC,CAapC"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 P1 — build an "instance mirror": the local instance's OWN registration,
|
|
3
|
+
* wrapped in an h2a envelope ready to be signed and pushed to a remote h2a so
|
|
4
|
+
* its read-only surface (`h2a_discover_instances`) reflects this live agent.
|
|
5
|
+
*
|
|
6
|
+
* P1 replicates instances only (registry). Presence (P2) and NHI (P3) extend the
|
|
7
|
+
* same envelope with more event kinds. The private key never leaves the agent;
|
|
8
|
+
* `buildInstanceMirror` returns an UNSIGNED envelope — the caller signs it with
|
|
9
|
+
* `signEnvelope` (DEC-116: possession of the key is the sole authority anchor).
|
|
10
|
+
*/
|
|
11
|
+
import { H2A_PROTOCOL, H2A_VERSION } from "@sentropic/h2a";
|
|
12
|
+
export const H2A_MIRROR_BODY_KIND = "mirror.instances";
|
|
13
|
+
/**
|
|
14
|
+
* Build the unsigned mirror envelope for `instance` from the local store.
|
|
15
|
+
* `nowMs` is injected (epoch ms) so the id + createdAt are deterministic in
|
|
16
|
+
* tests; the CLI verb passes `Date.now()`.
|
|
17
|
+
*/
|
|
18
|
+
export function buildInstanceMirror(store, instance, nowMs) {
|
|
19
|
+
const reg = store.findInstance(instance);
|
|
20
|
+
if (!reg)
|
|
21
|
+
throw new Error(`mirror: unknown local instance ${instance}`);
|
|
22
|
+
return {
|
|
23
|
+
protocol: H2A_PROTOCOL,
|
|
24
|
+
version: H2A_VERSION,
|
|
25
|
+
id: `mirror:${instance}:${nowMs}`,
|
|
26
|
+
type: "event",
|
|
27
|
+
actor: { instance, role: reg.roles?.[0] ?? "AGENTS", scope: "scope:default" },
|
|
28
|
+
target: { instance },
|
|
29
|
+
body: { kind: H2A_MIRROR_BODY_KIND, registrations: [reg] },
|
|
30
|
+
createdAt: new Date(nowMs).toISOString()
|
|
31
|
+
};
|
|
32
|
+
}
|
|
33
|
+
//# sourceMappingURL=build.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/runtime/mirror/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,WAAW,EAA+C,MAAM,gBAAgB,CAAC;AAIxG,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAA2B,CAAC;AAQhE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAiB,EACjB,QAAgB,EAChB,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,WAAW;QACpB,EAAE,EAAE,UAAU,QAAQ,IAAI,KAAK,EAAE;QACjC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE;QAC7E,MAAM,EAAE,EAAE,QAAQ,EAAE;QACpB,IAAI,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE;QAC1D,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;KACzC,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 — remote presence mirror (DEC-125). Local agents push signed snapshots
|
|
3
|
+
* of their state to a remote h2a so its read-only surface reflects reality.
|
|
4
|
+
* P1: instances only. Core stays dep-free; this lives in @sentropic/h2a-cli.
|
|
5
|
+
*/
|
|
6
|
+
export { buildInstanceMirror, H2A_MIRROR_BODY_KIND, type H2AInstanceMirrorBody } from "./build.js";
|
|
7
|
+
export { acceptMirrorEnvelope, type AcceptMirrorOptions, type H2AMirrorRejection, type H2AMirrorResult } from "./accept.js";
|
|
8
|
+
export { mirrorServerForStore, mirrorRejectionStatus, type MirrorServerForStoreOptions } from "./serve.js";
|
|
9
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,2BAA2B,EACjC,MAAM,YAAY,CAAC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 — remote presence mirror (DEC-125). Local agents push signed snapshots
|
|
3
|
+
* of their state to a remote h2a so its read-only surface reflects reality.
|
|
4
|
+
* P1: instances only. Core stays dep-free; this lives in @sentropic/h2a-cli.
|
|
5
|
+
*/
|
|
6
|
+
export { buildInstanceMirror, H2A_MIRROR_BODY_KIND } from "./build.js";
|
|
7
|
+
export { acceptMirrorEnvelope } from "./accept.js";
|
|
8
|
+
export { mirrorServerForStore, mirrorRejectionStatus } from "./serve.js";
|
|
9
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/mirror/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EAIrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,YAAY,CAAC"}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 P1 — HTTP ingester for instance mirrors. A thin, channel-untrusting
|
|
3
|
+
* front-end over `acceptMirrorEnvelope`: it reads a POSTed signed mirror and,
|
|
4
|
+
* on success, applies the registration to the store via `registerInstance`.
|
|
5
|
+
*
|
|
6
|
+
* Runs as a SEPARATE deployment from the read-only MCP pod (it writes the store;
|
|
7
|
+
* the MCP surface only reads it), co-mounting the RWX PVC. Store-agnostic +
|
|
8
|
+
* unit-testable; the k8s wiring is the deploy kit.
|
|
9
|
+
*/
|
|
10
|
+
import { type Server } from "node:http";
|
|
11
|
+
import { type H2AReplayGuard } from "@sentropic/h2a";
|
|
12
|
+
import type { LocalStore } from "../local-files/store.js";
|
|
13
|
+
import { type H2AMirrorRejection } from "./accept.js";
|
|
14
|
+
export interface MirrorServerForStoreOptions {
|
|
15
|
+
/** Operator-enrolled key PEMs allowed to mirror/bootstrap (out-of-band trust). */
|
|
16
|
+
enrolledKeys?: readonly string[];
|
|
17
|
+
/** POST endpoint path. Default `/h2a/mirror`. */
|
|
18
|
+
path?: string;
|
|
19
|
+
/** Shared replay guard. Defaults to a fresh in-memory guard. */
|
|
20
|
+
guard?: H2AReplayGuard;
|
|
21
|
+
/** Body-size cap (bytes). Default 256 KiB. */
|
|
22
|
+
maxBodyBytes?: number;
|
|
23
|
+
/** Clock source handed to the guard. Defaults to `Date.now`. */
|
|
24
|
+
now?: () => number;
|
|
25
|
+
}
|
|
26
|
+
/** Map a mirror-pipeline rejection to an HTTP status code. */
|
|
27
|
+
export declare function mirrorRejectionStatus(reason: H2AMirrorRejection): number;
|
|
28
|
+
/** Build (unstarted) the mirror ingester bound to `store`. */
|
|
29
|
+
export declare function mirrorServerForStore(store: LocalStore, options?: MirrorServerForStoreOptions): Server;
|
|
30
|
+
//# sourceMappingURL=serve.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,2BAA2B;IAC1C,kFAAkF;IAClF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAmBxE;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC,GAAG,MAAM,CAmDzG"}
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* EVO-13 P1 — HTTP ingester for instance mirrors. A thin, channel-untrusting
|
|
3
|
+
* front-end over `acceptMirrorEnvelope`: it reads a POSTed signed mirror and,
|
|
4
|
+
* on success, applies the registration to the store via `registerInstance`.
|
|
5
|
+
*
|
|
6
|
+
* Runs as a SEPARATE deployment from the read-only MCP pod (it writes the store;
|
|
7
|
+
* the MCP surface only reads it), co-mounting the RWX PVC. Store-agnostic +
|
|
8
|
+
* unit-testable; the k8s wiring is the deploy kit.
|
|
9
|
+
*/
|
|
10
|
+
import { createServer } from "node:http";
|
|
11
|
+
import { createReplayGuard } from "@sentropic/h2a";
|
|
12
|
+
import { acceptMirrorEnvelope } from "./accept.js";
|
|
13
|
+
/** Map a mirror-pipeline rejection to an HTTP status code. */
|
|
14
|
+
export function mirrorRejectionStatus(reason) {
|
|
15
|
+
switch (reason) {
|
|
16
|
+
case "malformed":
|
|
17
|
+
case "not-mirror":
|
|
18
|
+
case "no-signature":
|
|
19
|
+
case "instance-key-mismatch":
|
|
20
|
+
case "invalid-timestamp":
|
|
21
|
+
return 400;
|
|
22
|
+
case "unauthorized-key":
|
|
23
|
+
case "bad-signature":
|
|
24
|
+
return 401;
|
|
25
|
+
case "replayed":
|
|
26
|
+
return 409;
|
|
27
|
+
case "expired":
|
|
28
|
+
case "future":
|
|
29
|
+
return 422;
|
|
30
|
+
default:
|
|
31
|
+
return 400;
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
/** Build (unstarted) the mirror ingester bound to `store`. */
|
|
35
|
+
export function mirrorServerForStore(store, options = {}) {
|
|
36
|
+
const guard = options.guard ?? createReplayGuard();
|
|
37
|
+
const enrolledKeys = options.enrolledKeys ?? [];
|
|
38
|
+
const path = options.path ?? "/h2a/mirror";
|
|
39
|
+
const maxBodyBytes = options.maxBodyBytes ?? 256 * 1024;
|
|
40
|
+
return createServer((req, res) => {
|
|
41
|
+
const respond = (status, body) => {
|
|
42
|
+
res.writeHead(status, { "content-type": "application/json" });
|
|
43
|
+
res.end(JSON.stringify(body));
|
|
44
|
+
};
|
|
45
|
+
if ((req.url ?? "").split("?")[0] !== path)
|
|
46
|
+
return respond(404, { ok: false, error: "not-found" });
|
|
47
|
+
if (req.method !== "POST") {
|
|
48
|
+
res.setHeader("allow", "POST");
|
|
49
|
+
return respond(405, { ok: false, error: "method-not-allowed" });
|
|
50
|
+
}
|
|
51
|
+
const chunks = [];
|
|
52
|
+
let total = 0;
|
|
53
|
+
let aborted = false;
|
|
54
|
+
req.on("data", (chunk) => {
|
|
55
|
+
if (aborted)
|
|
56
|
+
return;
|
|
57
|
+
total += chunk.length;
|
|
58
|
+
if (total > maxBodyBytes) {
|
|
59
|
+
aborted = true;
|
|
60
|
+
respond(413, { ok: false, error: "payload-too-large" });
|
|
61
|
+
req.destroy();
|
|
62
|
+
return;
|
|
63
|
+
}
|
|
64
|
+
chunks.push(chunk);
|
|
65
|
+
});
|
|
66
|
+
req.on("end", () => {
|
|
67
|
+
if (aborted)
|
|
68
|
+
return;
|
|
69
|
+
let payload;
|
|
70
|
+
try {
|
|
71
|
+
payload = JSON.parse(Buffer.concat(chunks).toString("utf8"));
|
|
72
|
+
}
|
|
73
|
+
catch {
|
|
74
|
+
return respond(400, { ok: false, error: "malformed" });
|
|
75
|
+
}
|
|
76
|
+
const result = acceptMirrorEnvelope(payload, {
|
|
77
|
+
resolvePublicKeys: (signer) => store.listInstanceKeys(signer),
|
|
78
|
+
enrolledKeys,
|
|
79
|
+
guard,
|
|
80
|
+
applyRegistration: (reg) => store.registerInstance(reg),
|
|
81
|
+
...(options.now ? { now: options.now() } : {})
|
|
82
|
+
});
|
|
83
|
+
if (result.ok)
|
|
84
|
+
return respond(202, { ok: true, applied: result.applied, signer: result.signer });
|
|
85
|
+
return respond(mirrorRejectionStatus(result.reason), { ok: false, reason: result.reason });
|
|
86
|
+
});
|
|
87
|
+
});
|
|
88
|
+
}
|
|
89
|
+
//# sourceMappingURL=serve.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/runtime/mirror/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,gBAAgB,CAAC;AAGxE,OAAO,EAAE,oBAAoB,EAA2B,MAAM,aAAa,CAAC;AAe5E,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc,CAAC;QACpB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,mBAAmB;YACtB,OAAO,GAAG,CAAC;QACb,KAAK,kBAAkB,CAAC;QACxB,KAAK,eAAe;YAClB,OAAO,GAAG,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,KAAiB,EAAE,UAAuC,EAAE;IAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,GAAG,IAAI,CAAC;IAExD,OAAO,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAQ,EAAE;YACtD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACnG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO;YACpB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE;gBAC3C,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC7D,YAAY;gBACZ,KAAK;gBACL,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,OAAO,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sentropic/h2a-cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.27.0",
|
|
4
4
|
"description": "Unified CLI surface for h2a hosts and MCP-oriented coordination flows.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -43,7 +43,7 @@
|
|
|
43
43
|
"@hono/mcp": "^0.3.0",
|
|
44
44
|
"@hono/node-server": "^2.0.4",
|
|
45
45
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
46
|
-
"@sentropic/h2a": "^0.
|
|
46
|
+
"@sentropic/h2a": "^0.27.0",
|
|
47
47
|
"hono": "^4.12.23"
|
|
48
48
|
},
|
|
49
49
|
"publishConfig": {
|