@zvec/zvec-grep 0.2.1 → 0.3.0-rc.1

package/dist/authorization/planner.js

@@ -1,97 +0,0 @@
-import { createRemoteEmbeddingTarget } from "./target.js";
-import { RemoteEmbeddingAuthorizationStore } from "./store.js";
-export async function planRemoteIndexAuthorization(input) {
-    if (input.model.provider !== "qwen")
-        return undefined;
-    const needsEmbedding = input.rebuild === true ||
-        input.needsUpdate === true ||
-        !input.info.indexed ||
-        !indexStatusIsFresh(input.info);
-    if (!needsEmbedding)
-        return undefined;
-    const endpoint = input.model.endpoint;
-    if (endpoint === undefined) {
-        throw new Error(`Embedding model ${input.model.reference} did not provide a remote endpoint.`);
-    }
-    const target = await createRemoteEmbeddingTarget({
-        roots: workspaceRoots(input.info),
-        provider: input.model.provider,
-        model: input.model.name,
-        endpoint,
-    });
-    const store = input.store ?? new RemoteEmbeddingAuthorizationStore();
-    return {
-        operation: "index",
-        target,
-        disclosure: {
-            queryText: false,
-            workspaceContent: !input.info.indexed || input.rebuild ? "full" : "changed",
-        },
-        reason: input.rebuild
-            ? "index_rebuild"
-            : input.info.indexed
-                ? "index_update"
-                : "index_create",
-        grantPath: store.grantPath(target),
-    };
-}
-export async function planRemoteSearchAuthorization(input) {
-    const schema = input.info.workspaceIndex?.embedding;
-    if (!input.info.indexed || !schema || schema.provider !== "qwen") {
-        return undefined;
-    }
-    if (input.model.provider !== schema.provider ||
-        input.model.name !== schema.model) {
-        throw new Error(`Embedding model ${input.model.reference} does not match indexed model ${schema.provider}/${schema.model}.`);
-    }
-    const usesVector = searchUsesVector(input.search);
-    const needsUpdate = input.runtimeNeedsReconciliation === true ||
-        !indexStatusIsFresh(input.info);
-    const updatesIndex = needsUpdate &&
-        (input.search.autoUpdate || input.search.freshness === "wait_for_fresh");
-    if (!usesVector && !updatesIndex)
-        return undefined;
-    const endpoint = input.model.endpoint;
-    if (endpoint === undefined) {
-        throw new Error(`Embedding model ${input.model.reference} did not provide a remote endpoint.`);
-    }
-    const target = await createRemoteEmbeddingTarget({
-        roots: workspaceRoots(input.info),
-        provider: input.model.provider,
-        model: input.model.name,
-        endpoint,
-    });
-    const store = input.store ?? new RemoteEmbeddingAuthorizationStore();
-    return {
-        operation: usesVector
-            ? updatesIndex
-                ? "query_and_index"
-                : "query"
-            : "index",
-        target,
-        disclosure: {
-            queryText: usesVector,
-            workspaceContent: updatesIndex ? "changed" : "none",
-        },
-        reason: "query",
-        grantPath: store.grantPath(target),
-    };
-}
-export function searchUsesVector(input) {
-    return ((input.queries?.length ?? 0) > 0 ||
-        input.routes.some((route) => route.mode === "vector"));
-}
-export function indexStatusIsFresh(info) {
-    const status = info.status;
-    return Boolean(status &&
-        status.filesAdded === 0 &&
-        status.filesModified === 0 &&
-        status.filesDeleted === 0 &&
-        status.filesPending === 0 &&
-        status.filesFailed === 0);
-}
-function workspaceRoots(info) {
-    const roots = info.workspaceIndex?.rootPaths.map((root) => root.absolutePath) ?? [];
-    return roots.length > 0 ? roots : [info.root];
-}
-//# sourceMappingURL=planner.js.map

package/dist/authorization/planner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../src/authorization/planner.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAG/D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAMlD;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,cAAc,GAClB,KAAK,CAAC,OAAO,KAAK,IAAI;QACtB,KAAK,CAAC,WAAW,KAAK,IAAI;QAC1B,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;QACnB,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,KAAK,CAAC,SAAS,qCAAqC,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QACvB,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,iCAAiC,EAAE,CAAC;IACrE,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,MAAM;QACN,UAAU,EAAE;YACV,SAAS,EAAE,KAAK;YAChB,gBAAgB,EACd,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC5D;QACD,MAAM,EAAE,KAAK,CAAC,OAAO;YACnB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;gBAClB,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,cAAc;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAMnD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACxC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,KAAK,CAAC,SAAS,iCAAiC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,WAAW,GACf,KAAK,CAAC,0BAA0B,KAAK,IAAI;QACzC,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAChB,WAAW;QACX,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,KAAK,CAAC,SAAS,qCAAqC,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QACvB,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,iCAAiC,EAAE,CAAC;IACrE,OAAO;QACL,SAAS,EAAE,UAAU;YACnB,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,OAAO;YACX,CAAC,CAAC,OAAO;QACX,MAAM;QACN,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SACpD;QACD,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAwD;IAExD,OAAO,CACL,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAChC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,OAAO,OAAO,CACZ,MAAM;QACN,MAAM,CAAC,UAAU,KAAK,CAAC;QACvB,MAAM,CAAC,aAAa,KAAK,CAAC;QAC1B,MAAM,CAAC,YAAY,KAAK,CAAC;QACzB,MAAM,CAAC,YAAY,KAAK,CAAC;QACzB,MAAM,CAAC,WAAW,KAAK,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,MAAM,KAAK,GACT,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/authorization/prompt.d.ts

@@ -1,12 +0,0 @@
-import type { RemoteEmbeddingDataDisclosure } from "./types.js";
-export type RemoteEmbeddingAuthorizationPromptInput = {
-    workspaceRoots: readonly string[];
-    provider: string;
-    model: string;
-    endpoint?: string;
-    data: readonly string[];
-    note?: string;
-};
-export declare const REMOTE_EMBEDDING_ELICITATION_UNSUPPORTED_MESSAGE = "The connected MCP host does not support the Remote Embedding authorization interaction required by elicitation/create. The agent should use the current host's built-in user-question tool; for Qoder, the exact name is ask_user_question in Qoder IDE or AskUserQuestion in Qoder CLI/SDK. Ask the user to choose: allow Remote Embedding for this workspace, use local FTS only, or cancel. No user decision was received, and no remote data was sent.";
-export declare function remoteEmbeddingDisclosureData(disclosure: RemoteEmbeddingDataDisclosure): string[];
-export declare function formatRemoteEmbeddingAuthorizationPrompt(input: RemoteEmbeddingAuthorizationPromptInput): string;

package/dist/authorization/prompt.js

@@ -1,63 +0,0 @@
-import { basename } from "node:path";
-export const REMOTE_EMBEDDING_ELICITATION_UNSUPPORTED_MESSAGE = "The connected MCP host does not support the Remote Embedding authorization interaction required by elicitation/create. The agent should use the current host's built-in user-question tool; for Qoder, the exact name is ask_user_question in Qoder IDE or AskUserQuestion in Qoder CLI/SDK. Ask the user to choose: allow Remote Embedding for this workspace, use local FTS only, or cancel. No user decision was received, and no remote data was sent.";
-export function remoteEmbeddingDisclosureData(disclosure) {
-    return [
-        ...(disclosure.queryText ? ["query text"] : []),
-        ...(disclosure.workspaceContent === "selected"
-            ? ["selected workspace files"]
-            : disclosure.workspaceContent === "changed"
-                ? ["changed workspace files"]
-                : disclosure.workspaceContent === "full"
-                    ? ["selected workspace files"]
-                    : []),
-    ];
-}
-export function formatRemoteEmbeddingAuthorizationPrompt(input) {
-    const data = naturalList(input.data.length > 0 ? input.data : ["data required by this operation"]);
-    const lines = [
-        "Remote Embedding authorization",
-        "",
-        `Send ${data}?`,
-        "",
-        `  From  ${workspaceLabel(input.workspaceRoots)}`,
-        `  To    ${clip(`${input.provider}/${input.model}`, 72)}`,
-    ];
-    const host = endpointHost(input.endpoint);
-    if (host)
-        lines.push(`        ${clip(host, 72)}`);
-    if (input.note)
-        lines.push("", input.note);
-    lines.push("", "API charges may apply.");
-    return lines.join("\n");
-}
-function workspaceLabel(roots) {
-    const names = roots.map((root) => clip(basename(root) || root || "workspace", 32));
-    if (names.length === 0)
-        return "workspace";
-    if (names.length <= 2)
-        return names.join(", ");
-    return `${names.slice(0, 2).join(", ")} +${names.length - 2}`;
-}
-function endpointHost(endpoint) {
-    if (!endpoint)
-        return undefined;
-    try {
-        return new URL(endpoint).host;
-    }
-    catch {
-        return endpoint.replace(/^https?:\/\//, "").split("/")[0] || undefined;
-    }
-}
-function naturalList(items) {
-    if (items.length <= 1)
-        return items[0] ?? "data";
-    if (items.length === 2)
-        return `${items[0]} and ${items[1]}`;
-    return `${items.slice(0, -1).join(", ")}, and ${items.at(-1)}`;
-}
-function clip(value, maxLength) {
-    if (value.length <= maxLength)
-        return value;
-    return `${value.slice(0, Math.max(1, maxLength - 1))}…`;
-}
-//# sourceMappingURL=prompt.js.map

package/dist/authorization/prompt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/authorization/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAYrC,MAAM,CAAC,MAAM,gDAAgD,GAC3D,4bAA4b,CAAC;AAE/b,MAAM,UAAU,6BAA6B,CAC3C,UAAyC;IAEzC,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;YAC5C,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAC9B,CAAC,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAC7B,CAAC,CAAC,UAAU,CAAC,gBAAgB,KAAK,MAAM;oBACtC,CAAC,CAAC,CAAC,0BAA0B,CAAC;oBAC9B,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,KAA8C;IAE9C,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CACzE,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,gCAAgC;QAChC,EAAE;QACF,QAAQ,IAAI,GAAG;QACf,EAAE;QACF,WAAW,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;QACjD,WAAW,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE;KAC1D,CAAC;IACF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,KAAwB;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC,CAChD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,QAA4B;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB;IAC3C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC"}

package/dist/authorization/store.d.ts

@@ -1,20 +0,0 @@
-import { type RemoteEmbeddingAuthorizationStatus, type RemoteEmbeddingTarget, type RemoteEmbeddingWorkspaceGrant } from "./types.js";
-export type RemoteEmbeddingAuthorizationStoreOptions = {
-    signingKeyPath?: string;
-};
-export declare class RemoteEmbeddingAuthorizationStore {
-    private readonly signingKeyPath;
-    constructor(options?: RemoteEmbeddingAuthorizationStoreOptions);
-    grantPath(target: Pick<RemoteEmbeddingTarget, "workspaceRoots">): string;
-    hasGrant(target: RemoteEmbeddingTarget): Promise<boolean>;
-    grant(target: RemoteEmbeddingTarget): Promise<RemoteEmbeddingWorkspaceGrant>;
-    revoke(target: RemoteEmbeddingTarget): Promise<boolean>;
-    revokeAll(root: string): Promise<number>;
-    status(root: string): Promise<RemoteEmbeddingAuthorizationStatus>;
-    private readDocument;
-    private writeDocument;
-    private withDocumentWrite;
-    private verifyGrant;
-    private readSigningKey;
-    private getOrCreateSigningKey;
-}

package/dist/authorization/store.js

@@ -1,251 +0,0 @@
-import { createHmac, randomBytes, randomUUID, timingSafeEqual, } from "node:crypto";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { readJsonFile, writeJsonFile } from "../engine/utils/json.js";
-import { acquireReadWriteLock } from "../engine/utils/lock.js";
-import { REMOTE_EMBEDDING_CAPABILITY, } from "./types.js";
-const DOCUMENT_VERSION = 1;
-const GRANT_FILE = "authorization.json";
-export class RemoteEmbeddingAuthorizationStore {
-    signingKeyPath;
-    constructor(options = {}) {
-        this.signingKeyPath = resolve(options.signingKeyPath ??
-            process.env.ZVEC_GREP_AUTHORIZATION_KEY_FILE ??
-            join(homedir(), ".zvec-grep", "authorization-signing.key"));
-    }
-    grantPath(target) {
-        const root = target.workspaceRoots[0];
-        if (!root) {
-            throw new Error("Remote Embedding target has no workspace roots.");
-        }
-        return join(root, ".zvec-grep", GRANT_FILE);
-    }
-    async hasGrant(target) {
-        const key = await this.readSigningKey();
-        if (!key)
-            return false;
-        const document = await this.readDocument(this.grantPath(target));
-        return document.grants.some((grant) => grant.targetFingerprint === target.targetFingerprint &&
-            this.verifyGrant(grant, key));
-    }
-    async grant(target) {
-        const key = await this.getOrCreateSigningKey();
-        const unsigned = {
-            version: DOCUMENT_VERSION,
-            id: randomUUID(),
-            capability: REMOTE_EMBEDDING_CAPABILITY,
-            scope: "workspace",
-            workspaceRoots: [...target.workspaceRoots],
-            workspaceFingerprint: target.workspaceFingerprint,
-            provider: target.provider,
-            model: target.model,
-            endpoint: target.endpoint,
-            targetFingerprint: target.targetFingerprint,
-            grantedAt: Date.now(),
-        };
-        const grant = {
-            ...unsigned,
-            signature: sign(unsigned, key),
-        };
-        for (const root of target.workspaceRoots) {
-            const path = join(root, ".zvec-grep", GRANT_FILE);
-            await this.withDocumentWrite(path, async (document) => {
-                const next = {
-                    version: DOCUMENT_VERSION,
-                    grants: [
-                        ...document.grants.filter((candidate) => candidate.targetFingerprint !== target.targetFingerprint),
-                        grant,
-                    ],
-                };
-                await this.writeDocument(path, next);
-            });
-        }
-        return grant;
-    }
-    async revoke(target) {
-        let revoked = false;
-        for (const root of target.workspaceRoots) {
-            const path = join(root, ".zvec-grep", GRANT_FILE);
-            await this.withDocumentWrite(path, async (document) => {
-                const grants = document.grants.filter((grant) => grant.targetFingerprint !== target.targetFingerprint);
-                if (grants.length === document.grants.length)
-                    return;
-                revoked = true;
-                await this.writeDocument(path, {
-                    version: DOCUMENT_VERSION,
-                    grants,
-                });
-            });
-        }
-        return revoked;
-    }
-    async revokeAll(root) {
-        const path = join(resolve(root), ".zvec-grep", GRANT_FILE);
-        let revoked = 0;
-        let validGrants = [];
-        const key = await this.readSigningKey();
-        await this.withDocumentWrite(path, async (document) => {
-            revoked = document.grants.length;
-            if (revoked === 0)
-                return;
-            validGrants = key
-                ? document.grants.filter((grant) => this.verifyGrant(grant, key))
-                : [];
-            await this.writeDocument(path, {
-                version: DOCUMENT_VERSION,
-                grants: [],
-            });
-        });
-        const fingerprintsByPath = new Map();
-        for (const grant of validGrants) {
-            for (const workspaceRoot of grant.workspaceRoots) {
-                const grantPath = join(workspaceRoot, ".zvec-grep", GRANT_FILE);
-                if (resolve(grantPath) === resolve(path))
-                    continue;
-                const fingerprints = fingerprintsByPath.get(grantPath) ?? new Set();
-                fingerprints.add(grant.targetFingerprint);
-                fingerprintsByPath.set(grantPath, fingerprints);
-            }
-        }
-        for (const [grantPath, fingerprints] of fingerprintsByPath) {
-            await this.withDocumentWrite(grantPath, async (document) => {
-                const grants = document.grants.filter((grant) => !fingerprints.has(grant.targetFingerprint));
-                if (grants.length === document.grants.length)
-                    return;
-                await this.writeDocument(grantPath, {
-                    version: DOCUMENT_VERSION,
-                    grants,
-                });
-            });
-        }
-        return revoked;
-    }
-    async status(root) {
-        const path = join(resolve(root), ".zvec-grep", GRANT_FILE);
-        const document = await this.readDocument(path);
-        const key = await this.readSigningKey();
-        return {
-            path,
-            grants: document.grants.map(({ signature, ...grant }) => ({
-                ...grant,
-                valid: key ? this.verifyGrant({ ...grant, signature }, key) : false,
-            })),
-        };
-    }
-    async readDocument(path) {
-        const value = await readJsonFile(path, {
-            version: DOCUMENT_VERSION,
-            grants: [],
-        });
-        if (!isAuthorizationDocument(value)) {
-            return { version: DOCUMENT_VERSION, grants: [] };
-        }
-        return value;
-    }
-    async writeDocument(path, document) {
-        await writeJsonFile(path, document, {
-            directoryMode: 0o700,
-            fileMode: 0o600,
-        });
-    }
-    async withDocumentWrite(path, operation) {
-        const lock = acquireReadWriteLock(join(dirname(path), "authorization-store"), "write", { operation: "remote-embedding-authorization" });
-        try {
-            return await operation(await this.readDocument(path));
-        }
-        finally {
-            lock.release();
-        }
-    }
-    verifyGrant(grant, key) {
-        const { signature, ...unsigned } = grant;
-        const expected = sign(unsigned, key);
-        const actualBytes = Buffer.from(signature, "hex");
-        const expectedBytes = Buffer.from(expected, "hex");
-        return (actualBytes.length === expectedBytes.length &&
-            timingSafeEqual(actualBytes, expectedBytes));
-    }
-    async readSigningKey() {
-        try {
-            const value = (await readFile(this.signingKeyPath, "utf8")).trim();
-            return value ? Buffer.from(value, "hex") : undefined;
-        }
-        catch (error) {
-            if (error.code === "ENOENT")
-                return undefined;
-            throw error;
-        }
-    }
-    async getOrCreateSigningKey() {
-        const existing = await this.readSigningKey();
-        if (existing)
-            return existing;
-        await mkdir(dirname(this.signingKeyPath), { recursive: true, mode: 0o700 });
-        await chmod(dirname(this.signingKeyPath), 0o700);
-        const key = randomBytes(32);
-        try {
-            await writeFile(this.signingKeyPath, key.toString("hex"), {
-                encoding: "utf8",
-                mode: 0o600,
-                flag: "wx",
-            });
-            return key;
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            const concurrent = await this.readSigningKey();
-            if (!concurrent)
-                throw error;
-            return concurrent;
-        }
-    }
-}
-function sign(value, key) {
-    return createHmac("sha256", key).update(stableStringify(value)).digest("hex");
-}
-function stableStringify(value) {
-    if (Array.isArray(value)) {
-        return `[${value.map(stableStringify).join(",")}]`;
-    }
-    if (value && typeof value === "object") {
-        const record = value;
-        return `{${Object.keys(record)
-            .sort()
-            .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`)
-            .join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
-function isAuthorizationDocument(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const document = value;
-    if (document.version !== DOCUMENT_VERSION ||
-        !Array.isArray(document.grants)) {
-        return false;
-    }
-    return document.grants.every(isWorkspaceGrant);
-}
-function isWorkspaceGrant(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const grant = value;
-    return (grant.version === DOCUMENT_VERSION &&
-        grant.capability === REMOTE_EMBEDDING_CAPABILITY &&
-        grant.scope === "workspace" &&
-        Array.isArray(grant.workspaceRoots) &&
-        grant.workspaceRoots.every((root) => typeof root === "string") &&
-        [
-            "id",
-            "workspaceFingerprint",
-            "provider",
-            "model",
-            "endpoint",
-            "targetFingerprint",
-            "signature",
-        ].every((key) => typeof grant[key] === "string") &&
-        typeof grant.grantedAt === "number");
-}
-//# sourceMappingURL=store.js.map

package/dist/authorization/store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/authorization/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,2BAA2B,GAK5B,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,CAAU,CAAC;AACpC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAMxC,MAAM,OAAO,iCAAiC;IAC3B,cAAc,CAAS;IAExC,YAAY,UAAoD,EAAE;QAChE,IAAI,CAAC,cAAc,GAAG,OAAO,CAC3B,OAAO,CAAC,cAAc;YACpB,OAAO,CAAC,GAAG,CAAC,gCAAgC;YAC5C,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,MAAqD;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAA6B;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;YACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAA6B;QAE7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,gBAAgB;YACzB,EAAE,EAAE,UAAU,EAAE;YAChB,UAAU,EAAE,2BAA2B;YACvC,KAAK,EAAE,WAAoB;YAC3B,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;YAC1C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,KAAK,GAAkC;YAC3C,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC/B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,IAAI,GAAyC;oBACjD,OAAO,EAAE,gBAAgB;oBACzB,MAAM,EAAE;wBACN,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACvB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,CAC3D;wBACD,KAAK;qBACN;iBACF,CAAC;gBACF,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA6B;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,CAChE,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO;gBACrD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,WAAW,GAAoC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpD,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YACjC,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO;YAC1B,WAAW,GAAG,GAAG;gBACf,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;gBAC7B,OAAO,EAAE,gBAAgB;gBACzB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACjD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACpE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CACtD,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO;gBACrD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;oBAClC,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,GAAG,KAAK;gBACR,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK;aACpE,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAU,IAAI,EAAE;YAC9C,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,IAAY,EACZ,QAA8C;QAE9C,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE;YAClC,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,IAAY,EACZ,SAAyE;QAEzE,MAAM,IAAI,GAAG,oBAAoB,CAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,EAC1C,OAAO,EACP,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAChD,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,WAAW,CACjB,KAAoC,EACpC,GAAW;QAEX,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CACL,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;YAC3C,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBACxD,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU;gBAAE,MAAM,KAAK,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IACE,QAAQ,CAAC,OAAO,KAAK,gBAAgB;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACL,KAAK,CAAC,OAAO,KAAK,gBAAgB;QAClC,KAAK,CAAC,UAAU,KAAK,2BAA2B;QAChD,KAAK,CAAC,KAAK,KAAK,WAAW;QAC3B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC9D;YACE,IAAI;YACJ,sBAAsB;YACtB,UAAU;YACV,OAAO;YACP,UAAU;YACV,mBAAmB;YACnB,WAAW;SACZ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QAChD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC"}

package/dist/authorization/target.d.ts

@@ -1,15 +0,0 @@
-import type { RemoteEmbeddingTarget } from "./types.js";
-export declare function canonicalizeWorkspaceRoots(roots: readonly string[]): Promise<string[]>;
-export declare function workspaceFingerprint(roots: readonly string[]): string;
-export declare function remoteEmbeddingTargetFingerprint(input: {
-    workspaceFingerprint: string;
-    provider: string;
-    model: string;
-    endpoint: string;
-}): string;
-export declare function createRemoteEmbeddingTarget(input: {
-    roots: readonly string[];
-    provider: string;
-    model: string;
-    endpoint: string;
-}): Promise<RemoteEmbeddingTarget>;

package/dist/authorization/target.js

@@ -1,49 +0,0 @@
-import { createHash } from "node:crypto";
-import { realpath } from "node:fs/promises";
-import { resolve } from "node:path";
-export async function canonicalizeWorkspaceRoots(roots) {
-    const canonical = await Promise.all(roots.map(async (root) => {
-        const absolute = resolve(root);
-        return await realpath(absolute).catch(() => absolute);
-    }));
-    return [...new Set(canonical)].sort();
-}
-export function workspaceFingerprint(roots) {
-    return sha256(JSON.stringify([...roots]));
-}
-export function remoteEmbeddingTargetFingerprint(input) {
-    return sha256(JSON.stringify([
-        input.workspaceFingerprint,
-        input.provider,
-        input.model,
-        input.endpoint,
-    ]));
-}
-export async function createRemoteEmbeddingTarget(input) {
-    const workspaceRoots = await canonicalizeWorkspaceRoots(input.roots);
-    if (workspaceRoots.length === 0) {
-        throw new Error("Remote Embedding authorization requires a workspace root.");
-    }
-    const endpoint = input.endpoint.trim();
-    if (endpoint.length === 0) {
-        throw new Error("Remote Embedding authorization requires an endpoint.");
-    }
-    const rootFingerprint = workspaceFingerprint(workspaceRoots);
-    return {
-        workspaceRoots,
-        workspaceFingerprint: rootFingerprint,
-        provider: input.provider,
-        model: input.model,
-        endpoint,
-        targetFingerprint: remoteEmbeddingTargetFingerprint({
-            workspaceFingerprint: rootFingerprint,
-            provider: input.provider,
-            model: input.model,
-            endpoint,
-        }),
-    };
-}
-function sha256(value) {
-    return createHash("sha256").update(value).digest("hex");
-}
-//# sourceMappingURL=target.js.map

package/dist/authorization/target.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/authorization/target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAwB;IAExB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAKhD;IACC,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,QAAQ;KACf,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC7D,OAAO;QACL,cAAc;QACd,oBAAoB,EAAE,eAAe;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,iBAAiB,EAAE,gCAAgC,CAAC;YAClD,oBAAoB,EAAE,eAAe;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;SACT,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/authorization/types.d.ts

@@ -1,61 +0,0 @@
-export declare const REMOTE_EMBEDDING_CAPABILITY: "remote_embedding";
-export type RemoteEmbeddingAuthorizationScope = "once" | "workspace";
-export type RemoteEmbeddingOperation = "query" | "index" | "query_and_index";
-export type RemoteEmbeddingDataDisclosure = {
-    queryText: boolean;
-    workspaceContent: "none" | "selected" | "changed" | "full";
-};
-export type RemoteEmbeddingTarget = {
-    workspaceRoots: readonly string[];
-    workspaceFingerprint: string;
-    provider: string;
-    model: string;
-    endpoint: string;
-    targetFingerprint: string;
-};
-export type RemoteEmbeddingRequest = {
-    provider: string;
-    model: string;
-    endpoint: string;
-    purpose: "document" | "query";
-    contentKinds: readonly ("text" | "image")[];
-    contentCount: number;
-};
-export type RemoteEmbeddingAuthorizationPlan = {
-    operation: RemoteEmbeddingOperation;
-    target: RemoteEmbeddingTarget;
-    disclosure: RemoteEmbeddingDataDisclosure;
-    reason: "query" | "index_create" | "index_update" | "index_rebuild";
-    grantPath: string;
-};
-export type RemoteEmbeddingOperationPermit = {
-    capability: typeof REMOTE_EMBEDDING_CAPABILITY;
-    scope: RemoteEmbeddingAuthorizationScope;
-    target: RemoteEmbeddingTarget;
-    issuedAt: number;
-    operationId: string;
-};
-export type RemoteEmbeddingWorkspaceGrant = {
-    version: 1;
-    id: string;
-    capability: typeof REMOTE_EMBEDDING_CAPABILITY;
-    scope: "workspace";
-    workspaceRoots: string[];
-    workspaceFingerprint: string;
-    provider: string;
-    model: string;
-    endpoint: string;
-    targetFingerprint: string;
-    grantedAt: number;
-    signature: string;
-};
-export type RemoteEmbeddingAuthorizationDocument = {
-    version: 1;
-    grants: RemoteEmbeddingWorkspaceGrant[];
-};
-export type RemoteEmbeddingAuthorizationStatus = {
-    path: string;
-    grants: Array<Omit<RemoteEmbeddingWorkspaceGrant, "signature"> & {
-        valid: boolean;
-    }>;
-};

package/dist/authorization/types.js

@@ -1,2 +0,0 @@
-export const REMOTE_EMBEDDING_CAPABILITY = "remote_embedding";
-//# sourceMappingURL=types.js.map

package/dist/authorization/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAA2B,CAAC"}

package/dist/cli/args.d.ts

@@ -1,5 +0,0 @@
-import type { ParsedArgs } from "./types.js";
-export declare function parseArgs(args: readonly string[]): ParsedArgs;
-export declare function parseDevice(value: string): "auto" | "cpu" | "metal" | "vulkan" | "cuda";
-export declare function splitPathFilters(value: string): string[];
-export declare function parseModifiedTime(value: string, option: string): number;