@tomflow/proflow-platform-host 0.1.29 → 0.1.31

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tomflow/proflow-platform-host
 
+## 0.1.31
+
+### Patch Changes
+
+- Close the initial Monitor lifecycle with owner-backed seed/recover, activation-time rotation clocks, automatic bootstrap, and exact-target Monitor delivery.
+
+## 0.1.30
+
+### Patch Changes
+
+- Fail closed on ambiguous Task/Worker Permission identity and keep generic application-boundary observability from fabricating an authoritative side-effect state.
+
 ## 0.1.29
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -6,7 +6,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.29";
+            moduleVersion: "0.1.31";
             data: {
                 endpoint: string;
                 stateRoot: string;
@@ -24,7 +24,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "platform-host";
-            readonly moduleVersion: "0.1.29";
+            readonly moduleVersion: "0.1.31";
         };
         observedEffects: string[];
     }>;
@@ -34,7 +34,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.29";
+            moduleVersion: "0.1.31";
             data: {
                 setupStatus: "READY";
                 runtimeStatus: "RUNNING" | "STOPPED";
@@ -48,7 +48,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.29";
+            moduleVersion: "0.1.31";
             data: {
                 endpoint: string;
                 stateRoot: string;
@@ -66,7 +66,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.29";
+            moduleVersion: "0.1.31";
             data: {
                 docs: string;
             };
@@ -79,7 +79,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.29";
+            moduleVersion: "0.1.31";
             data: {
                 host: string;
                 port: number;
@@ -90,7 +90,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.29";
+            moduleVersion: "0.1.31";
             ok: false;
             status: "FAILED";
             error: {
@@ -107,7 +107,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "platform-host";
-            readonly moduleVersion: "0.1.29";
+            readonly moduleVersion: "0.1.31";
         };
         observedEffects: string[];
     } | {
@@ -116,11 +116,11 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "platform-host";
-            readonly moduleVersion: "0.1.29";
+            readonly moduleVersion: "0.1.31";
         } | {
             contract: "deployment.result.v1";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.29";
+            moduleVersion: "0.1.31";
             ok: false;
             status: "FAILED";
             error: {

package/dist/deployment/adapter.js

@@ -63,25 +63,33 @@ async function running(context) {
         return false;
     }
 }
+async function readPrivateConnection(context, input) {
+    const facts = await readModuleSharedFacts(context, "execution-browser-extension");
+    const endpoint = factString(facts, input.endpointFact);
+    const tokenFile = factString(facts, input.tokenFileFact);
+    if (!endpoint || !tokenFile)
+        return undefined;
+    const info = await stat(tokenFile);
+    if (process.platform !== "win32" && (info.mode & 0o077) !== 0)
+        throw new Error(`${input.tokenFileFact} permissions must be owner-only`);
+    const credential = (await readFile(tokenFile, "utf8")).trim();
+    if (credential.length < 32)
+        throw new Error(`invalid ${input.tokenFileFact} credential`);
+    return { endpoint, credential };
+}
 async function compose(context) {
     const own = await ownFacts(context);
     const { createPlatformHost, parsePlatformHostConfig } = await import("../src/index.js");
     const url = new URL(own.endpoint);
     const host = createPlatformHost({
-        resolveLocalToolConnection: async () => {
-            const facts = await readModuleSharedFacts(context, "execution-browser-extension");
-            const endpoint = factString(facts, "localToolBridgeEndpoint");
-            const tokenFile = factString(facts, "localToolHostTokenFile");
-            if (!endpoint || !tokenFile)
-                return undefined;
-            const info = await stat(tokenFile);
-            if (process.platform !== "win32" && (info.mode & 0o077) !== 0)
-                throw new Error("local tool credential permissions must be owner-only");
-            const credential = (await readFile(tokenFile, "utf8")).trim();
-            if (credential.length < 32)
-                throw new Error("invalid local tool credential");
-            return { endpoint, credential };
-        },
+        resolveLocalToolConnection: () => readPrivateConnection(context, {
+            endpointFact: "localToolBridgeEndpoint",
+            tokenFileFact: "localToolHostTokenFile",
+        }),
+        resolveMonitorControlConnection: () => readPrivateConnection(context, {
+            endpointFact: "monitorControlEndpoint",
+            tokenFileFact: "monitorControlTokenFile",
+        }),
         resolveOwnerConnection: async (owner) => {
             const facts = await readModuleSharedFacts(context, owner === "execution" ? "execution-runtime" : "model-runtime");
             const baseUrl = factString(facts, "endpoint"), tokenFile = factString(facts, "transportCredentialFile");

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "platform-host";
     readonly packageName: "@tomflow/proflow-platform-host";
-    readonly moduleVersion: "0.1.29";
+    readonly moduleVersion: "0.1.31";
     readonly kind: "service";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "platform-host",
     packageName: "@tomflow/proflow-platform-host",
-    moduleVersion: "0.1.29",
+    moduleVersion: "0.1.31",
     kind: "service",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",

package/dist/src/browser-permission-context.js

@@ -21,9 +21,12 @@ export function resolveBrowserPermissionTaskBinding(input) {
                 binding.workerRef !== input.workerRef ||
                 binding.conversationLocator !== input.conversationLocator)
                 return null;
-            // The same durable Worker/Conversation may be reused by multiple Tasks.
-            // Exact duplicates strengthen the same identity; only disagreement is ambiguous.
-            match ??= binding;
+            // Worker/Conversation identity is Task-scoped. A second Task match is
+            // ambiguous even when every field is byte-identical; fail closed rather
+            // than authorizing a permission against the wrong Task occurrence.
+            if (match !== null)
+                return null;
+            match = binding;
         }
     }
     return match;

package/dist/src/index.d.ts

@@ -99,6 +99,10 @@ export type LocalToolConnectionResolver = () => Promise<{
     endpoint: string;
     credential: string;
 } | undefined>;
+export type MonitorControlConnectionResolver = () => Promise<{
+    endpoint: string;
+    credential: string;
+} | undefined>;
 export type PlatformHostBrowserOwnerPorts = {
     task: {
         getWorkerBinding(taskId: string, roleRef: string): Promise<{
@@ -232,6 +236,7 @@ export declare function createPlatformHost(input: {
     executionCredential?: string;
     resolveOwnerConnection?: OwnerConnectionResolver;
     resolveLocalToolConnection?: LocalToolConnectionResolver;
+    resolveMonitorControlConnection?: MonitorControlConnectionResolver;
 }): Readonly<{
     start: () => Promise<{
         host: string;