@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/hub/types.d.ts

@@ -0,0 +1,401 @@
+/** Pure P1 interfaces from docs/design/hub.md; no initialization or runtime authority. */
+export type HubId = string;
+export type FleetId = string;
+export type ExposureId = string;
+export type GrantId = string;
+export type RoomId = string;
+export type MessageId = string;
+export type Epoch = number;
+export type Millis = number;
+export type Sha256 = string;
+import type { PersonKey } from "./directory/index.js";
+export type { PersonKey, DirectoryPerson, SignInResult, Eligibility, HubDirectory, HubDirectoryConfig } from "./directory/index.js";
+export type PersonId = string;
+export interface HubFrame<T extends string, P> {
+    v: 1;
+    type: T;
+    requestId: string;
+    linkEpoch: Epoch;
+    payload: P;
+}
+export interface HubHello {
+    supportedVersions: readonly number[];
+    capabilities: readonly string[];
+    memberBootId: string;
+}
+export interface HubWelcome {
+    selectedVersion: 1;
+    hubId: HubId;
+    fleetId: FleetId;
+    linkEpoch: Epoch;
+    revocationVersion: Epoch;
+    capabilities?: readonly string[];
+}
+/** attachments-v1: a file carried with a question (Hub → member) or an answer (member → Hub). */
+export interface HubAttachmentRef {
+    id: string;
+    name: string;
+    size: number;
+    mime: string;
+    sha256: Sha256;
+}
+export interface HubAttachmentChunk {
+    id: string;
+    offset: number;
+    total: number;
+    sha256: Sha256;
+    data: string;
+}
+export interface HubExposureSnapshot {
+    revision: Epoch;
+    exposures: readonly HubExposure[];
+}
+/** quota-band-v1: member-derived, coarse and ephemeral. Exact usage never crosses the link. */
+export interface HubQuota {
+    band: "available" | "near_limit" | "exhausted" | "unknown";
+    resetsAt?: Millis;
+}
+export interface HubExposureQuota {
+    exposureId: ExposureId;
+    quota: HubQuota;
+}
+export interface HubQuestion {
+    text: string;
+    identity: HubAskerEnvelope;
+    attachments?: readonly HubAttachmentRef[];
+}
+export type HubReceiptStage = "queued" | "delivered" | "consumed" | "answered" | "rejected" | "cancelled" | "failed" | "uncertain";
+export interface HubReceipt {
+    messageId: MessageId;
+    contentDigest: Sha256;
+    stage: HubReceiptStage;
+    sequence: Epoch;
+    at: Millis;
+    memberDeliveryId?: string;
+    reasonCode?: string;
+}
+export interface HubAnswer {
+    messageId: MessageId;
+    answerId: string;
+    text: string;
+    contentDigest: Sha256;
+    releaseLease: HubAuthorizationLease;
+    attachments?: readonly HubAttachmentRef[];
+    buttons?: HubAnswerButtons;
+}
+export interface HubAnswerButtons {
+    id: string;
+    labels: readonly string[];
+    values?: readonly string[];
+    poll?: import("../reply-polls.js").PollConfig;
+}
+export type HubPollBallot = import("../reply-polls.js").PollBallot & {
+    setId: string;
+    roomId: RoomId;
+    messageId: MessageId;
+};
+export interface HubReconcile {
+    afterReceiptSequence: Epoch;
+    messages: readonly {
+        messageId: MessageId;
+        contentDigest: Sha256;
+    }[];
+}
+export interface HubAuthorizationScope {
+    messageId: MessageId;
+    operationId: string;
+    exposureRevision: Epoch;
+}
+export type HubAuthorizationRequest = HubAuthorizationScope & ({
+    phase: "admit" | "begin";
+} | {
+    phase: "tool";
+    tool: {
+        name: string;
+        argumentsDigest: Sha256;
+    };
+} | {
+    phase: "release-answer";
+    answer: {
+        answerId: string;
+        contentDigest: Sha256;
+    };
+});
+export interface HubAuthorizationLease {
+    decisionId: string;
+    messageId: MessageId;
+    operationId: string;
+    phase: HubAuthorizationRequest["phase"];
+    operationDigest: Sha256;
+    revocationVersion: Epoch;
+    exposureRevision: Epoch;
+    linkEpoch: Epoch;
+    expiresAt: Millis;
+}
+export interface HubReconcileReply {
+    receipts: readonly HubReceipt[];
+    nextReceiptSequence: Epoch;
+    more: boolean;
+}
+export type HubAuthorizationResult = {
+    ok: true;
+    lease: HubAuthorizationLease;
+} | {
+    ok: false;
+    reasonCode: string;
+};
+export interface HubProtocolError {
+    code: string;
+    retryable: boolean;
+}
+export type HubRevocationScope = {
+    kind: "person";
+    personId: PersonId;
+} | {
+    kind: "fleet";
+    fleetId: FleetId;
+} | {
+    kind: "exposure";
+    exposureId: ExposureId;
+} | {
+    kind: "grant";
+    grantId: GrantId;
+};
+export interface HubRevocation {
+    revocationVersion: Epoch;
+    scope: HubRevocationScope;
+    reasonCode: string;
+}
+export type HubMemberFrame = HubFrame<"hello", HubHello> | HubFrame<"exposure.snapshot", HubExposureSnapshot> | HubFrame<"receipt", HubReceipt> | HubFrame<"answer", HubAnswer> | HubFrame<"reconcile", HubReconcile> | HubFrame<"authorize.request", HubAuthorizationRequest> | HubFrame<"error", HubProtocolError> | HubFrame<"attachment.get", {
+    id: string;
+    offset: number;
+}> | HubFrame<"attachment.put", HubAttachmentChunk> | HubFrame<"exposure.quota", HubExposureQuota>;
+export type HubServerFrame = HubFrame<"welcome", HubWelcome> | HubFrame<"question", HubQuestion> | HubFrame<"receipt", HubReceipt> | HubFrame<"reconcile", HubReconcileReply> | HubFrame<"authorize.result", HubAuthorizationResult> | HubFrame<"revoke", HubRevocation> | HubFrame<"error", HubProtocolError> | HubFrame<"attachment.chunk", HubAttachmentChunk> | HubFrame<"attachment.ack", {
+    id: string;
+    offset: number;
+}>;
+export interface HubServerTransport {
+    start(): Promise<void>;
+    send(fleetId: FleetId, frame: HubServerFrame): Promise<void>;
+    close(): Promise<void>;
+}
+export interface HubMemberTransport {
+    start(): Promise<void>;
+    send(frame: HubMemberFrame): Promise<void>;
+    authorize(request: HubAuthorizationRequest): Promise<HubAuthorizationLease>;
+    close(): Promise<void>;
+}
+export interface HubAskerEnvelope {
+    v: 1;
+    issuer: HubId;
+    issuerKeyId: string;
+    messageId: MessageId;
+    asker: PersonKey;
+    owner: PersonKey;
+    destinationFleetId: FleetId;
+    exposureId: ExposureId;
+    roomId: RoomId;
+    grantId: GrantId;
+    grantRevision: Epoch;
+    exposureRevision: Epoch;
+    revocationVersion: Epoch;
+    contentDigest: Sha256;
+    issuedAt: Millis;
+    expiresAt: Millis;
+    nonce: string;
+    signature: string;
+}
+export interface HubPerson {
+    key: PersonKey;
+    displayName: string;
+    loginLabel: string;
+    status: "active" | "disabled" | "unknown";
+    lastCheckedAt: Millis;
+}
+export interface HubFleet {
+    id: FleetId;
+    owner: PersonKey;
+    displayName: string;
+    generation: Epoch;
+    status: "pending" | "online" | "offline" | "revoked" | "frozen";
+    approvedAt?: Millis;
+}
+export interface HubExposure {
+    id: ExposureId;
+    fleetId: FleetId;
+    owner: PersonKey;
+    displayName: string;
+    revision: Epoch;
+    state: "published" | "withdrawn" | "frozen";
+    dataViewId: string;
+    allowedTools: readonly string[];
+    policyDigest: Sha256;
+}
+export interface HubGrant {
+    id: GrantId;
+    revision: Epoch;
+    owner: PersonKey;
+    exposureId: ExposureId;
+    exposureRevision: Epoch;
+    approvedBy: PersonKey;
+    approvedAt: Millis;
+    subject: {
+        kind: "person";
+        person: PersonKey;
+    };
+    permissions: readonly ("ask" | "read-own-room")[];
+    startsAt: Millis;
+    expiresAt: Millis;
+    state: "active" | "revoked";
+}
+export interface HubRoom {
+    id: RoomId;
+    asker: PersonKey;
+    exposureId: ExposureId;
+    ownerAtCreation: PersonKey;
+    grantId: GrantId;
+    state: "active" | "held" | "closed";
+}
+export interface HubDeputy {
+    id: string;
+    person: PersonKey;
+    roleId: string;
+    scopeId: string;
+    startsAt: Millis;
+    expiresAt: Millis;
+    appointedBy: PersonKey;
+}
+export interface HubAuditRecord {
+    id: string;
+    sequence: Epoch;
+    at: Millis;
+    requestId: string;
+    actor: {
+        kind: "person";
+        person: PersonKey;
+    } | {
+        kind: "local-host";
+    } | {
+        kind: "member";
+        fleetId: FleetId;
+    };
+    action: string;
+    result: "allowed" | "denied" | "held" | "completed";
+    messageId?: MessageId;
+    roomId?: RoomId;
+    fleetId?: FleetId;
+    exposureId?: ExposureId;
+    ownerAtEvent?: PersonKey;
+    grantId?: GrantId;
+    grantRevision?: Epoch;
+    policyVersion: Epoch;
+    contentRef?: string;
+    reasonCode?: string;
+}
+export interface HubMode {
+    serverEnabled(): boolean;
+    memberEnabled(): boolean;
+    epoch(): Epoch;
+}
+export type HubActor = {
+    kind: "directory";
+    person: PersonKey;
+    sessionId: string;
+} | {
+    kind: "local-host";
+    sessionId: string;
+    directoryBinding: PersonKey | null;
+};
+export interface HubRequestContext {
+    readonly requestId: string;
+    current(): Promise<HubActor>;
+    requirePerson(): Promise<PersonKey>;
+    requireAdmin(): Promise<HubActor>;
+}
+export interface HubCatalog {
+    publish(ctx: HubRequestContext, exposure: HubExposure): Promise<HubExposure>;
+    withdraw(ctx: HubRequestContext, id: ExposureId, revision: Epoch): Promise<void>;
+    grant(ctx: HubRequestContext, grant: HubGrant): Promise<HubGrant>;
+    revokeGrant(ctx: HubRequestContext, id: GrantId, revision: Epoch): Promise<void>;
+    visible(ctx: HubRequestContext): Promise<readonly HubExposure[]>;
+}
+export interface HubPolicy {
+    authorize(request: HubAuthorizationRequest): Promise<HubAuthorizationLease>;
+    revoke(ctx: HubRequestContext, scope: HubRevocation["scope"]): Promise<HubRevocation>;
+}
+export interface HubRooms {
+    open(ctx: HubRequestContext, exposureId: ExposureId, grantId: GrantId): Promise<HubRoom>;
+    ask(ctx: HubRequestContext, roomId: RoomId, idempotencyKey: string, text: string): Promise<HubReceipt>;
+    read(ctx: HubRequestContext, roomId: RoomId, after: Epoch): Promise<readonly HubRoomEntry[]>;
+}
+export interface HubRoomEntry {
+    messageId: MessageId;
+    sequence: Epoch;
+    receipt: HubReceipt;
+    askedAt?: Millis;
+    question?: string;
+    answer?: string;
+}
+export interface HubMemberAdmission {
+    admit(question: HubQuestion): Promise<HubReceipt>;
+    reconcile(input: HubReconcile): Promise<readonly HubReceipt[]>;
+    fence(revocation: HubRevocation): Promise<void>;
+}
+export interface HubExecutionPolicy {
+    dataViewId: string;
+    policyDigest: Sha256;
+    allowedTools: readonly string[];
+    readOnly: true;
+}
+export interface HubRestrictedContext {
+    id: string;
+    messageId: MessageId;
+    exposureId: ExposureId;
+    owner: PersonKey;
+    exposureRevision: Epoch;
+    policy: HubExecutionPolicy;
+}
+export interface HubRestrictedExecution {
+    prepare(question: HubQuestion, policy: HubExecutionPolicy): Promise<HubRestrictedContext>;
+    begin(context: HubRestrictedContext, lease: HubAuthorizationLease): Promise<void>;
+    invokeTool(context: HubRestrictedContext, name: string, args: unknown, lease: HubAuthorizationLease): Promise<unknown>;
+    finish(context: HubRestrictedContext): Promise<HubAnswer>;
+    hold(context: HubRestrictedContext, reasonCode: string): Promise<void>;
+    proposeLocalAction(context: HubRestrictedContext, proposal: HubLocalProposal): Promise<void>;
+}
+export interface HubLocalProposal {
+    id: string;
+    action: string;
+    argumentsDigest: Sha256;
+    consequences: string;
+}
+export interface HubTx {
+    readonly id: string;
+}
+export interface HubUnitOfWork {
+    atomic<T>(work: (tx: HubTx) => T): T;
+}
+export interface HubAuditContent {
+    recordId: string;
+    question?: string;
+    answer?: string;
+    audience: readonly PersonKey[];
+    buttons?: HubAnswerButtons;
+    pollBallot?: HubPollBallot;
+}
+export interface HubAuditSink {
+    append(tx: HubTx, record: HubAuditRecord): void;
+    read(ctx: HubRequestContext, scope: {
+        exposureId?: ExposureId;
+        after?: Epoch;
+    }): Promise<readonly HubAuditRecord[]>;
+    readContent(ctx: HubRequestContext, recordId: string): Promise<HubAuditContent>;
+}
+export interface HubNotifications {
+    owner(event: {
+        messageId: MessageId;
+        exposureId: ExposureId;
+        code: "asked" | "answered" | "held" | "revoked";
+    }): Promise<void>;
+}
+export type { HubInitPlan, HubInitializer, HubInitInspection, HubInitSecrets, HubInitConfirmation, HubInitResult, HubListen, HubIdentityProvider, HubIdentitySummary, HubCoexistence } from "./init/types.js";

package/dist/hub/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/hub/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/hub/types.ts"],"names":[],"mappings":""}

package/dist/hub/validation.d.ts

@@ -0,0 +1,33 @@
+/** Closed, bounded machine data. Error strings are static and safe for transport. */
+import { z } from "zod";
+export declare const uuid: z.ZodString;
+export declare const hash: z.ZodString;
+export declare const epoch: z.ZodNumber;
+export declare const token: z.ZodString;
+export declare const identifier: z.ZodString;
+export declare const reason: z.ZodEnum<{
+    backpressure: "backpressure";
+    conflict: "conflict";
+    denied: "denied";
+    expired: "expired";
+    incompatible: "incompatible";
+    invalid: "invalid";
+    "not-found": "not-found";
+    revoked: "revoked";
+    stale: "stale";
+    unavailable: "unavailable";
+    uncertain: "uncertain";
+}>;
+export declare const person: z.ZodObject<{
+    realm: z.ZodString;
+    objectId: z.ZodString;
+}, z.core.$strict>;
+export declare const plain: (max: number) => z.ZodString;
+export declare function scalarString(s: string): boolean;
+export declare class HubProtocolError extends Error {
+    readonly code: z.infer<typeof reason>;
+    constructor(code?: z.infer<typeof reason>);
+}
+/** JSON.parse alone silently accepts duplicate keys, including escaped spellings of the same key. */
+export declare function parseStrictJson(input: string | Buffer, limit?: number): unknown;
+export declare function validated<T>(schema: z.ZodType<T>, value: unknown): T;

package/dist/hub/validation.js

@@ -0,0 +1,136 @@
+/** Closed, bounded machine data. Error strings are static and safe for transport. */
+import { z } from "zod";
+export const uuid = z.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
+export const hash = z.string().regex(/^[a-f0-9]{64}$/);
+export const epoch = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+export const token = z.string().regex(/^[a-f0-9]{64}$/);
+export const identifier = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,127}$/);
+export const reason = z.enum(["unavailable", "denied", "stale", "incompatible", "invalid", "conflict", "uncertain", "revoked", "expired", "backpressure", "not-found"]);
+export const person = z.strictObject({ realm: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), objectId: uuid });
+export const plain = (max) => z.string().refine(s => Buffer.byteLength(s, "utf8") <= max && scalarString(s), "Invalid text");
+export function scalarString(s) {
+    for (let i = 0; i < s.length; i++) {
+        const n = s.charCodeAt(i);
+        if (n >= 0xd800 && n <= 0xdbff) {
+            const low = s.charCodeAt(++i);
+            if (!(low >= 0xdc00 && low <= 0xdfff))
+                return false;
+        }
+        else if (n >= 0xdc00 && n <= 0xdfff)
+            return false;
+    }
+    return true;
+}
+export class HubProtocolError extends Error {
+    code;
+    constructor(code = "invalid") {
+        super(`Hub protocol: ${code}`);
+        this.code = code;
+    }
+}
+/** JSON.parse alone silently accepts duplicate keys, including escaped spellings of the same key. */
+export function parseStrictJson(input, limit = 256 * 1024) {
+    if (typeof input === "string" && !scalarString(input))
+        throw new HubProtocolError();
+    const bytes = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+    if (bytes.length > limit)
+        throw new HubProtocolError("backpressure");
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new HubProtocolError();
+    }
+    if (!scalarString(text))
+        throw new HubProtocolError();
+    let at = 0;
+    const ws = () => { while (/[\x20\t\r\n]/.test(text[at] ?? "!") && at < text.length)
+        at++; };
+    const string = () => {
+        const start = at++;
+        while (at < text.length) {
+            const c = text[at++];
+            if (c === '"') {
+                let value;
+                try {
+                    value = JSON.parse(text.slice(start, at));
+                }
+                catch {
+                    throw new HubProtocolError();
+                }
+                if (!scalarString(value))
+                    throw new HubProtocolError();
+                return value;
+            }
+            if (c === "\\")
+                at++;
+        }
+        throw new HubProtocolError();
+    };
+    const value = (depth) => {
+        if (depth > 32)
+            throw new HubProtocolError();
+        ws();
+        if (text[at] === '"') {
+            string();
+            return;
+        }
+        if (text[at] === "{" || text[at] === "[") {
+            const object = text[at++] === "{", end = object ? "}" : "]", keys = new Set();
+            ws();
+            if (text[at] === end) {
+                at++;
+                return;
+            }
+            for (;;) {
+                if (object) {
+                    ws();
+                    if (text[at] !== '"')
+                        throw new HubProtocolError();
+                    const key = string();
+                    if (keys.has(key))
+                        throw new HubProtocolError();
+                    keys.add(key);
+                    ws();
+                    if (text[at++] !== ":")
+                        throw new HubProtocolError();
+                }
+                value(depth + 1);
+                ws();
+                if (text[at] === end) {
+                    at++;
+                    return;
+                }
+                if (text[at++] !== ",")
+                    throw new HubProtocolError();
+            }
+        }
+        const match = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(text.slice(at));
+        if (!match)
+            throw new HubProtocolError();
+        at += match[0].length;
+        if (/^-?\d/.test(match[0])) {
+            const n = Number(match[0]);
+            if (!Number.isFinite(n) || Math.abs(n) > Number.MAX_SAFE_INTEGER)
+                throw new HubProtocolError();
+        }
+    };
+    value(0);
+    ws();
+    if (at !== text.length)
+        throw new HubProtocolError();
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new HubProtocolError();
+    }
+}
+export function validated(schema, value) {
+    const result = schema.safeParse(value);
+    if (!result.success)
+        throw new HubProtocolError();
+    return result.data;
+}
+//# sourceMappingURL=validation.js.map

package/dist/hub/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/hub/validation.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;AACvG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AACxK,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7G,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AACrI,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;QAAC,CAAC;aAClH,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACpB,IAAI;IAAzB,YAAqB,IAAI,GAA2B,SAAS;QAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;oBAA3E,IAAI;IAAwE,CAAC;CACnG;AACD,qGAAqG;AACrG,MAAM,UAAU,eAAe,CAAC,KAAsB,EAAE,KAAK,GAAG,GAAG,GAAG,IAAI;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACrE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAAC,CAAC;IAC/G,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IACtD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM;QAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,KAAK,GAAG,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,KAAa,CAAC;gBAClB,IAAI,CAAC;oBAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBAAC,CAAC;gBAC1F,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,KAAK,IAAI;gBAAE,EAAE,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC/B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAQ,EAAE;QACpC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC7C,EAAE,EAAE,CAAC;QACL,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YACtF,EAAE,EAAE,CAAC;YAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,EAAE,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC7C,SAAS,CAAC;gBACR,IAAI,MAAM,EAAE,CAAC;oBACX,EAAE,EAAE,CAAC;oBAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG;wBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;oBACzD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;oBAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACrF,EAAE,EAAE,CAAC;oBAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG;wBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBAC7D,CAAC;gBACD,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,EAAE,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,EAAE,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACvC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG;oBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,kEAAkE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACzC,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,gBAAgB;gBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAAC,CAAC;IAC7J,CAAC,CAAC;IACF,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,EAAE,EAAE,CAAC;IAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IACrE,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAAC,CAAC;AAC1E,CAAC;AACD,MAAM,UAAU,SAAS,CAAI,MAAoB,EAAE,KAAc;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/hub/version-floor.d.ts

@@ -0,0 +1,10 @@
+import type { HubVersionFloor } from "./store.js";
+export declare class HubFileVersionFloor implements HubVersionFloor {
+    private readonly home;
+    private readonly suffix;
+    constructor(home: string, suffix: string);
+    private flushParent;
+    initialize(): void;
+    read(): number;
+    raise(revision: number): void;
+}

package/dist/hub/version-floor.js

@@ -0,0 +1,45 @@
+/** Private, independently durable revision floor; never create/reset on a missing read. */
+import { openSync, writeFileSync, fsyncSync, closeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { atomicWriteFileSync } from "../atomic-write.js";
+import { ensurePrivateDirectory, readPrivateFile, privatePath } from "./private-files.js";
+import { parseStrictJson, validated, epoch } from "./validation.js";
+export class HubFileVersionFloor {
+    home;
+    suffix;
+    constructor(home, suffix) {
+        this.home = home;
+        this.suffix = suffix;
+    }
+    flushParent() {
+        const fd = openSync(privatePath(this.home, dirname(this.suffix), true), "r");
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    initialize() {
+        ensurePrivateDirectory(this.home, dirname(this.suffix).replaceAll("\\", "/"));
+        const fd = openSync(join(this.home, this.suffix), "wx", 0o600);
+        try {
+            writeFileSync(fd, "0", "utf8");
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        this.flushParent();
+    }
+    read() { return validated(epoch, parseStrictJson(readPrivateFile(this.home, this.suffix, 64))); }
+    raise(revision) {
+        validated(epoch, revision);
+        if (revision < this.read())
+            throw Error("Hub revision would decrease");
+        atomicWriteFileSync(join(this.home, this.suffix), String(revision), { mode: 0o600 });
+        // The shared helper's directory fsync is best-effort; a revision floor must not report that as durable success.
+        this.flushParent();
+    }
+}
+//# sourceMappingURL=version-floor.js.map

package/dist/hub/version-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-floor.js","sourceRoot":"","sources":["../../src/hub/version-floor.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEpE,MAAM,OAAO,mBAAmB;IACD,IAAI;IAA2B,MAAM;IAAlE,YAA6B,IAAY,EAAmB,MAAc;oBAA7C,IAAI;sBAA2B,MAAM;IAAW,CAAC;IACtE,WAAW;QACjB,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACnD,CAAC;IACD,UAAU;QACR,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9E,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC;YAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjF,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,KAAa,OAAO,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,KAAK,CAAC,QAAgB;QACpB,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAAC,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,gHAAgH;QAChH,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/hub-browser-certificate-policy.d.ts

@@ -0,0 +1,31 @@
+/** Host Settings wire values only; no filesystem, key or runtime side effects on import. */
+export interface HubBrowserCertificateInfo {
+    fingerprint256: string;
+    validFrom: string;
+    validTo: string;
+    selfSigned: boolean;
+}
+export interface HubBrowserCertificateView {
+    revision: string;
+    selected: HubBrowserCertificateInfo;
+    activeFingerprint256: string | null;
+    restartRequired: boolean;
+}
+export type HubBrowserCertificatePrepare = {
+    mode: "generate";
+    revision: string;
+} | {
+    mode: "import";
+    revision: string;
+    certificateFile: string;
+    keyFile: string;
+};
+export interface HubBrowserCertificateApply {
+    reference: string;
+    revision: string;
+}
+export interface HubBrowserCertificateProposal extends HubBrowserCertificateApply {
+    certificate: HubBrowserCertificateInfo;
+}
+export declare function parseHubBrowserCertificatePrepare(input: unknown): HubBrowserCertificatePrepare;
+export declare function parseHubBrowserCertificateApply(input: unknown): HubBrowserCertificateApply;