@sentropic/h2a-cli 0.74.0 → 0.78.0

package/dist/runtime/governance/launch-check.js

@@ -1,113 +0,0 @@
-/**
- * Governance D3 — Conductor Launch Check (DRY-RUN, read-only).
- *
- * h2a polls `track workspace-activity` and RECOMMENDS launching a conductor
- * where work is durably stalled and no conductor is live.
- *
- * The module has two layers:
- *
- * 1. `recommendConductorLaunch` — pure function, no I/O.  Derives the
- *    recommendation from two booleans: whether a conductor is already live and
- *    how many stalled items were found.
- *
- * 2. `conductorLaunchCheck` — the I/O gatherer.  Calls `track
- *    workspace-activity`, calls `conductorFor`, computes the recommendation,
- *    and returns a single result object.  Never writes, never spawns.
- *
- * IMPORTANT — DRY-RUN policy
- * --------------------------
- * h2a does NOT spawn anything.  A `recommendation === "launch"` output is
- * purely advisory.  The actual conductor launch is **parked** pending a
- * spawn-policy decision and remote-trigger support.
- */
-import { execFileSync } from "node:child_process";
-import { conductorFor } from "./conductor.js";
-/**
- * Pure function: derive a conductor-launch recommendation from pre-gathered
- * facts.  No I/O.
- *
- * Rules (in precedence order):
- * 1. conductorLive === true → none (a live conductor already owns the workspace).
- * 2. conductorLive === false AND stalledCount > 0 → launch.
- * 3. else → none (no stalled work detected).
- */
-export function recommendConductorLaunch(opts) {
-    const { conductorLive, stalledCount } = opts;
-    if (conductorLive) {
-        return {
-            recommendation: "none",
-            reason: "a live conductor already owns this workspace"
-        };
-    }
-    if (stalledCount > 0) {
-        return {
-            recommendation: "launch",
-            reason: `${stalledCount} stalled item(s) and no live conductor`,
-            suggestedHosts: ["claude", "codex", "agy"]
-        };
-    }
-    return {
-        recommendation: "none",
-        reason: "no stalled work"
-    };
-}
-/**
- * Default implementation: run the `track` binary and parse the JSON output.
- * Returns `undefined` on any error (track absent, non-zero exit, invalid JSON).
- * Never throws.
- */
-function defaultRunTrackActivity(workspaceId, idleMs) {
-    try {
-        const out = execFileSync("track", [
-            "workspace-activity",
-            "--workspace",
-            workspaceId,
-            "--idle-ms",
-            String(idleMs),
-            "--format",
-            "json"
-        ], { encoding: "utf8" });
-        return JSON.parse(out);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Gather all facts and derive a conductor-launch recommendation.
- *
- * Read-only: no writes, no spawns.
- */
-export function conductorLaunchCheck(opts) {
-    const { root, workspaceId, idleMs = 86_400_000, now, runTrackActivity = defaultRunTrackActivity } = opts;
-    // 1. Gather track activity (graceful — track may not be installed in CI).
-    const activityRaw = runTrackActivity(workspaceId, idleMs);
-    const trackAvailable = activityRaw !== undefined;
-    const activity = activityRaw ?? { pending: 0, stalled: [] };
-    // 2. Resolve the live conductor.
-    const resolution = conductorFor({
-        root,
-        workspaceId,
-        ...(now !== undefined ? { now: now() } : {})
-    });
-    const conductor = resolution.conductor;
-    const conductorLive = conductor !== null;
-    // 3. Compute recommendation.
-    const rec = recommendConductorLaunch({
-        conductorLive,
-        stalledCount: activity.stalled.length
-    });
-    return {
-        workspaceId,
-        trackAvailable,
-        conductor,
-        conductorLive,
-        pending: activity.pending,
-        stalled: activity.stalled,
-        ...(activity.latestEventAt !== undefined ? { latestEventAt: activity.latestEventAt } : {}),
-        recommendation: rec.recommendation,
-        reason: rec.reason,
-        ...(rec.suggestedHosts !== undefined ? { suggestedHosts: rec.suggestedHosts } : {})
-    };
-}
-//# sourceMappingURL=launch-check.js.map

package/dist/runtime/governance/launch-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"launch-check.js","sourceRoot":"","sources":["../../../src/runtime/governance/launch-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAsB9C;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAkC;IAElC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE7C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,cAAc,EAAE,MAAM;YACtB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,cAAc,EAAE,QAAQ;YACxB,MAAM,EAAE,GAAG,YAAY,wCAAwC;YAC/D,cAAc,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,MAAM;QACtB,MAAM,EAAE,iBAAiB;KAC1B,CAAC;AACJ,CAAC;AAoDD;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,WAAmB,EACnB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,OAAO,EACP;YACE,oBAAoB;YACpB,aAAa;YACb,WAAW;YACX,WAAW;YACX,MAAM,CAAC,MAAM,CAAC;YACd,UAAU;YACV,MAAM;SACP,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwE,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA8B;IACjE,MAAM,EACJ,IAAI,EACJ,WAAW,EACX,MAAM,GAAG,UAAU,EACnB,GAAG,EACH,gBAAgB,GAAG,uBAAuB,EAC3C,GAAG,IAAI,CAAC;IAET,0EAA0E;IAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,cAAc,GAAG,WAAW,KAAK,SAAS,CAAC;IACjD,MAAM,QAAQ,GAAG,WAAW,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE5D,iCAAiC;IACjC,MAAM,UAAU,GAAG,YAAY,CAAC;QAC9B,IAAI;QACJ,WAAW;QACX,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,MAAM,aAAa,GAAG,SAAS,KAAK,IAAI,CAAC;IAEzC,6BAA6B;IAC7B,MAAM,GAAG,GAAG,wBAAwB,CAAC;QACnC,aAAa;QACb,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,cAAc;QACd,SAAS;QACT,aAAa;QACb,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC"}

package/dist/runtime/governance/spawns.d.ts

@@ -1,50 +0,0 @@
-/**
- * Governance D3 — Conductor-spawn request store (append-only).
- *
- * Records each time h2a emits a conductor-launch-request envelope to a remote
- * agent, so the cap/cooldown guard can suppress duplicate requests within the
- * 30-minute window.
- *
- * File: `<root>/.h2a/governance/conductor-spawns.jsonl`
- * Event shape: `{ workspaceId: string, at: string, to?: string }`
- *
- * API mirrors claims.ts — append-only, no deletion, no enforcement.
- */
-export interface SpawnRequestEvent {
-    readonly workspaceId: string;
-    /** ISO 8601 timestamp when the request was emitted. */
-    readonly at: string;
-    /** The remote instance that received the request, if known. */
-    readonly to?: string;
-}
-/**
- * Append a conductor-spawn request event to the JSONL store.
- * Creates the governance directory if it does not exist.
- */
-export declare function recordSpawnRequest(root: string, event: SpawnRequestEvent): void;
-/**
- * Return the `at` timestamp of the most recent spawn request for a workspace,
- * or `undefined` if none has been recorded.
- *
- * Uses canonical comparison so the workspace id is case-fold and slug-stable.
- */
-export declare function lastSpawnRequestAt(root: string, workspaceId: string): string | undefined;
-export interface SpawnAllowedOpts {
-    /** ISO 8601 timestamp of the last recorded spawn request, or undefined. */
-    readonly lastSpawnAt?: string;
-    /** Reference instant in ms (Date.now()). */
-    readonly now: number;
-    /** Cooldown window in ms (default 1 800 000 = 30 min). */
-    readonly cooldownMs?: number;
-}
-/**
- * Pure helper: return true iff emitting a new spawn request is allowed.
- *
- * Rules:
- * - No previous request → always allowed.
- * - Previous request exists → allowed only if `now - Date.parse(lastSpawnAt) >= cooldownMs`.
- *
- * Default cooldown is 30 minutes (1 800 000 ms).
- */
-export declare function spawnAllowed(opts: SpawnAllowedOpts): boolean;
-//# sourceMappingURL=spawns.d.ts.map

package/dist/runtime/governance/spawns.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spawns.d.ts","sourceRoot":"","sources":["../../../src/runtime/governance/spawns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAkBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,iBAAiB,GACvB,IAAI,CAIN;AA0BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIxF;AAMD,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAK5D"}

package/dist/runtime/governance/spawns.js

@@ -1,91 +0,0 @@
-/**
- * Governance D3 — Conductor-spawn request store (append-only).
- *
- * Records each time h2a emits a conductor-launch-request envelope to a remote
- * agent, so the cap/cooldown guard can suppress duplicate requests within the
- * 30-minute window.
- *
- * File: `<root>/.h2a/governance/conductor-spawns.jsonl`
- * Event shape: `{ workspaceId: string, at: string, to?: string }`
- *
- * API mirrors claims.ts — append-only, no deletion, no enforcement.
- */
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { canonicalAddress, localStorePaths } from "../local-files/index.js";
-// ---------------------------------------------------------------------------
-// Paths
-// ---------------------------------------------------------------------------
-function governanceDir(root) {
-    return join(localStorePaths(root).root, "governance");
-}
-function spawnsFile(root) {
-    return join(governanceDir(root), "conductor-spawns.jsonl");
-}
-// ---------------------------------------------------------------------------
-// Store operations
-// ---------------------------------------------------------------------------
-/**
- * Append a conductor-spawn request event to the JSONL store.
- * Creates the governance directory if it does not exist.
- */
-export function recordSpawnRequest(root, event) {
-    const dir = governanceDir(root);
-    mkdirSync(dir, { recursive: true });
-    appendFileSync(spawnsFile(root), `${JSON.stringify(event)}\n`, "utf8");
-}
-/**
- * Return all spawn request events for a workspace, sorted ascending by `at`.
- * Skips malformed lines. Returns an empty array if the file does not exist.
- */
-function listSpawnRequests(root, workspaceId) {
-    const file = spawnsFile(root);
-    if (!existsSync(file))
-        return [];
-    const wantWs = canonicalAddress(workspaceId);
-    const out = [];
-    for (const line of readFileSync(file, "utf8").split("\n")) {
-        if (!line.trim())
-            continue;
-        try {
-            const ev = JSON.parse(line);
-            if (canonicalAddress(ev.workspaceId) === wantWs) {
-                out.push(ev);
-            }
-        }
-        catch {
-            // skip malformed line
-        }
-    }
-    out.sort((a, b) => a.at.localeCompare(b.at));
-    return out;
-}
-/**
- * Return the `at` timestamp of the most recent spawn request for a workspace,
- * or `undefined` if none has been recorded.
- *
- * Uses canonical comparison so the workspace id is case-fold and slug-stable.
- */
-export function lastSpawnRequestAt(root, workspaceId) {
-    const events = listSpawnRequests(root, workspaceId);
-    if (events.length === 0)
-        return undefined;
-    return events[events.length - 1].at;
-}
-/**
- * Pure helper: return true iff emitting a new spawn request is allowed.
- *
- * Rules:
- * - No previous request → always allowed.
- * - Previous request exists → allowed only if `now - Date.parse(lastSpawnAt) >= cooldownMs`.
- *
- * Default cooldown is 30 minutes (1 800 000 ms).
- */
-export function spawnAllowed(opts) {
-    const { lastSpawnAt, now, cooldownMs = 1_800_000 } = opts;
-    if (lastSpawnAt === undefined)
-        return true;
-    const elapsed = now - Date.parse(lastSpawnAt);
-    return elapsed >= cooldownMs;
-}
-//# sourceMappingURL=spawns.js.map

package/dist/runtime/governance/spawns.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"spawns.js","sourceRoot":"","sources":["../../../src/runtime/governance/spawns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAc5E,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAwB;IAExB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,WAAmB;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;YACjD,IAAI,gBAAgB,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,WAAmB;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAeD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAsB;IACjD,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;IAC1D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9C,OAAO,OAAO,IAAI,UAAU,CAAC;AAC/B,CAAC"}

package/dist/runtime/identity/bindings.d.ts

@@ -1,84 +0,0 @@
-/**
- * Identity binding registry + proof-of-possession (DEC-116 F1 security core;
- * stability unit RE-ANCHORED 2026-06-07 — supersedes the per-workspace choice).
- *
- * Reconnect de-collision binds the perennial identity to its stability unit
- * `(host, providerSessionId)` — the provider **conversation UUID**
- * (`CLAUDE_CODE_SESSION_ID`, the Codex session id, …). One identity per live
- * conversation: two concurrent conversations in the SAME workspace now get
- * DISTINCT ids (no shared inbox — the collision this re-anchor removes), and a
- * resume of the same conversation reclaims its id (the UUID survives resume).
- * `workspaceId` is recorded as metadata only — NOT the match key. Keying on it
- * (the prior design) collapsed concurrent agents in one repo onto one inbox; the
- * per-session granularity is intended now, with dead ids reaped via presence TTL
- * + discover=live-only rather than prevented. An agent with no readable
- * conversation UUID is given a per-workspace fallback id
- * (`fallback:<host>:<workspaceId>` by the caller), so that degenerate case keeps
- * the old per-workspace behavior.
- *
- * **RECLAIM requires proof-of-possession**: the connector must sign a fresh
- * nonce with the ed25519 key already bound to that identity (verified against
- * the instance's active keys). The provider session id is a spoofable *routing
- * hint* — never the authenticator. No valid signature → **MINT** a fresh
- * identity (so a process presenting a victim's id, without the key, gets a new
- * identity, not the victim's inbox). The read → decide → append runs in ONE lock
- * (no reclaim/mint race, F3).
- */
-import { type H2ASignature } from "@sentropic/h2a";
-export interface H2AIdentityBinding {
-    readonly host: string;
-    readonly providerSessionId: string;
-    readonly workspaceId: string;
-    /** The addressable handle `host:label:uuid12` — what the keyring + addressing key on. */
-    readonly instance: string;
-    /** The perennial agent UUID (its first 12 hex form `uuid12` in the instance). */
-    readonly agentUuid: string;
-    readonly at: string;
-}
-export interface IdentityBindingKey {
-    readonly host: string;
-    readonly providerSessionId: string;
-    readonly workspaceId: string;
-}
-export declare function listBindings(root: string): H2AIdentityBinding[];
-/**
- * The latest binding for the identity's stability unit
- * `(host, providerSessionId)` (append-only → last wins), or undefined.
- *
- * The match is the provider **conversation UUID** (`CLAUDE_CODE_SESSION_ID`, the
- * Codex session id, or a `fallback:<host>:<workspaceId>` when none is readable).
- * `workspaceId` is recorded on the binding for audit but is NOT part of the
- * match: keying on it collapsed two concurrent conversations in one repo onto a
- * single id + inbox (the BR25 collision). Two conversations → two ids; a resumed
- * conversation reclaims its id (same UUID), still gated by proof-of-possession in
- * `reclaimOrMint`.
- */
-export declare function findBinding(root: string, key: IdentityBindingKey): H2AIdentityBinding | undefined;
-/**
- * Verify a reclaim proof: `signature` over `nonce` must verify against ANY of
- * the agent's active public keys. Total — never throws.
- */
-export declare function verifyReclaimProof(nonce: string, signature: H2ASignature, publicKeys: readonly string[]): boolean;
-export interface ReclaimOrMintDeps {
-    /** PoP: true iff the connector proved possession of the bound instance's key. */
-    verifyProof(binding: H2AIdentityBinding): boolean;
-    /** Mint a fresh identity (new uuid + derived instance) when no reclaim. */
-    mint(): {
-        instance: string;
-        agentUuid: string;
-    };
-    now(): number;
-}
-export interface ReclaimOrMintResult {
-    readonly action: "reclaim" | "mint";
-    readonly instance: string;
-    readonly agentUuid: string;
-}
-/**
- * Atomically (one lock) reclaim the existing binding iff it exists AND
- * proof-of-possession passes; otherwise mint a fresh identity and record the new
- * binding. Spoofing the id without the key → mint (a new identity), never a
- * reclaim of someone else's.
- */
-export declare function reclaimOrMint(root: string, key: IdentityBindingKey, deps: ReclaimOrMintDeps): ReclaimOrMintResult;
-//# sourceMappingURL=bindings.d.ts.map

package/dist/runtime/identity/bindings.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAIpE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAYD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAa/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,kBAAkB,GAAG,SAAS,CAQjG;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,YAAY,EACvB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAST;AAED,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAClD,2EAA2E;IAC3E,IAAI,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,GAAG,IAAI,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,iBAAiB,GACtB,mBAAmB,CAerB"}

package/dist/runtime/identity/bindings.js

@@ -1,112 +0,0 @@
-/**
- * Identity binding registry + proof-of-possession (DEC-116 F1 security core;
- * stability unit RE-ANCHORED 2026-06-07 — supersedes the per-workspace choice).
- *
- * Reconnect de-collision binds the perennial identity to its stability unit
- * `(host, providerSessionId)` — the provider **conversation UUID**
- * (`CLAUDE_CODE_SESSION_ID`, the Codex session id, …). One identity per live
- * conversation: two concurrent conversations in the SAME workspace now get
- * DISTINCT ids (no shared inbox — the collision this re-anchor removes), and a
- * resume of the same conversation reclaims its id (the UUID survives resume).
- * `workspaceId` is recorded as metadata only — NOT the match key. Keying on it
- * (the prior design) collapsed concurrent agents in one repo onto one inbox; the
- * per-session granularity is intended now, with dead ids reaped via presence TTL
- * + discover=live-only rather than prevented. An agent with no readable
- * conversation UUID is given a per-workspace fallback id
- * (`fallback:<host>:<workspaceId>` by the caller), so that degenerate case keeps
- * the old per-workspace behavior.
- *
- * **RECLAIM requires proof-of-possession**: the connector must sign a fresh
- * nonce with the ed25519 key already bound to that identity (verified against
- * the instance's active keys). The provider session id is a spoofable *routing
- * hint* — never the authenticator. No valid signature → **MINT** a fresh
- * identity (so a process presenting a victim's id, without the key, gets a new
- * identity, not the victim's inbox). The read → decide → append runs in ONE lock
- * (no reclaim/mint race, F3).
- */
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { verifyCanonical } from "@sentropic/h2a";
-import { localStorePaths, withLockSync } from "../local-files/index.js";
-function identityDir(root) {
-    return join(localStorePaths(root).root, "identity");
-}
-function bindingsFile(root) {
-    return join(identityDir(root), "bindings.jsonl");
-}
-function bindingsLock(root) {
-    return join(identityDir(root), ".lock");
-}
-export function listBindings(root) {
-    const f = bindingsFile(root);
-    if (!existsSync(f))
-        return [];
-    const out = [];
-    for (const line of readFileSync(f, "utf8").split("\n")) {
-        if (!line.trim())
-            continue;
-        try {
-            out.push(JSON.parse(line));
-        }
-        catch {
-            // skip malformed
-        }
-    }
-    return out;
-}
-/**
- * The latest binding for the identity's stability unit
- * `(host, providerSessionId)` (append-only → last wins), or undefined.
- *
- * The match is the provider **conversation UUID** (`CLAUDE_CODE_SESSION_ID`, the
- * Codex session id, or a `fallback:<host>:<workspaceId>` when none is readable).
- * `workspaceId` is recorded on the binding for audit but is NOT part of the
- * match: keying on it collapsed two concurrent conversations in one repo onto a
- * single id + inbox (the BR25 collision). Two conversations → two ids; a resumed
- * conversation reclaims its id (same UUID), still gated by proof-of-possession in
- * `reclaimOrMint`.
- */
-export function findBinding(root, key) {
-    let found;
-    for (const b of listBindings(root)) {
-        if (b.host === key.host && b.providerSessionId === key.providerSessionId) {
-            found = b;
-        }
-    }
-    return found;
-}
-/**
- * Verify a reclaim proof: `signature` over `nonce` must verify against ANY of
- * the agent's active public keys. Total — never throws.
- */
-export function verifyReclaimProof(nonce, signature, publicKeys) {
-    for (const pem of publicKeys) {
-        try {
-            if (verifyCanonical(nonce, signature, pem))
-                return true;
-        }
-        catch {
-            // try the next active key
-        }
-    }
-    return false;
-}
-/**
- * Atomically (one lock) reclaim the existing binding iff it exists AND
- * proof-of-possession passes; otherwise mint a fresh identity and record the new
- * binding. Spoofing the id without the key → mint (a new identity), never a
- * reclaim of someone else's.
- */
-export function reclaimOrMint(root, key, deps) {
-    mkdirSync(identityDir(root), { recursive: true });
-    return withLockSync(bindingsLock(root), () => {
-        const existing = findBinding(root, key);
-        if (existing && deps.verifyProof(existing)) {
-            return { action: "reclaim", instance: existing.instance, agentUuid: existing.agentUuid };
-        }
-        const minted = deps.mint();
-        appendFileSync(bindingsFile(root), `${JSON.stringify({ ...key, instance: minted.instance, agentUuid: minted.agentUuid, at: new Date(deps.now()).toISOString() })}\n`, "utf8");
-        return { action: "mint", instance: minted.instance, agentUuid: minted.agentUuid };
-    });
-}
-//# sourceMappingURL=bindings.js.map

package/dist/runtime/identity/bindings.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bindings.js","sourceRoot":"","sources":["../../../src/runtime/identity/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAqB,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAmBxE,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACnD,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAuB;IAC/D,IAAI,KAAqC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,iBAAiB,KAAK,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACzE,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,SAAuB,EACvB,UAA6B;IAE7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,GAAuB,EACvB,IAAuB;IAEvB,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,cAAc,CACZ,YAAY,CAAC,IAAI,CAAC,EAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAA+B,CAAC,IAAI,EAC9J,MAAM,CACP,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/identity/index.d.ts

@@ -1,11 +0,0 @@
-export { resolveProviderSession } from "./resolver.js";
-export type { ProviderSession, ProviderSessionReaders, ProviderSessionSource, ResolveProviderSessionInput } from "./resolver.js";
-export { defaultProviderSessionReaders, readHostSessionName } from "./readers.js";
-export type { HostNameReaders } from "./readers.js";
-export { listBindings, findBinding, verifyReclaimProof, reclaimOrMint } from "./bindings.js";
-export type { H2AIdentityBinding, IdentityBindingKey, ReclaimOrMintDeps, ReclaimOrMintResult } from "./bindings.js";
-export { mergeInboxDedup, decideLegacyAdoption, listIdentityAliases, legacyAliasAlreadyAdopted, recordIdentityAlias } from "./migration.js";
-export type { H2AIdentityAlias, LegacyAdoptionInput, LegacyAdoptionDecision } from "./migration.js";
-export { resolveLiveIdentity } from "./live.js";
-export type { ResolveLiveIdentityInput, ResolvedLiveIdentity } from "./live.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/runtime/identity/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACd,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC"}

package/dist/runtime/identity/index.js

@@ -1,6 +0,0 @@
-export { resolveProviderSession } from "./resolver.js";
-export { defaultProviderSessionReaders, readHostSessionName } from "./readers.js";
-export { listBindings, findBinding, verifyReclaimProof, reclaimOrMint } from "./bindings.js";
-export { mergeInboxDedup, decideLegacyAdoption, listIdentityAliases, legacyAliasAlreadyAdopted, recordIdentityAlias } from "./migration.js";
-export { resolveLiveIdentity } from "./live.js";
-//# sourceMappingURL=index.js.map

package/dist/runtime/identity/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAOvD,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAElF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACd,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC"}

package/dist/runtime/identity/live.d.ts

@@ -1,26 +0,0 @@
-import { type H2AWorkspaceRef } from "@sentropic/h2a";
-import { type ProviderSessionReaders } from "./resolver.js";
-export interface ResolveLiveIdentityInput {
-    readonly root: string;
-    readonly host: string;
-    readonly cwd: string;
-    readonly explicitInstance?: string;
-    readonly name?: string;
-    readonly scopes?: readonly string[];
-    readonly readers?: ProviderSessionReaders;
-    readonly now?: () => number;
-}
-export interface ResolvedLiveIdentity {
-    readonly instance: string;
-    readonly host: string;
-    readonly workspace?: H2AWorkspaceRef;
-    readonly name?: string;
-    readonly legacyInstance?: string;
-    readonly action: "override" | "reclaim" | "mint";
-    readonly providerSessionSource?: string;
-    readonly privateKeyPath?: string;
-    readonly publicKeyPath?: string;
-    readonly migrationNotice?: string;
-}
-export declare function resolveLiveIdentity(input: ResolveLiveIdentityInput): ResolvedLiveIdentity;
-//# sourceMappingURL=live.d.ts.map

package/dist/runtime/identity/live.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/live.ts"],"names":[],"mappings":"AAYA,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAGpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAmJD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CA8GzF"}