@zvec/zvec-grep 0.1.5 → 0.1.7

package/dist/authorization/planner.js

@@ -0,0 +1,97 @@
+import { createRemoteEmbeddingTarget } from "./target.js";
+import { RemoteEmbeddingAuthorizationStore } from "./store.js";
+export async function planRemoteIndexAuthorization(input) {
+    if (input.model.provider !== "qwen")
+        return undefined;
+    const needsEmbedding = input.rebuild === true ||
+        input.needsUpdate === true ||
+        !input.info.indexed ||
+        !indexStatusIsFresh(input.info);
+    if (!needsEmbedding)
+        return undefined;
+    const endpoint = input.model.endpoint;
+    if (endpoint === undefined) {
+        throw new Error(`Embedding model ${input.model.reference} did not provide a remote endpoint.`);
+    }
+    const target = await createRemoteEmbeddingTarget({
+        roots: workspaceRoots(input.info),
+        provider: input.model.provider,
+        model: input.model.name,
+        endpoint,
+    });
+    const store = input.store ?? new RemoteEmbeddingAuthorizationStore();
+    return {
+        operation: "index",
+        target,
+        disclosure: {
+            queryText: false,
+            workspaceContent: !input.info.indexed || input.rebuild ? "full" : "changed",
+        },
+        reason: input.rebuild
+            ? "index_rebuild"
+            : input.info.indexed
+                ? "index_update"
+                : "index_create",
+        grantPath: store.grantPath(target),
+    };
+}
+export async function planRemoteSearchAuthorization(input) {
+    const schema = input.info.workspaceIndex?.embedding;
+    if (!input.info.indexed || !schema || schema.provider !== "qwen") {
+        return undefined;
+    }
+    if (input.model.provider !== schema.provider ||
+        input.model.name !== schema.model) {
+        throw new Error(`Embedding model ${input.model.reference} does not match indexed model ${schema.provider}/${schema.model}.`);
+    }
+    const usesVector = searchUsesVector(input.search);
+    const needsUpdate = input.runtimeNeedsReconciliation === true ||
+        !indexStatusIsFresh(input.info);
+    const updatesIndex = needsUpdate &&
+        (input.search.autoUpdate || input.search.freshness === "wait_for_fresh");
+    if (!usesVector && !updatesIndex)
+        return undefined;
+    const endpoint = input.model.endpoint;
+    if (endpoint === undefined) {
+        throw new Error(`Embedding model ${input.model.reference} did not provide a remote endpoint.`);
+    }
+    const target = await createRemoteEmbeddingTarget({
+        roots: workspaceRoots(input.info),
+        provider: input.model.provider,
+        model: input.model.name,
+        endpoint,
+    });
+    const store = input.store ?? new RemoteEmbeddingAuthorizationStore();
+    return {
+        operation: usesVector
+            ? updatesIndex
+                ? "query_and_index"
+                : "query"
+            : "index",
+        target,
+        disclosure: {
+            queryText: usesVector,
+            workspaceContent: updatesIndex ? "changed" : "none",
+        },
+        reason: "query",
+        grantPath: store.grantPath(target),
+    };
+}
+export function searchUsesVector(input) {
+    return ((input.queries?.length ?? 0) > 0 ||
+        input.routes.some((route) => route.mode === "vector"));
+}
+export function indexStatusIsFresh(info) {
+    const status = info.status;
+    return Boolean(status &&
+        status.filesAdded === 0 &&
+        status.filesModified === 0 &&
+        status.filesDeleted === 0 &&
+        status.filesPending === 0 &&
+        status.filesFailed === 0);
+}
+function workspaceRoots(info) {
+    const roots = info.workspaceIndex?.rootPaths.map((root) => root.absolutePath) ?? [];
+    return roots.length > 0 ? roots : [info.root];
+}
+//# sourceMappingURL=planner.js.map

package/dist/authorization/planner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../src/authorization/planner.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAG/D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAMlD;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,cAAc,GAClB,KAAK,CAAC,OAAO,KAAK,IAAI;QACtB,KAAK,CAAC,WAAW,KAAK,IAAI;QAC1B,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;QACnB,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,KAAK,CAAC,SAAS,qCAAqC,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QACvB,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,iCAAiC,EAAE,CAAC;IACrE,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,MAAM;QACN,UAAU,EAAE;YACV,SAAS,EAAE,KAAK;YAChB,gBAAgB,EACd,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC5D;QACD,MAAM,EAAE,KAAK,CAAC,OAAO;YACnB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;gBAClB,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,cAAc;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACxC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,KAAK,CAAC,SAAS,iCAAiC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,WAAW,GACf,KAAK,CAAC,0BAA0B,KAAK,IAAI;QACzC,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAChB,WAAW;QACX,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,KAAK,CAAC,SAAS,qCAAqC,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QACvB,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,iCAAiC,EAAE,CAAC;IACrE,OAAO;QACL,SAAS,EAAE,UAAU;YACnB,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,OAAO;YACX,CAAC,CAAC,OAAO;QACX,MAAM;QACN,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SACpD;QACD,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAwD;IAExD,OAAO,CACL,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAChC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,OAAO,OAAO,CACZ,MAAM;QACN,MAAM,CAAC,UAAU,KAAK,CAAC;QACvB,MAAM,CAAC,aAAa,KAAK,CAAC;QAC1B,MAAM,CAAC,YAAY,KAAK,CAAC;QACzB,MAAM,CAAC,YAAY,KAAK,CAAC;QACzB,MAAM,CAAC,WAAW,KAAK,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,MAAM,KAAK,GACT,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/authorization/prompt.d.ts

@@ -0,0 +1,11 @@
+import type { RemoteEmbeddingDataDisclosure } from "./types.js";
+export type RemoteEmbeddingAuthorizationPromptInput = {
+    workspaceRoots: readonly string[];
+    provider: string;
+    model: string;
+    endpoint?: string;
+    data: readonly string[];
+    note?: string;
+};
+export declare function remoteEmbeddingDisclosureData(disclosure: RemoteEmbeddingDataDisclosure): string[];
+export declare function formatRemoteEmbeddingAuthorizationPrompt(input: RemoteEmbeddingAuthorizationPromptInput): string;

package/dist/authorization/prompt.js

@@ -0,0 +1,62 @@
+import { basename } from "node:path";
+export function remoteEmbeddingDisclosureData(disclosure) {
+    return [
+        ...(disclosure.queryText ? ["query text"] : []),
+        ...(disclosure.workspaceContent === "selected"
+            ? ["selected workspace files"]
+            : disclosure.workspaceContent === "changed"
+                ? ["changed workspace files"]
+                : disclosure.workspaceContent === "full"
+                    ? ["selected workspace files"]
+                    : []),
+    ];
+}
+export function formatRemoteEmbeddingAuthorizationPrompt(input) {
+    const data = naturalList(input.data.length > 0 ? input.data : ["data required by this operation"]);
+    const lines = [
+        "Remote Embedding authorization",
+        "",
+        `Send ${data}?`,
+        "",
+        `  From  ${workspaceLabel(input.workspaceRoots)}`,
+        `  To    ${clip(`${input.provider}/${input.model}`, 72)}`,
+    ];
+    const host = endpointHost(input.endpoint);
+    if (host)
+        lines.push(`        ${clip(host, 72)}`);
+    if (input.note)
+        lines.push("", input.note);
+    lines.push("", "API charges may apply.");
+    return lines.join("\n");
+}
+function workspaceLabel(roots) {
+    const names = roots.map((root) => clip(basename(root) || root || "workspace", 32));
+    if (names.length === 0)
+        return "workspace";
+    if (names.length <= 2)
+        return names.join(", ");
+    return `${names.slice(0, 2).join(", ")} +${names.length - 2}`;
+}
+function endpointHost(endpoint) {
+    if (!endpoint)
+        return undefined;
+    try {
+        return new URL(endpoint).host;
+    }
+    catch {
+        return endpoint.replace(/^https?:\/\//, "").split("/")[0] || undefined;
+    }
+}
+function naturalList(items) {
+    if (items.length <= 1)
+        return items[0] ?? "data";
+    if (items.length === 2)
+        return `${items[0]} and ${items[1]}`;
+    return `${items.slice(0, -1).join(", ")}, and ${items.at(-1)}`;
+}
+function clip(value, maxLength) {
+    if (value.length <= maxLength)
+        return value;
+    return `${value.slice(0, Math.max(1, maxLength - 1))}…`;
+}
+//# sourceMappingURL=prompt.js.map

package/dist/authorization/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/authorization/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAYrC,MAAM,UAAU,6BAA6B,CAC3C,UAAyC;IAEzC,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;YAC5C,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAC9B,CAAC,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAC7B,CAAC,CAAC,UAAU,CAAC,gBAAgB,KAAK,MAAM;oBACtC,CAAC,CAAC,CAAC,0BAA0B,CAAC;oBAC9B,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,KAA8C;IAE9C,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CACzE,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,gCAAgC;QAChC,EAAE;QACF,QAAQ,IAAI,GAAG;QACf,EAAE;QACF,WAAW,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;QACjD,WAAW,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE;KAC1D,CAAC;IACF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,KAAwB;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC,CAChD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,QAA4B;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB;IAC3C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC"}

package/dist/authorization/store.d.ts

@@ -0,0 +1,20 @@
+import { type RemoteEmbeddingAuthorizationStatus, type RemoteEmbeddingTarget, type RemoteEmbeddingWorkspaceGrant } from "./types.js";
+export type RemoteEmbeddingAuthorizationStoreOptions = {
+    signingKeyPath?: string;
+};
+export declare class RemoteEmbeddingAuthorizationStore {
+    private readonly signingKeyPath;
+    constructor(options?: RemoteEmbeddingAuthorizationStoreOptions);
+    grantPath(target: Pick<RemoteEmbeddingTarget, "workspaceRoots">): string;
+    hasGrant(target: RemoteEmbeddingTarget): Promise<boolean>;
+    grant(target: RemoteEmbeddingTarget): Promise<RemoteEmbeddingWorkspaceGrant>;
+    revoke(target: RemoteEmbeddingTarget): Promise<boolean>;
+    revokeAll(root: string): Promise<number>;
+    status(root: string): Promise<RemoteEmbeddingAuthorizationStatus>;
+    private readDocument;
+    private writeDocument;
+    private withDocumentWrite;
+    private verifyGrant;
+    private readSigningKey;
+    private getOrCreateSigningKey;
+}

package/dist/authorization/store.js

@@ -0,0 +1,251 @@
+import { createHmac, randomBytes, randomUUID, timingSafeEqual, } from "node:crypto";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { readJsonFile, writeJsonFile } from "../engine/utils/json.js";
+import { acquireReadWriteLock } from "../engine/utils/lock.js";
+import { REMOTE_EMBEDDING_CAPABILITY, } from "./types.js";
+const DOCUMENT_VERSION = 1;
+const GRANT_FILE = "authorization.json";
+export class RemoteEmbeddingAuthorizationStore {
+    signingKeyPath;
+    constructor(options = {}) {
+        this.signingKeyPath = resolve(options.signingKeyPath ??
+            process.env.ZVEC_GREP_AUTHORIZATION_KEY_FILE ??
+            join(homedir(), ".zvec-grep", "authorization-signing.key"));
+    }
+    grantPath(target) {
+        const root = target.workspaceRoots[0];
+        if (!root) {
+            throw new Error("Remote Embedding target has no workspace roots.");
+        }
+        return join(root, ".zvec-grep", GRANT_FILE);
+    }
+    async hasGrant(target) {
+        const key = await this.readSigningKey();
+        if (!key)
+            return false;
+        const document = await this.readDocument(this.grantPath(target));
+        return document.grants.some((grant) => grant.targetFingerprint === target.targetFingerprint &&
+            this.verifyGrant(grant, key));
+    }
+    async grant(target) {
+        const key = await this.getOrCreateSigningKey();
+        const unsigned = {
+            version: DOCUMENT_VERSION,
+            id: randomUUID(),
+            capability: REMOTE_EMBEDDING_CAPABILITY,
+            scope: "workspace",
+            workspaceRoots: [...target.workspaceRoots],
+            workspaceFingerprint: target.workspaceFingerprint,
+            provider: target.provider,
+            model: target.model,
+            endpoint: target.endpoint,
+            targetFingerprint: target.targetFingerprint,
+            grantedAt: Date.now(),
+        };
+        const grant = {
+            ...unsigned,
+            signature: sign(unsigned, key),
+        };
+        for (const root of target.workspaceRoots) {
+            const path = join(root, ".zvec-grep", GRANT_FILE);
+            await this.withDocumentWrite(path, async (document) => {
+                const next = {
+                    version: DOCUMENT_VERSION,
+                    grants: [
+                        ...document.grants.filter((candidate) => candidate.targetFingerprint !== target.targetFingerprint),
+                        grant,
+                    ],
+                };
+                await this.writeDocument(path, next);
+            });
+        }
+        return grant;
+    }
+    async revoke(target) {
+        let revoked = false;
+        for (const root of target.workspaceRoots) {
+            const path = join(root, ".zvec-grep", GRANT_FILE);
+            await this.withDocumentWrite(path, async (document) => {
+                const grants = document.grants.filter((grant) => grant.targetFingerprint !== target.targetFingerprint);
+                if (grants.length === document.grants.length)
+                    return;
+                revoked = true;
+                await this.writeDocument(path, {
+                    version: DOCUMENT_VERSION,
+                    grants,
+                });
+            });
+        }
+        return revoked;
+    }
+    async revokeAll(root) {
+        const path = join(resolve(root), ".zvec-grep", GRANT_FILE);
+        let revoked = 0;
+        let validGrants = [];
+        const key = await this.readSigningKey();
+        await this.withDocumentWrite(path, async (document) => {
+            revoked = document.grants.length;
+            if (revoked === 0)
+                return;
+            validGrants = key
+                ? document.grants.filter((grant) => this.verifyGrant(grant, key))
+                : [];
+            await this.writeDocument(path, {
+                version: DOCUMENT_VERSION,
+                grants: [],
+            });
+        });
+        const fingerprintsByPath = new Map();
+        for (const grant of validGrants) {
+            for (const workspaceRoot of grant.workspaceRoots) {
+                const grantPath = join(workspaceRoot, ".zvec-grep", GRANT_FILE);
+                if (resolve(grantPath) === resolve(path))
+                    continue;
+                const fingerprints = fingerprintsByPath.get(grantPath) ?? new Set();
+                fingerprints.add(grant.targetFingerprint);
+                fingerprintsByPath.set(grantPath, fingerprints);
+            }
+        }
+        for (const [grantPath, fingerprints] of fingerprintsByPath) {
+            await this.withDocumentWrite(grantPath, async (document) => {
+                const grants = document.grants.filter((grant) => !fingerprints.has(grant.targetFingerprint));
+                if (grants.length === document.grants.length)
+                    return;
+                await this.writeDocument(grantPath, {
+                    version: DOCUMENT_VERSION,
+                    grants,
+                });
+            });
+        }
+        return revoked;
+    }
+    async status(root) {
+        const path = join(resolve(root), ".zvec-grep", GRANT_FILE);
+        const document = await this.readDocument(path);
+        const key = await this.readSigningKey();
+        return {
+            path,
+            grants: document.grants.map(({ signature, ...grant }) => ({
+                ...grant,
+                valid: key ? this.verifyGrant({ ...grant, signature }, key) : false,
+            })),
+        };
+    }
+    async readDocument(path) {
+        const value = await readJsonFile(path, {
+            version: DOCUMENT_VERSION,
+            grants: [],
+        });
+        if (!isAuthorizationDocument(value)) {
+            return { version: DOCUMENT_VERSION, grants: [] };
+        }
+        return value;
+    }
+    async writeDocument(path, document) {
+        await writeJsonFile(path, document, {
+            directoryMode: 0o700,
+            fileMode: 0o600,
+        });
+    }
+    async withDocumentWrite(path, operation) {
+        const lock = acquireReadWriteLock(join(dirname(path), "authorization-store"), "write", { operation: "remote-embedding-authorization" });
+        try {
+            return await operation(await this.readDocument(path));
+        }
+        finally {
+            lock.release();
+        }
+    }
+    verifyGrant(grant, key) {
+        const { signature, ...unsigned } = grant;
+        const expected = sign(unsigned, key);
+        const actualBytes = Buffer.from(signature, "hex");
+        const expectedBytes = Buffer.from(expected, "hex");
+        return (actualBytes.length === expectedBytes.length &&
+            timingSafeEqual(actualBytes, expectedBytes));
+    }
+    async readSigningKey() {
+        try {
+            const value = (await readFile(this.signingKeyPath, "utf8")).trim();
+            return value ? Buffer.from(value, "hex") : undefined;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async getOrCreateSigningKey() {
+        const existing = await this.readSigningKey();
+        if (existing)
+            return existing;
+        await mkdir(dirname(this.signingKeyPath), { recursive: true, mode: 0o700 });
+        await chmod(dirname(this.signingKeyPath), 0o700);
+        const key = randomBytes(32);
+        try {
+            await writeFile(this.signingKeyPath, key.toString("hex"), {
+                encoding: "utf8",
+                mode: 0o600,
+                flag: "wx",
+            });
+            return key;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const concurrent = await this.readSigningKey();
+            if (!concurrent)
+                throw error;
+            return concurrent;
+        }
+    }
+}
+function sign(value, key) {
+    return createHmac("sha256", key).update(stableStringify(value)).digest("hex");
+}
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function isAuthorizationDocument(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const document = value;
+    if (document.version !== DOCUMENT_VERSION ||
+        !Array.isArray(document.grants)) {
+        return false;
+    }
+    return document.grants.every(isWorkspaceGrant);
+}
+function isWorkspaceGrant(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const grant = value;
+    return (grant.version === DOCUMENT_VERSION &&
+        grant.capability === REMOTE_EMBEDDING_CAPABILITY &&
+        grant.scope === "workspace" &&
+        Array.isArray(grant.workspaceRoots) &&
+        grant.workspaceRoots.every((root) => typeof root === "string") &&
+        [
+            "id",
+            "workspaceFingerprint",
+            "provider",
+            "model",
+            "endpoint",
+            "targetFingerprint",
+            "signature",
+        ].every((key) => typeof grant[key] === "string") &&
+        typeof grant.grantedAt === "number");
+}
+//# sourceMappingURL=store.js.map

package/dist/authorization/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/authorization/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,2BAA2B,GAK5B,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,CAAU,CAAC;AACpC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAMxC,MAAM,OAAO,iCAAiC;IAC3B,cAAc,CAAS;IAExC,YAAY,UAAoD,EAAE;QAChE,IAAI,CAAC,cAAc,GAAG,OAAO,CAC3B,OAAO,CAAC,cAAc;YACpB,OAAO,CAAC,GAAG,CAAC,gCAAgC;YAC5C,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,MAAqD;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAA6B;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;YACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAA6B;QAE7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,gBAAgB;YACzB,EAAE,EAAE,UAAU,EAAE;YAChB,UAAU,EAAE,2BAA2B;YACvC,KAAK,EAAE,WAAoB;YAC3B,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;YAC1C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,KAAK,GAAkC;YAC3C,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC/B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,IAAI,GAAyC;oBACjD,OAAO,EAAE,gBAAgB;oBACzB,MAAM,EAAE;wBACN,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACvB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,CAC3D;wBACD,KAAK;qBACN;iBACF,CAAC;gBACF,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA6B;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,CAChE,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO;gBACrD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,WAAW,GAAoC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpD,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YACjC,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO;YAC1B,WAAW,GAAG,GAAG;gBACf,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;gBAC7B,OAAO,EAAE,gBAAgB;gBACzB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACjD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACpE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CACtD,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO;gBACrD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;oBAClC,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,GAAG,KAAK;gBACR,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK;aACpE,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAU,IAAI,EAAE;YAC9C,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,IAAY,EACZ,QAA8C;QAE9C,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE;YAClC,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,IAAY,EACZ,SAAyE;QAEzE,MAAM,IAAI,GAAG,oBAAoB,CAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,EAC1C,OAAO,EACP,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAChD,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,WAAW,CACjB,KAAoC,EACpC,GAAW;QAEX,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CACL,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;YAC3C,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBACxD,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU;gBAAE,MAAM,KAAK,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IACE,QAAQ,CAAC,OAAO,KAAK,gBAAgB;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACL,KAAK,CAAC,OAAO,KAAK,gBAAgB;QAClC,KAAK,CAAC,UAAU,KAAK,2BAA2B;QAChD,KAAK,CAAC,KAAK,KAAK,WAAW;QAC3B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC9D;YACE,IAAI;YACJ,sBAAsB;YACtB,UAAU;YACV,OAAO;YACP,UAAU;YACV,mBAAmB;YACnB,WAAW;SACZ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QAChD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC"}

package/dist/authorization/target.d.ts

@@ -0,0 +1,15 @@
+import type { RemoteEmbeddingTarget } from "./types.js";
+export declare function canonicalizeWorkspaceRoots(roots: readonly string[]): Promise<string[]>;
+export declare function workspaceFingerprint(roots: readonly string[]): string;
+export declare function remoteEmbeddingTargetFingerprint(input: {
+    workspaceFingerprint: string;
+    provider: string;
+    model: string;
+    endpoint: string;
+}): string;
+export declare function createRemoteEmbeddingTarget(input: {
+    roots: readonly string[];
+    provider: string;
+    model: string;
+    endpoint: string;
+}): Promise<RemoteEmbeddingTarget>;

package/dist/authorization/target.js

@@ -0,0 +1,49 @@
+import { createHash } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { resolve } from "node:path";
+export async function canonicalizeWorkspaceRoots(roots) {
+    const canonical = await Promise.all(roots.map(async (root) => {
+        const absolute = resolve(root);
+        return await realpath(absolute).catch(() => absolute);
+    }));
+    return [...new Set(canonical)].sort();
+}
+export function workspaceFingerprint(roots) {
+    return sha256(JSON.stringify([...roots]));
+}
+export function remoteEmbeddingTargetFingerprint(input) {
+    return sha256(JSON.stringify([
+        input.workspaceFingerprint,
+        input.provider,
+        input.model,
+        input.endpoint,
+    ]));
+}
+export async function createRemoteEmbeddingTarget(input) {
+    const workspaceRoots = await canonicalizeWorkspaceRoots(input.roots);
+    if (workspaceRoots.length === 0) {
+        throw new Error("Remote Embedding authorization requires a workspace root.");
+    }
+    const endpoint = input.endpoint.trim();
+    if (endpoint.length === 0) {
+        throw new Error("Remote Embedding authorization requires an endpoint.");
+    }
+    const rootFingerprint = workspaceFingerprint(workspaceRoots);
+    return {
+        workspaceRoots,
+        workspaceFingerprint: rootFingerprint,
+        provider: input.provider,
+        model: input.model,
+        endpoint,
+        targetFingerprint: remoteEmbeddingTargetFingerprint({
+            workspaceFingerprint: rootFingerprint,
+            provider: input.provider,
+            model: input.model,
+            endpoint,
+        }),
+    };
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+//# sourceMappingURL=target.js.map

package/dist/authorization/target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/authorization/target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAwB;IAExB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAKhD;IACC,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,QAAQ;KACf,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC7D,OAAO;QACL,cAAc;QACd,oBAAoB,EAAE,eAAe;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,iBAAiB,EAAE,gCAAgC,CAAC;YAClD,oBAAoB,EAAE,eAAe;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;SACT,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/authorization/types.d.ts

@@ -0,0 +1,61 @@
+export declare const REMOTE_EMBEDDING_CAPABILITY: "remote_embedding";
+export type RemoteEmbeddingAuthorizationScope = "once" | "workspace";
+export type RemoteEmbeddingOperation = "query" | "index" | "query_and_index";
+export type RemoteEmbeddingDataDisclosure = {
+    queryText: boolean;
+    workspaceContent: "none" | "selected" | "changed" | "full";
+};
+export type RemoteEmbeddingTarget = {
+    workspaceRoots: readonly string[];
+    workspaceFingerprint: string;
+    provider: string;
+    model: string;
+    endpoint: string;
+    targetFingerprint: string;
+};
+export type RemoteEmbeddingRequest = {
+    provider: string;
+    model: string;
+    endpoint: string;
+    purpose: "document" | "query";
+    contentKinds: readonly ("text" | "image")[];
+    contentCount: number;
+};
+export type RemoteEmbeddingAuthorizationPlan = {
+    operation: RemoteEmbeddingOperation;
+    target: RemoteEmbeddingTarget;
+    disclosure: RemoteEmbeddingDataDisclosure;
+    reason: "query" | "index_create" | "index_update" | "index_rebuild";
+    grantPath: string;
+};
+export type RemoteEmbeddingOperationPermit = {
+    capability: typeof REMOTE_EMBEDDING_CAPABILITY;
+    scope: RemoteEmbeddingAuthorizationScope;
+    target: RemoteEmbeddingTarget;
+    issuedAt: number;
+    operationId: string;
+};
+export type RemoteEmbeddingWorkspaceGrant = {
+    version: 1;
+    id: string;
+    capability: typeof REMOTE_EMBEDDING_CAPABILITY;
+    scope: "workspace";
+    workspaceRoots: string[];
+    workspaceFingerprint: string;
+    provider: string;
+    model: string;
+    endpoint: string;
+    targetFingerprint: string;
+    grantedAt: number;
+    signature: string;
+};
+export type RemoteEmbeddingAuthorizationDocument = {
+    version: 1;
+    grants: RemoteEmbeddingWorkspaceGrant[];
+};
+export type RemoteEmbeddingAuthorizationStatus = {
+    path: string;
+    grants: Array<Omit<RemoteEmbeddingWorkspaceGrant, "signature"> & {
+        valid: boolean;
+    }>;
+};

package/dist/authorization/types.js

@@ -0,0 +1,2 @@
+export const REMOTE_EMBEDDING_CAPABILITY = "remote_embedding";
+//# sourceMappingURL=types.js.map

package/dist/authorization/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAA2B,CAAC"}

package/dist/cli/args.d.ts

@@ -1,5 +1,5 @@
 import type { ParsedArgs } from "./types.js";
 export declare function parseArgs(args: readonly string[]): ParsedArgs;
-export declare function parseLlamaGpu(value: string): "auto" | "metal" | "vulkan" | "cuda" | false;
+export declare function parseDevice(value: string): "auto" | "cpu" | "metal" | "vulkan" | "cuda";
 export declare function splitPathFilters(value: string): string[];
 export declare function parseModifiedTime(value: string, option: string): number;