@sentropic/h2a-cli 0.75.0 → 0.78.0

package/dist/runtime/identity/live.js

@@ -1,232 +0,0 @@
-import { createHash, generateKeyPairSync } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
-import { hostname } from "node:os";
-import { basename, join } from "node:path";
-import { deriveInstanceId, deriveWorkspaceId, mintAgentUuid, signCanonical } from "@sentropic/h2a";
-import { createLocalStore } from "../local-files/store.js";
-import { findBinding, reclaimOrMint, verifyReclaimProof } from "./bindings.js";
-import { decideLegacyAdoption, legacyAliasAlreadyAdopted, recordIdentityAlias } from "./migration.js";
-import { defaultProviderSessionReaders, readHostSessionName } from "./readers.js";
-import { resolveProviderSession } from "./resolver.js";
-import { durableWorkspaceId } from "./workspace-id.js";
-function safeKeyName(instance) {
-    return instance.replace(/[:/]/g, "-");
-}
-function keyPaths(root, instance) {
-    const keysDir = join(root, "keys");
-    return {
-        privateKeyPath: join(keysDir, `${safeKeyName(instance)}.key.pem`),
-        publicKeyPath: join(keysDir, `${safeKeyName(instance)}.pub.pem`)
-    };
-}
-function readMachineId() {
-    for (const path of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-        try {
-            const id = readFileSync(path, "utf8").trim();
-            if (id.length > 0)
-                return id;
-        }
-        catch {
-            // try the next source
-        }
-    }
-    return hostname() || "unknown-machine";
-}
-function realWorkspacePath(cwd) {
-    try {
-        return realpathSync(cwd);
-    }
-    catch {
-        return cwd;
-    }
-}
-function labelFromCwd(cwd) {
-    return basename(cwd) || "workspace";
-}
-function publicKeyFingerprint(publicKeyPem) {
-    return createHash("sha256").update(publicKeyPem, "utf8").digest("hex").slice(0, 16);
-}
-function remoteBridgeInstance(providerSessionId) {
-    return providerSessionId.startsWith("remote:")
-        ? providerSessionId
-        : `remote:${providerSessionId}`;
-}
-function generateKeypair() {
-    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
-    return {
-        privateKeyPem: privateKey.export({ format: "pem", type: "pkcs8" }).toString(),
-        publicKeyPem: publicKey.export({ format: "pem", type: "spki" }).toString()
-    };
-}
-function readKeypair(root, instance) {
-    const paths = keyPaths(root, instance);
-    if (!existsSync(paths.privateKeyPath) || !existsSync(paths.publicKeyPath))
-        return undefined;
-    return {
-        privateKeyPem: readFileSync(paths.privateKeyPath, "utf8"),
-        publicKeyPem: readFileSync(paths.publicKeyPath, "utf8"),
-        ...paths
-    };
-}
-function ensureKeypair(root, instance, adoptFromInstance) {
-    const existing = readKeypair(root, instance);
-    if (existing) {
-        return {
-            publicKeyPem: existing.publicKeyPem,
-            privateKeyPath: existing.privateKeyPath,
-            publicKeyPath: existing.publicKeyPath
-        };
-    }
-    const paths = keyPaths(root, instance);
-    mkdirSync(join(root, "keys"), { recursive: true });
-    const adopted = adoptFromInstance ? readKeypair(root, adoptFromInstance) : undefined;
-    if (adopted) {
-        copyFileSync(adopted.privateKeyPath, paths.privateKeyPath);
-        copyFileSync(adopted.publicKeyPath, paths.publicKeyPath);
-        return { publicKeyPem: adopted.publicKeyPem, ...paths };
-    }
-    const generated = generateKeypair();
-    writeFileSync(paths.privateKeyPath, generated.privateKeyPem, { encoding: "utf8", mode: 0o600 });
-    writeFileSync(paths.publicKeyPath, generated.publicKeyPem, "utf8");
-    return { publicKeyPem: generated.publicKeyPem, ...paths };
-}
-function provesLocalKey(root, instance) {
-    const store = createLocalStore({ root });
-    const keypair = readKeypair(root, instance);
-    if (!keypair)
-        return false;
-    const activeKeys = store.listInstanceKeys(instance);
-    if (activeKeys.length === 0)
-        return false;
-    const nonce = `identity-reclaim:${instance}:${publicKeyFingerprint(keypair.publicKeyPem)}`;
-    try {
-        const signature = signCanonical(nonce, { by: instance, privateKeyPem: keypair.privateKeyPem });
-        return verifyReclaimProof(nonce, signature, activeKeys);
-    }
-    catch {
-        return false;
-    }
-}
-function ensureRegistered(input) {
-    const store = createLocalStore({ root: input.root });
-    const existing = store.findInstance(input.instance);
-    if (!existing) {
-        const registration = {
-            id: input.instance,
-            instance: input.instance,
-            roles: ["AGENTS"],
-            scopes: [...input.scopes],
-            capabilities: [],
-            endpoints: [{ kind: "local-files", uri: `file://${input.root}` }],
-            publicKeys: [input.publicKeyPem],
-            acceptedPolicies: [],
-            agentUuid: input.agentUuid,
-            workspace: input.workspace,
-            name: input.name,
-            createdAt: new Date(input.now()).toISOString()
-        };
-        store.registerInstance(registration);
-        return;
-    }
-    if (!store.listInstanceKeys(input.instance).includes(input.publicKeyPem)) {
-        store.addInstanceKey(input.instance, input.publicKeyPem);
-    }
-}
-export function resolveLiveIdentity(input) {
-    const host = input.host || "agent";
-    const label = labelFromCwd(input.cwd);
-    if (input.explicitInstance) {
-        return { instance: input.explicitInstance, host, action: "override" };
-    }
-    const readers = input.readers ?? defaultProviderSessionReaders;
-    const provider = resolveProviderSession({ host, cwd: input.cwd, readers });
-    const realPath = realWorkspacePath(input.cwd);
-    const workspaceId = durableWorkspaceId(realPath) ??
-        provider.workspaceHint ??
-        deriveWorkspaceId({ machineId: readMachineId(), path: realPath });
-    const workspace = {
-        id: workspaceId,
-        path: realPath,
-        host,
-        label
-    };
-    const legacyInstance = `${host}:${label}`;
-    const now = input.now ?? Date.now;
-    const scopes = input.scopes?.length ? input.scopes : ["scope:default"];
-    // WP-6: prefer the host-native session name (Claude customTitle / Codex thread_name)
-    // over the cwd label. The explicit `--name` flag always takes precedence.
-    const hostName = input.name === undefined
-        ? readHostSessionName({ host, cwd: input.cwd, sessionId: provider.providerSessionId })
-        : undefined;
-    const name = input.name ?? hostName ?? label;
-    const mint = () => {
-        const agentUuid = mintAgentUuid();
-        return {
-            agentUuid,
-            instance: deriveInstanceId({ host, label: name, uuid: agentUuid })
-        };
-    };
-    const mintRemote = () => {
-        const agentUuid = mintAgentUuid();
-        return {
-            agentUuid,
-            instance: provider.providerSessionId
-                ? remoteBridgeInstance(provider.providerSessionId)
-                : deriveInstanceId({ host, label: name, uuid: agentUuid })
-        };
-    };
-    // Re-anchor: the conversation UUID is the identity unit. When no provider
-    // session id is readable, fall back to a per-workspace-STABLE id (no
-    // timestamp) so that degenerate case keeps the old per-workspace reclaim
-    // behavior instead of minting a fresh id on every connect.
-    const providerSessionId = provider.providerSessionId ?? `fallback:${host}:${workspace.id}`;
-    const result = host === "remote"
-        ? { action: "mint", ...mintRemote() }
-        : reclaimOrMint(input.root, { host, providerSessionId, workspaceId: workspace.id }, {
-            verifyProof: (binding) => provesLocalKey(input.root, binding.instance),
-            mint,
-            now
-        });
-    const existingBinding = findBinding(input.root, {
-        host,
-        providerSessionId,
-        workspaceId: workspace.id
-    });
-    const legacyDecision = decideLegacyAdoption({
-        legacyAlreadyAdopted: legacyAliasAlreadyAdopted(input.root, legacyInstance),
-        provedLegacyPossession: provesLocalKey(input.root, legacyInstance)
-    });
-    const adoptedFrom = result.action === "mint" && legacyDecision.adopt ? legacyInstance : undefined;
-    const keypair = ensureKeypair(input.root, result.instance, adoptedFrom);
-    ensureRegistered({
-        root: input.root,
-        instance: result.instance,
-        agentUuid: result.agentUuid,
-        workspace,
-        name,
-        publicKeyPem: keypair.publicKeyPem,
-        scopes,
-        now
-    });
-    recordIdentityAlias(input.root, {
-        instance: result.instance,
-        legacyInstance,
-        adoptedKeyring: Boolean(adoptedFrom),
-        at: new Date(now()).toISOString()
-    });
-    return {
-        instance: result.instance,
-        host,
-        workspace,
-        name,
-        legacyInstance,
-        action: result.action,
-        providerSessionSource: provider.source,
-        privateKeyPath: keypair.privateKeyPath,
-        publicKeyPath: keypair.publicKeyPath,
-        migrationNotice: result.action === "mint" || !existingBinding
-            ? `identity migration: ${result.instance} reads legacy ${legacyInstance}; ${legacyDecision.reason}`
-            : undefined
-    };
-}
-//# sourceMappingURL=live.js.map

package/dist/runtime/identity/live.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../src/runtime/identity/live.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,aAAa,EAGd,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAA+B,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AA0BvD,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;QACjE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,EAAE,IAAI,iBAAiB,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,oBAAoB,CAAC,iBAAyB;IACrD,OAAO,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5C,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,UAAU,iBAAiB,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7E,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IAGjD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5F,OAAO;QACL,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC;QACzD,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;QACvD,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,aAAa,EAAE,QAAQ,CAAC,aAAa;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3D,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACzD,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,GAAG,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,oBAAoB,QAAQ,IAAI,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/F,OAAO,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KASzB;IACC,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,YAAY,GAAyB;YACzC,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,QAAQ,CAAC;YACjB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACjE,UAAU,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;YAChC,gBAAgB,EAAE,EAAE;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SAC/C,CAAC;QACF,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC;IAC/D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,WAAW,GACf,kBAAkB,CAAC,QAAQ,CAAC;QAC5B,QAAQ,CAAC,aAAa;QACtB,iBAAiB,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAoB;QACjC,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,KAAK;KACN,CAAC;IACF,MAAM,cAAc,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACvE,qFAAqF;IACrF,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS;QACvC,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACtF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,IAAI,KAAK,CAAC;IAE7C,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,OAAO;YACL,SAAS;YACT,QAAQ,EAAE,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,OAAO;YACL,SAAS;YACT,QAAQ,EAAE,QAAQ,CAAC,iBAAiB;gBAClC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAClD,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC,CAAC;IAEF,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,iBAAiB,GACrB,QAAQ,CAAC,iBAAiB,IAAI,YAAY,IAAI,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;IACnE,MAAM,MAAM,GACV,IAAI,KAAK,QAAQ;QACf,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,GAAG,UAAU,EAAE,EAAE;QAC9C,CAAC,CAAC,aAAa,CACX,KAAK,CAAC,IAAI,EACV,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EACtD;YACE,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC;YACtE,IAAI;YACJ,GAAG;SACJ,CACF,CAAC;IAER,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,IAAI;QACJ,iBAAiB;QACjB,WAAW,EAAE,SAAS,CAAC,EAAE;KAC1B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,oBAAoB,EAAE,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC;QAC3E,sBAAsB,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxE,gBAAgB,CAAC;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS;QACT,IAAI;QACJ,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM;QACN,GAAG;KACJ,CAAC,CAAC;IACH,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC;QACpC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI;QACJ,SAAS;QACT,IAAI;QACJ,cAAc;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,qBAAqB,EAAE,QAAQ,CAAC,MAAM;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EACb,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,eAAe;YAC1C,CAAC,CAAC,uBAAuB,MAAM,CAAC,QAAQ,iBAAiB,cAAc,KAAK,cAAc,CAAC,MAAM,EAAE;YACnG,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC"}

package/dist/runtime/identity/migration.d.ts

@@ -1,55 +0,0 @@
-/**
- * Transparent migration dual-read (DEC-116).
- *
- * After the identity fix, an agent's perennial inbox lives under its new
- * uuid-bearing instance id, while messages addressed before the migration sit
- * under the old label-derived instance dir(s). Migration must be transparent
- * and immediate: the agent keeps receiving everything with no manual move. The
- * read path therefore unions the current inbox with one or more legacy inbox
- * locations, deduplicated by envelope id — equivalent to reading several dirs
- * as if they were one (same id-sorted order as the single-dir reader).
- *
- * Pure + total: the impure part (which dirs to read) belongs to the caller; this
- * is the deterministic merge that is unit-tested in isolation.
- */
-import type { H2AEnvelope } from "@sentropic/h2a";
-/**
- * Merge envelope sets, deduplicated by `envelope.id`. Pass the CURRENT inbox
- * first: on an id collision the earlier set wins (identical content is expected,
- * but precedence is defined). Entries without a string `id` are skipped. The
- * result is sorted by `id` ascending, matching the single-dir reader's
- * filename `.sort()`, so a dual-read is indistinguishable from one merged dir.
- */
-export declare function mergeInboxDedup(sets: ReadonlyArray<readonly H2AEnvelope[]>): H2AEnvelope[];
-export interface LegacyAdoptionInput {
-    /** Has some agent already inherited this legacy id's keyring (single-inheritor lock)? */
-    readonly legacyAlreadyAdopted: boolean;
-    /** Did this connector prove possession of one of the legacy keyring's keys? */
-    readonly provedLegacyPossession: boolean;
-}
-export interface LegacyAdoptionDecision {
-    /** Adopt the legacy id as an alias of this agent's perennial uuid + inherit its keyring. */
-    readonly adopt: boolean;
-    /** Mint a fresh key for this agent (honest re-key for de-collided peers). */
-    readonly netNewKeys: boolean;
-    readonly reason: string;
-}
-/**
- * Ratified migration rule (DEC-116, spec §Migration F4): the FIRST agent to
- * prove possession of a legacy key inherits the legacy keyring and adopts the
- * legacy id as an alias of its new perennial uuid; every de-collided peer mints
- * **net-new keys** (honest re-key, surfaced in the migration notice). No proof
- * → no inheritance. Pure + total. The adoption record + keyring copy are the
- * caller's (impure, locked) job; this is the deterministic decision.
- */
-export declare function decideLegacyAdoption(input: LegacyAdoptionInput): LegacyAdoptionDecision;
-export interface H2AIdentityAlias {
-    readonly instance: string;
-    readonly legacyInstance: string;
-    readonly adoptedKeyring: boolean;
-    readonly at: string;
-}
-export declare function listIdentityAliases(root: string, instance?: string): H2AIdentityAlias[];
-export declare function legacyAliasAlreadyAdopted(root: string, legacyInstance: string): boolean;
-export declare function recordIdentityAlias(root: string, alias: H2AIdentityAlias): void;
-//# sourceMappingURL=migration.d.ts.map

package/dist/runtime/identity/migration.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,CAAC,SAAS,WAAW,EAAE,CAAC,GAC1C,WAAW,EAAE,CAUf;AAED,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,GAAG,sBAAsB,CAoBvF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAUD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAcvF;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAIvF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAQ/E"}

package/dist/runtime/identity/migration.js

@@ -1,100 +0,0 @@
-/**
- * Transparent migration dual-read (DEC-116).
- *
- * After the identity fix, an agent's perennial inbox lives under its new
- * uuid-bearing instance id, while messages addressed before the migration sit
- * under the old label-derived instance dir(s). Migration must be transparent
- * and immediate: the agent keeps receiving everything with no manual move. The
- * read path therefore unions the current inbox with one or more legacy inbox
- * locations, deduplicated by envelope id — equivalent to reading several dirs
- * as if they were one (same id-sorted order as the single-dir reader).
- *
- * Pure + total: the impure part (which dirs to read) belongs to the caller; this
- * is the deterministic merge that is unit-tested in isolation.
- */
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-/**
- * Merge envelope sets, deduplicated by `envelope.id`. Pass the CURRENT inbox
- * first: on an id collision the earlier set wins (identical content is expected,
- * but precedence is defined). Entries without a string `id` are skipped. The
- * result is sorted by `id` ascending, matching the single-dir reader's
- * filename `.sort()`, so a dual-read is indistinguishable from one merged dir.
- */
-export function mergeInboxDedup(sets) {
-    const byId = new Map();
-    for (const set of sets) {
-        for (const env of set) {
-            const id = env?.id;
-            if (typeof id !== "string" || byId.has(id))
-                continue;
-            byId.set(id, env);
-        }
-    }
-    return [...byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
-}
-/**
- * Ratified migration rule (DEC-116, spec §Migration F4): the FIRST agent to
- * prove possession of a legacy key inherits the legacy keyring and adopts the
- * legacy id as an alias of its new perennial uuid; every de-collided peer mints
- * **net-new keys** (honest re-key, surfaced in the migration notice). No proof
- * → no inheritance. Pure + total. The adoption record + keyring copy are the
- * caller's (impure, locked) job; this is the deterministic decision.
- */
-export function decideLegacyAdoption(input) {
-    if (!input.provedLegacyPossession) {
-        return {
-            adopt: false,
-            netNewKeys: true,
-            reason: "no proof of possession of a legacy key — mint net-new keys"
-        };
-    }
-    if (input.legacyAlreadyAdopted) {
-        return {
-            adopt: false,
-            netNewKeys: true,
-            reason: "legacy id already adopted by a peer — de-collided peer mints net-new keys"
-        };
-    }
-    return {
-        adopt: true,
-        netNewKeys: false,
-        reason: "first to prove possession — inherits legacy keyring, legacy id becomes an alias"
-    };
-}
-function identityDir(root) {
-    return join(root, "identity");
-}
-function aliasesFile(root) {
-    return join(identityDir(root), "aliases.jsonl");
-}
-export function listIdentityAliases(root, instance) {
-    const f = aliasesFile(root);
-    if (!existsSync(f))
-        return [];
-    const out = [];
-    for (const line of readFileSync(f, "utf8").split("\n")) {
-        if (!line.trim())
-            continue;
-        try {
-            const parsed = JSON.parse(line);
-            if (instance === undefined || parsed.instance === instance)
-                out.push(parsed);
-        }
-        catch {
-            // skip malformed alias records
-        }
-    }
-    return out;
-}
-export function legacyAliasAlreadyAdopted(root, legacyInstance) {
-    return listIdentityAliases(root).some((alias) => alias.legacyInstance === legacyInstance && alias.adoptedKeyring);
-}
-export function recordIdentityAlias(root, alias) {
-    mkdirSync(identityDir(root), { recursive: true });
-    const exists = listIdentityAliases(root).some((entry) => entry.instance === alias.instance && entry.legacyInstance === alias.legacyInstance);
-    if (exists)
-        return;
-    appendFileSync(aliasesFile(root), `${JSON.stringify(alias)}\n`, "utf8");
-}
-//# sourceMappingURL=migration.js.map

package/dist/runtime/identity/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"migration.js","sourceRoot":"","sources":["../../../src/runtime/identity/migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,EAAE,GAAI,GAA+B,EAAE,EAAE,CAAC;YAChD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YACrD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAiBD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,4DAA4D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,iFAAiF;KAC1F,CAAC;AACJ,CAAC;AASD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiB;IACjE,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;YACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,cAAsB;IAC5E,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,CAAC,cAAc,CAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAuB;IACvE,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CACrF,CAAC;IACF,IAAI,MAAM;QAAE,OAAO;IACnB,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC"}

package/dist/runtime/identity/readers.d.ts

@@ -1,42 +0,0 @@
-/**
- * Default (real-filesystem) `ProviderSessionReaders` for the identity resolver
- * (DEC-116). Every reader is **best-effort + total**: any missing file, format
- * drift, or parse error yields `undefined`, so the resolver degrades to
- * `{ source: "none" }` and the caller mints a keypair-anchored id (never throws,
- * never blocks connect). The transcript layouts were live-verified 2026-05-30
- * (gemini's path layout drifts across versions — we match on `.project_root`).
- */
-import type { ProviderSessionReaders } from "./resolver.js";
-export declare const defaultProviderSessionReaders: ProviderSessionReaders;
-/**
- * Injectable FS readers for `readHostSessionName` (test-friendly).
- * Only reading is required; real-FS defaults are `defaultHostNameReaders`.
- */
-export interface HostNameReaders {
-    /** Read up to `maxLines` newline-delimited lines from a file. Returns [] on any error. */
-    readLines(path: string, maxLines: number): string[];
-    /** List newline-delimited JSONL entries from `~/.codex/session_index.jsonl`. */
-    readCodexSessionIndex(): string[];
-    /** Whether the home dir root is known (for path construction). */
-    homedir(): string;
-}
-export declare const defaultHostNameReaders: HostNameReaders;
-/**
- * Read the host-native session name for the given session.
- *
- * - **claude**: reads the transcript JSONL (located via the CLAUDE_CODE_SESSION_ID
- *   resolver); scans the first 40 lines for `customTitle` (user rename) first,
- *   then falls back to `agentName`. Never returns `aiTitle`.
- * - **codex**: reads `~/.codex/session_index.jsonl`; returns `thread_name` for
- *   the entry whose `id === sessionId` (last-match wins).
- * - Other hosts: returns undefined.
- *
- * Always best-effort (returns undefined on any parse/IO error).
- */
-export declare function readHostSessionName(opts: {
-    host: string;
-    cwd: string;
-    sessionId?: string;
-    readers?: HostNameReaders;
-}): string | undefined;
-//# sourceMappingURL=readers.d.ts.map

package/dist/runtime/identity/readers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"readers.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/readers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AA2F5D,eAAO,MAAM,6BAA6B,EAAE,sBAK3C,CAAC;AAIF;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpD,gFAAgF;IAChF,qBAAqB,IAAI,MAAM,EAAE,CAAC;IAClC,kEAAkE;IAClE,OAAO,IAAI,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,EAAE,eAqBpC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B,GAAG,MAAM,GAAG,SAAS,CAcrB"}