@tiangong-ai/cli 0.0.18 → 0.0.20

package/dist/research/workspace/broker.js

@@ -0,0 +1,353 @@
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+import { readFile, writeFile } from "node:fs/promises";
+import { join, relative } from "node:path";
+import { CliError } from "../../errors.js";
+import { loadCapabilityDeclarations, verifyCapabilities } from "./capabilities.js";
+import { appendJournalEvent } from "./journal.js";
+import { ensureDirectory, isObject, pathExists, sha256Bytes, sha256Text, workspacePaths, } from "./storage.js";
+const MAX_REQUEST_BYTES = 1024 * 1024;
+const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+export async function startCapabilityBroker(root, projectId, capsuleProject) {
+    const declarations = await loadCapabilityDeclarations(root);
+    const networkCapabilities = declarations.capabilities.filter((capability) => capability.permissions.includes("brokered-network"));
+    if (!networkCapabilities.length)
+        return undefined;
+    const verification = await verifyCapabilities(root);
+    if (verification.status !== "verified") {
+        throw new CliError("Capability broker requires verified capability locks.", {
+            code: "RESEARCH_CAPABILITY_DRIFT",
+            exitCode: 3,
+            details: verification,
+        });
+    }
+    const credentialMap = await loadCredentialMap(root, declarations.capabilities);
+    const routeToken = randomUUID().replaceAll("-", "");
+    const route = `/mcp/${routeToken}`;
+    const server = createServer((request, response) => {
+        void handleMcpRequest({
+            request,
+            response,
+            route,
+            root,
+            projectId,
+            capsuleProject,
+            capabilities: networkCapabilities,
+            credentialMap,
+        });
+    });
+    await new Promise((resolvePromise, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolvePromise());
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        server.close();
+        throw new Error("Capability broker did not receive a TCP address.");
+    }
+    return {
+        url: `http://127.0.0.1:${address.port}${route}`,
+        stop: () => new Promise((resolvePromise, reject) => {
+            server.close((error) => (error ? reject(error) : resolvePromise()));
+        }),
+    };
+}
+async function handleMcpRequest(input) {
+    try {
+        if (input.request.method !== "POST" || input.request.url !== input.route) {
+            sendJson(input.response, 404, { error: "not_found" });
+            return;
+        }
+        const body = await readRequestJson(input.request);
+        if (!isObject(body) || body.jsonrpc !== "2.0" || typeof body.method !== "string") {
+            sendRpcError(input.response, body, -32600, "Invalid Request");
+            return;
+        }
+        if (body.method === "notifications/initialized") {
+            input.response.writeHead(202).end();
+            return;
+        }
+        if (body.method === "initialize") {
+            sendRpcResult(input.response, body, {
+                protocolVersion: "2025-03-26",
+                capabilities: { tools: {} },
+                serverInfo: { name: "tiangong-research-broker", version: "1" },
+            });
+            return;
+        }
+        if (body.method === "tools/list") {
+            sendRpcResult(input.response, body, {
+                tools: [
+                    {
+                        name: "fetch_candidate_source",
+                        description: "Fetch one HTTPS candidate source through a locked capability and record a value-free receipt.",
+                        inputSchema: {
+                            type: "object",
+                            additionalProperties: false,
+                            required: ["capability_id", "url"],
+                            properties: {
+                                capability_id: { type: "string" },
+                                credential_id: { type: "string" },
+                                url: { type: "string" },
+                            },
+                        },
+                    },
+                ],
+            });
+            return;
+        }
+        if (body.method === "tools/call") {
+            const params = body.params;
+            if (!isObject(params) ||
+                params.name !== "fetch_candidate_source" ||
+                !isObject(params.arguments)) {
+                sendToolError(input.response, body, "Unsupported tool call.");
+                return;
+            }
+            try {
+                const receipt = await fetchCandidateSource({
+                    root: input.root,
+                    projectId: input.projectId,
+                    capsuleProject: input.capsuleProject,
+                    capabilities: input.capabilities,
+                    credentialMap: input.credentialMap,
+                    arguments: params.arguments,
+                });
+                sendRpcResult(input.response, body, {
+                    content: [{ type: "text", text: JSON.stringify(receipt) }],
+                });
+            }
+            catch (error) {
+                sendToolError(input.response, body, error instanceof Error ? error.message : String(error));
+            }
+            return;
+        }
+        sendRpcError(input.response, body, -32601, "Method not found");
+    }
+    catch (error) {
+        sendJson(input.response, 500, {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+async function fetchCandidateSource(input) {
+    const capabilityId = input.arguments.capability_id;
+    const credentialId = input.arguments.credential_id;
+    const rawUrl = input.arguments.url;
+    if (typeof capabilityId !== "string" || typeof rawUrl !== "string") {
+        throw new Error("capability_id and url are required strings");
+    }
+    if (credentialId !== undefined && typeof credentialId !== "string") {
+        throw new Error("credential_id must be a string when provided");
+    }
+    const capability = input.capabilities.find((candidate) => candidate.id === capabilityId);
+    if (!capability)
+        throw new Error(`capability is not admitted for brokered network: ${capabilityId}`);
+    const target = validateHttpsUrl(rawUrl);
+    const credential = credentialId
+        ? capability.credentials.find((candidate) => candidate.id === credentialId)
+        : undefined;
+    if (credentialId && !credential) {
+        throw new Error(`credential is not declared by capability ${capabilityId}: ${credentialId}`);
+    }
+    assertAllowedHost(target, capability.allowedHosts, "capability");
+    if (credential)
+        assertAllowedHost(target, credential.allowedHosts, "credential");
+    const attemptId = randomUUID();
+    await appendJournalEvent(workspacePaths(input.root).journal, "capability.fetch.attempted", input.projectId, {
+        attemptId,
+        projectId: input.projectId,
+        capabilityId,
+        credentialId: credentialId ?? null,
+        targetSha256: sha256Text(target.toString()),
+    });
+    try {
+        const headers = new Headers({
+            Accept: "text/plain, application/json, text/html;q=0.9, */*;q=0.1",
+        });
+        if (credential) {
+            const value = input.credentialMap.get(credential.id);
+            if (!value)
+                throw new Error(`credential value is not configured: ${credential.id}`);
+            headers.set(credential.headerName, `${credential.prefix}${value}`);
+        }
+        const { response, finalUrl } = await fetchWithRedirectPolicy(target, headers, capability.allowedHosts, credential?.allowedHosts);
+        const announcedLength = Number(response.headers.get("content-length") ?? "0");
+        if (announcedLength > MAX_RESPONSE_BYTES)
+            throw new Error("response exceeds the broker size limit");
+        const bytes = await readBoundedResponseBody(response);
+        for (const secret of input.credentialMap.values()) {
+            if (bytes.includes(Buffer.from(secret, "utf8"))) {
+                throw new Error("response failed credential disclosure screening");
+            }
+        }
+        if (!response.ok)
+            throw new Error(`HTTPS source returned status ${response.status}`);
+        const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim() ?? "application/octet-stream";
+        const extension = contentType.includes("json")
+            ? "json"
+            : contentType.startsWith("text/")
+                ? "txt"
+                : "bin";
+        const destination = join(input.capsuleProject, "inputs", "broker", `${attemptId}.${extension}`);
+        await ensureDirectory(join(input.capsuleProject, "inputs", "broker"));
+        await writeFile(destination, bytes, { mode: 0o600 });
+        const receipt = {
+            attemptId,
+            capabilityId,
+            credentialId: credentialId ?? null,
+            status: response.status,
+            contentType,
+            bytes: bytes.length,
+            sha256: sha256Bytes(bytes),
+            sourceSha256: sha256Text(finalUrl.toString()),
+            path: relative(input.capsuleProject, destination).replaceAll("\\", "/"),
+        };
+        await appendJournalEvent(workspacePaths(input.root).journal, "capability.fetch.completed", input.projectId, receipt);
+        return receipt;
+    }
+    catch (error) {
+        await appendJournalEvent(workspacePaths(input.root).journal, "capability.fetch.failed", input.projectId, {
+            attemptId,
+            capabilityId,
+            credentialId: credentialId ?? null,
+            error: bounded(error instanceof Error ? error.message : String(error), 500),
+        });
+        throw error;
+    }
+}
+async function loadCredentialMap(root, capabilities) {
+    const path = workspacePaths(root).env;
+    if (!(await pathExists(path)))
+        return new Map();
+    const content = await readFile(path, "utf8");
+    const configured = new Map();
+    let foundConfiguration = false;
+    const declared = new Set(capabilities.flatMap((capability) => capability.credentials.map((credential) => credential.id)));
+    for (const sourceLine of content.split(/\r?\n/)) {
+        const line = sourceLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const equals = line.indexOf("=");
+        const key = equals > 0 ? line.slice(0, equals).trim() : "";
+        if (key !== "TIANGONG_RESEARCH_CAPABILITY_CREDENTIALS_JSON") {
+            throw new Error(`unsupported research environment key: ${key || "missing"}`);
+        }
+        if (foundConfiguration)
+            throw new Error("research credential configuration is duplicated");
+        foundConfiguration = true;
+        const value = JSON.parse(line.slice(equals + 1).trim() || "{}");
+        if (!isObject(value))
+            throw new Error("capability credentials must be a JSON object");
+        for (const [credentialId, credentialValue] of Object.entries(value)) {
+            if (!declared.has(credentialId))
+                throw new Error(`credential is not declared: ${credentialId}`);
+            if (typeof credentialValue !== "string" || Buffer.byteLength(credentialValue, "utf8") < 8) {
+                throw new Error(`credential value is invalid: ${credentialId}`);
+            }
+            configured.set(credentialId, credentialValue);
+        }
+    }
+    return configured;
+}
+async function fetchWithRedirectPolicy(initialUrl, headers, capabilityHosts, credentialHosts) {
+    let current = initialUrl;
+    for (let redirects = 0; redirects <= 5; redirects += 1) {
+        assertAllowedHost(current, capabilityHosts, "capability");
+        if (credentialHosts)
+            assertAllowedHost(current, credentialHosts, "credential");
+        const response = await fetch(current, {
+            method: "GET",
+            headers,
+            redirect: "manual",
+            signal: AbortSignal.timeout(120_000),
+        });
+        if (![301, 302, 303, 307, 308].includes(response.status)) {
+            return { response, finalUrl: current };
+        }
+        const location = response.headers.get("location");
+        await response.body?.cancel();
+        if (!location)
+            throw new Error("HTTPS source returned a redirect without a location");
+        if (redirects === 5)
+            throw new Error("HTTPS source exceeded the redirect limit");
+        current = validateHttpsUrl(new URL(location, current).toString());
+    }
+    throw new Error("HTTPS source exceeded the redirect limit");
+}
+function assertAllowedHost(url, allowedHosts, scope) {
+    if (!allowedHosts.includes(url.host)) {
+        throw new Error(`target host is outside ${scope} scope: ${url.host}`);
+    }
+}
+async function readBoundedResponseBody(response) {
+    if (!response.body)
+        return Buffer.alloc(0);
+    const reader = response.body.getReader();
+    const chunks = [];
+    let bytes = 0;
+    try {
+        while (true) {
+            const result = await reader.read();
+            if (result.done)
+                break;
+            const chunk = Buffer.from(result.value);
+            bytes += chunk.length;
+            if (bytes > MAX_RESPONSE_BYTES) {
+                await reader.cancel();
+                throw new Error("response exceeds the broker size limit");
+            }
+            chunks.push(chunk);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks);
+}
+function validateHttpsUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || !url.hostname) {
+        throw new Error("broker URL must be credential-free HTTPS");
+    }
+    return url;
+}
+async function readRequestJson(request) {
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > MAX_REQUEST_BYTES)
+            throw new Error("MCP request exceeds its size limit");
+        chunks.push(buffer);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function sendRpcResult(response, request, result) {
+    sendJson(response, 200, { jsonrpc: "2.0", id: request.id ?? null, result });
+}
+function sendRpcError(response, request, code, message) {
+    const id = isObject(request) ? (request.id ?? null) : null;
+    sendJson(response, 200, { jsonrpc: "2.0", id, error: { code, message } });
+}
+function sendToolError(response, request, message) {
+    sendRpcResult(response, request, {
+        content: [{ type: "text", text: message }],
+        isError: true,
+    });
+}
+function sendJson(response, status, value) {
+    if (response.headersSent)
+        return;
+    const body = `${JSON.stringify(value)}\n`;
+    response.writeHead(status, {
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(body),
+    });
+    response.end(body);
+}
+function bounded(value, length) {
+    return value.length <= length ? value : `${value.slice(0, length)}…`;
+}
+//# sourceMappingURL=broker.js.map

package/dist/research/workspace/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/research/workspace/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,GACf,MAAM,cAAc,CAAC;AAGtB,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AACtC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAO3C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,SAAiB,EACjB,cAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,mBAAmB,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1E,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CACpD,CAAC;IACF,IAAI,CAAC,mBAAmB,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE;YAC1E,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,KAAK,gBAAgB,CAAC;YACpB,OAAO;YACP,QAAQ;YACR,KAAK;YACL,IAAI;YACJ,SAAS;YACT,cAAc;YACd,YAAY,EAAE,mBAAmB;YACjC,aAAa;SACd,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,oBAAoB,OAAO,CAAC,IAAI,GAAG,KAAK,EAAE;QAC/C,IAAI,EAAE,GAAG,EAAE,CACT,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAS/B;IACC,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACzE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjF,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;YAChD,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAClC,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,EAAE;aAC/D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAClC,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,wBAAwB;wBAC9B,WAAW,EACT,+FAA+F;wBACjG,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,oBAAoB,EAAE,KAAK;4BAC3B,QAAQ,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC;4BAClC,UAAU,EAAE;gCACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACjC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACjC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6BACxB;yBACF;qBACF;iBACF;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IACE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,wBAAwB;gBACxC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAC3B,CAAC;gBACD,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;oBACzC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAC;gBACH,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;oBAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO;QACT,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC5B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAOnC;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACnD,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;IACnC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IACzF,IAAI,CAAC,UAAU;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,YAAY,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,YAAY;QAC7B,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,YAAY,CAAC;QAC3E,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,KAAK,YAAY,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,UAAU;QAAE,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,kBAAkB,CACtB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAClC,4BAA4B,EAC5B,KAAK,CAAC,SAAS,EACf;QACE,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY;QACZ,YAAY,EAAE,YAAY,IAAI,IAAI;QAClC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;KAC5C,CACF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,MAAM,EAAE,0DAA0D;SACnE,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAC1D,MAAM,EACN,OAAO,EACP,UAAU,CAAC,YAAY,EACvB,UAAU,EAAE,YAAY,CACzB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9E,IAAI,eAAe,GAAG,kBAAkB;YACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,MAAM,WAAW,GACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;QAC/F,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC/B,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,KAAK,CAAC;QACZ,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;QAChG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG;YACd,SAAS;YACT,YAAY;YACZ,YAAY,EAAE,YAAY,IAAI,IAAI;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;YAC1B,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;SACxE,CAAC;QACF,MAAM,kBAAkB,CACtB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAClC,4BAA4B,EAC5B,KAAK,CAAC,SAAS,EACf,OAAO,CACR,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CACtB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAClC,yBAAyB,EACzB,KAAK,CAAC,SAAS,EACf;YACE,SAAS;YACT,YAAY;YACZ,YAAY,EAAE,YAAY,IAAI,IAAI;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;SAC5E,CACF,CAAC;QACF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY,EACZ,YAAqC;IAErC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,YAAY,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAChG,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI,GAAG,KAAK,+CAA+C,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC3F,kBAAkB,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAY,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACtF,KAAK,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,UAAe,EACf,OAAgB,EAChB,eAAyB,EACzB,eAAqC;IAErC,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,IAAI,CAAC,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;QACvD,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1D,IAAI,eAAe;YAAE,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtF,IAAI,SAAS,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACjF,OAAO,GAAG,gBAAgB,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAQ,EAAE,YAAsB,EAAE,KAAa;IACxE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,KAAK,GAAG,iBAAiB;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CACpB,QAAwB,EACxB,OAAgC,EAChC,MAAe;IAEf,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CACnB,QAAwB,EACxB,OAAgB,EAChB,IAAY,EACZ,OAAe;IAEf,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CACpB,QAAwB,EACxB,OAAgC,EAChC,OAAe;IAEf,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE;QAC/B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,KAAc;IACxE,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO;IACjC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,OAAO,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;AACvE,CAAC"}

package/dist/research/workspace/capabilities.d.ts

@@ -0,0 +1,10 @@
+import type { CapabilityDeclarations, CapabilityLock } from "./types.js";
+export declare function loadCapabilityDeclarations(root: string): Promise<CapabilityDeclarations>;
+export declare function lockCapabilities(root: string): Promise<CapabilityLock>;
+export declare function verifyCapabilities(root: string): Promise<{
+    status: "verified" | "drifted";
+    checked: number;
+    errors: string[];
+}>;
+export declare function stageLockedCapabilities(root: string, destination: string): Promise<string[]>;
+export declare function declaredCredentialIds(root: string): Promise<Set<string>>;