@tomflow/proflow-execution-browser-extension 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tomflow/proflow-execution-browser-extension
 
+## 0.1.3
+
+### Patch Changes
+
+- Real-1 final remediation and black-box release closure
+
+## 0.1.2
+
+### Patch Changes
+
+- Close the Real-1 global Platform control-plane contract across every published ProFlow package. Platform CLI now owns one durable global Workspace binding with canonical identity, cross-process operation locking, cwd/`--workspace` install targeting, cross-directory instance commands, whole-instance uninstall/rebind, and deterministic npm/yarn/pnpm Workspace package-manager selection. Every package-owned install entry, including newly generated Module Template packages, delegates to the Shell-global `platform` command and fails closed when that global CLI is unavailable; Deployment Conformance and the formal test plans mechanically enforce the same rule across all 24 packages.
+
 ## 0.1.1
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -3,7 +3,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "execution-browser-extension";
-            moduleVersion: "0.1.1";
+            moduleVersion: "0.1.3";
             ok: boolean;
             status: string;
         };
@@ -13,7 +13,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "execution-browser-extension";
-            moduleVersion: "0.1.1";
+            moduleVersion: "0.1.3";
             ok: boolean;
             status: string;
         };
@@ -23,7 +23,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "execution-browser-extension";
-            moduleVersion: "0.1.1";
+            moduleVersion: "0.1.3";
             ok: boolean;
             status: string;
             actionRequired: {
@@ -37,7 +37,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "execution-browser-extension";
-            moduleVersion: "0.1.1";
+            moduleVersion: "0.1.3";
             ok: boolean;
             status: string;
             checks: {
@@ -52,10 +52,25 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "execution-browser-extension";
-            moduleVersion: "0.1.1";
+            moduleVersion: "0.1.3";
             ok: boolean;
             status: string;
         };
         observedEffects: never[];
     };
 };
+export declare function browserExtensionLoadDir(workspaceRoot: string): string;
+export declare function materializeProductionConfig(input: {
+    moduleRef: string;
+    config: Record<string, string>;
+    workspaceRoot: string;
+}): Promise<{
+    loadDir: string;
+}>;
+export declare function createProductionBinding(input: {
+    moduleRef: string;
+    config: Record<string, string>;
+    workspaceRoot: string;
+}): {
+    behaviorAdapter: Record<string, unknown>;
+};

package/dist/deployment/adapter.js

@@ -1,3 +1,6 @@
+import { cp, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { descriptor } from "./descriptor.js";
 const base = {
     contract: "deployment.result.v1",
@@ -45,3 +48,177 @@ export const behaviorAdapter = {
         observedEffects: [],
     }),
 };
+function loopbackEndpoint(value, key) {
+    const url = new URL(value);
+    if (url.protocol !== "http:" ||
+        url.hostname !== "127.0.0.1" ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "") {
+        throw new Error(`${key} must be a loopback HTTP origin`);
+    }
+    return value.replace(/\/$/, "");
+}
+async function credential(file, key) {
+    const token = (await readFile(file, "utf8")).trim();
+    if (token.length < 32)
+        throw new Error(`${key} must contain at least 32 characters`);
+    return token;
+}
+function packageRoot() {
+    const candidate = dirname(dirname(fileURLToPath(import.meta.url)));
+    return basename(candidate) === "dist" ? dirname(candidate) : candidate;
+}
+export function browserExtensionLoadDir(workspaceRoot) {
+    return join(workspaceRoot, ".proflow", "deployment", "browser-extension", "execution-browser-extension");
+}
+export async function materializeProductionConfig(input) {
+    const required = [
+        "bridge.endpoint",
+        "bridge.token",
+        "taskApplication.endpoint",
+        "taskApplication.token",
+        "approvalApplication.endpoint",
+        "approvalApplication.token",
+    ];
+    for (const key of required) {
+        if (!input.config[key])
+            throw new Error(`missing required browser config ${key}`);
+    }
+    const runtimeConfig = {
+        proflowRuntimeBridge: {
+            endpoint: loopbackEndpoint(input.config["bridge.endpoint"] ?? "", "bridge.endpoint"),
+            token: await credential(input.config["bridge.token"] ?? "", "bridge.token"),
+        },
+        proflowTaskApplication: {
+            endpoint: loopbackEndpoint(input.config["taskApplication.endpoint"] ?? "", "taskApplication.endpoint"),
+            token: await credential(input.config["taskApplication.token"] ?? "", "taskApplication.token"),
+        },
+        proflowApprovalApplication: {
+            endpoint: loopbackEndpoint(input.config["approvalApplication.endpoint"] ?? "", "approvalApplication.endpoint"),
+            token: await credential(input.config["approvalApplication.token"] ?? "", "approvalApplication.token"),
+        },
+    };
+    const sourceRoot = packageRoot();
+    const loadDir = browserExtensionLoadDir(input.workspaceRoot);
+    await mkdir(join(loadDir, "dist"), { recursive: true });
+    await cp(join(sourceRoot, "dist", "extension"), join(loadDir, "dist", "extension"), {
+        recursive: true,
+        force: true,
+    });
+    await cp(join(sourceRoot, "extension"), join(loadDir, "extension"), {
+        recursive: true,
+        force: true,
+    });
+    await cp(join(sourceRoot, "manifest.json"), join(loadDir, "manifest.json"), {
+        force: true,
+    });
+    await writeFile(join(loadDir, "runtime-config.json"), `${JSON.stringify(runtimeConfig, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    return { loadDir };
+}
+async function readBrowserVerificationEvidence(file, expectedLoadDir) {
+    if (!file)
+        return undefined;
+    try {
+        const raw = JSON.parse(await readFile(file, "utf8"));
+        if (raw.contract !== "proflow.browser-extension-verification.v1" ||
+            raw.moduleVersion !== descriptor.moduleVersion ||
+            raw.loadDir !== expectedLoadDir ||
+            typeof raw.extensionId !== "string" ||
+            raw.extensionId.length < 16 ||
+            raw.serviceWorker !== "RUNNING" ||
+            typeof raw.observedAt !== "string" ||
+            Number.isNaN(Date.parse(raw.observedAt)))
+            return undefined;
+        return raw;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createProductionBinding(input) {
+    const loadDir = browserExtensionLoadDir(input.workspaceRoot);
+    const verificationEvidenceFile = input.config.verificationEvidenceFile;
+    const boundBase = {
+        contract: "deployment.result.v1",
+        moduleRef: descriptor.moduleRef,
+        moduleVersion: descriptor.moduleVersion,
+    };
+    const configured = async () => {
+        try {
+            const raw = JSON.parse(await readFile(join(loadDir, "runtime-config.json"), "utf8"));
+            return typeof raw === "object" && raw !== null;
+        }
+        catch {
+            return false;
+        }
+    };
+    return {
+        behaviorAdapter: {
+            ...behaviorAdapter,
+            preflight: async () => ({
+                result: (await configured())
+                    ? { ...boundBase, ok: true, status: "SUCCEEDED" }
+                    : {
+                        ...boundBase,
+                        ok: false,
+                        status: "ACTION_REQUIRED",
+                        actionRequired: {
+                            action: "configure-browser-extension",
+                            description: `Materialize Browser Extension runtime config before loading ${loadDir}`,
+                        },
+                    },
+                observedEffects: [],
+            }),
+            status: async () => ({
+                result: (await configured())
+                    ? {
+                        ...boundBase,
+                        ok: true,
+                        status: "SUCCEEDED",
+                        data: { loadDir, configMaterialized: true },
+                    }
+                    : {
+                        ...boundBase,
+                        ok: false,
+                        status: "ACTION_REQUIRED",
+                        actionRequired: {
+                            action: "configure-browser-extension",
+                            description: "Browser Extension runtime config is not materialized",
+                        },
+                    },
+                observedEffects: [],
+            }),
+            verify: async () => {
+                const evidence = await readBrowserVerificationEvidence(verificationEvidenceFile, loadDir);
+                return {
+                    result: (await configured()) && evidence
+                        ? {
+                            ...boundBase,
+                            ok: true,
+                            status: "SUCCEEDED",
+                            checks: [
+                                {
+                                    id: "real-carrier-e3-e4",
+                                    status: "PASS",
+                                    message: `Real Chrome loaded extension ${evidence.extensionId} from ${loadDir} and its MV3 Service Worker was observed running`,
+                                },
+                            ],
+                        }
+                        : {
+                            ...boundBase,
+                            ok: false,
+                            status: "ACTION_REQUIRED",
+                            actionRequired: {
+                                action: "verify-real-chrome-extension",
+                                description: `Load ${loadDir} in real Chrome and write verified evidence to ${verificationEvidenceFile ?? "the configured verificationEvidenceFile"}`,
+                            },
+                        },
+                    observedEffects: evidence
+                        ? ["Observes real Chrome MV3 load evidence"]
+                        : [],
+                };
+            },
+        },
+    };
+}

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "execution-browser-extension";
     readonly packageName: "@tomflow/proflow-execution-browser-extension";
-    readonly moduleVersion: "0.1.1";
+    readonly moduleVersion: "0.1.3";
     readonly kind: "browser-extension";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";
@@ -41,10 +41,10 @@ export declare const descriptor: {
         readonly description: "Loopback Browser Reality Bridge endpoint";
     }, {
         readonly key: "bridge.token";
-        readonly type: "secretRef";
+        readonly type: "path";
         readonly required: true;
         readonly sensitive: true;
-        readonly description: "Browser Reality Bridge extension token reference";
+        readonly description: "File containing the Browser Reality Bridge extension token";
     }, {
         readonly key: "taskApplication.endpoint";
         readonly type: "url";
@@ -52,10 +52,10 @@ export declare const descriptor: {
         readonly description: "Loopback Platform Host Task application endpoint";
     }, {
         readonly key: "taskApplication.token";
-        readonly type: "secretRef";
+        readonly type: "path";
         readonly required: true;
         readonly sensitive: true;
-        readonly description: "Platform Host Task application token reference";
+        readonly description: "File containing the Platform Host Task application token";
     }, {
         readonly key: "approvalApplication.endpoint";
         readonly type: "url";
@@ -63,10 +63,15 @@ export declare const descriptor: {
         readonly description: "Loopback Platform Host Approval application endpoint";
     }, {
         readonly key: "approvalApplication.token";
-        readonly type: "secretRef";
+        readonly type: "path";
         readonly required: true;
         readonly sensitive: true;
-        readonly description: "Platform Host Approval application token reference";
+        readonly description: "File containing the Platform Host Approval application token";
+    }, {
+        readonly key: "verificationEvidenceFile";
+        readonly type: "path";
+        readonly required: true;
+        readonly description: "JSON evidence file written after real Chrome loads the Deployment-managed MV3 extension and its Service Worker runs";
     }, {
         readonly key: "chromeRuntimeModuleRef";
         readonly type: "moduleRef";

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "execution-browser-extension",
     packageName: "@tomflow/proflow-execution-browser-extension",
-    moduleVersion: "0.1.1",
+    moduleVersion: "0.1.3",
     kind: "browser-extension",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",
@@ -34,10 +34,10 @@ export const descriptor = {
         },
         {
             key: "bridge.token",
-            type: "secretRef",
+            type: "path",
             required: true,
             sensitive: true,
-            description: "Browser Reality Bridge extension token reference",
+            description: "File containing the Browser Reality Bridge extension token",
         },
         {
             key: "taskApplication.endpoint",
@@ -47,10 +47,10 @@ export const descriptor = {
         },
         {
             key: "taskApplication.token",
-            type: "secretRef",
+            type: "path",
             required: true,
             sensitive: true,
-            description: "Platform Host Task application token reference",
+            description: "File containing the Platform Host Task application token",
         },
         {
             key: "approvalApplication.endpoint",
@@ -60,10 +60,16 @@ export const descriptor = {
         },
         {
             key: "approvalApplication.token",
-            type: "secretRef",
+            type: "path",
             required: true,
             sensitive: true,
-            description: "Platform Host Approval application token reference",
+            description: "File containing the Platform Host Approval application token",
+        },
+        {
+            key: "verificationEvidenceFile",
+            type: "path",
+            required: true,
+            description: "JSON evidence file written after real Chrome loads the Deployment-managed MV3 extension and its Service Worker runs",
         },
         {
             key: "chromeRuntimeModuleRef",