evolcore 0.0.35 → 0.0.37

package/dist/config/contact-book-store.js

@@ -3,14 +3,17 @@ import fs from 'fs';
 import path from 'path';
 import { isValidAid } from '../aun/aid/validation.js';
 import { isExplicitGroupId } from '../aun/group/index.js';
-import { agentConfig, agentContactAuditPath, agentContactConfig, agentDir, resolvePaths } from '../paths.js';
+import { agentConfig, agentContactAuditPath, agentContactConfig, agentDir, agentRelationsDir, resolvePaths } from '../paths.js';
 import { atomicReadJson, atomicWrite, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
 import { unregisterFile } from '../core/file-integrity/store.js';
 import { ensureManagedLockParent, resolveManagedLockPath } from '../core/runtime-lock.js';
+import { parsePeerKey } from '../core/relation/peer-identity.js';
 import { ConfigTarget, notifyConfigWrite, validateConfig } from './config-manager.js';
+import { ownerResolver } from '../core/ownership/owner-resolver.js';
 import { parseContactAlias } from './contact-alias.js';
 import { clearRoleStoreCache } from './role-store.js';
+import { currentVersion } from './schema-registry.js';
 const LOCK_NAME = '.contact-book-mutation.lock';
 const JOURNAL_NAME = '.contact-book-mutation.json';
 const LOCK_WAIT_MS = 5_000;
@@ -84,6 +87,86 @@ function enqueueContactMutation(request, changes) {
 export function mutateContactBookSync(request) {
     return mutateContactBookSyncInternal(request, []);
 }
+export function synchronizeManagementContactsSync(selfAid) {
+    return mutateContactBookSync({
+        selfAid,
+        actor: 'management-role-sync',
+        mutation: { type: 'sync-management-roles' },
+    });
+}
+/** Synchronize contacts using current verified ownership, never a requested binding target. */
+export function synchronizeOwnershipContactsSync(subjectAid) {
+    synchronizeManagementContactsSync(subjectAid);
+    const ownerAid = ownerResolver.owner(subjectAid);
+    if (!ownerAid || !fs.existsSync(agentConfig(ownerAid)))
+        return;
+    // Add the subject to its local Owner's contacts, preserving existing admission decisions.
+    mutateContactBookSync({
+        selfAid: ownerAid,
+        actor: 'ownership-contact-sync',
+        mutation: { type: 'ensure-contacts', primaryIds: [subjectAid] },
+    });
+}
+function managementRoleMapForAgent(selfAid, changes) {
+    const roles = {};
+    for (const owner of ownerResolver.protocolOwners(selfAid)) {
+        if (isValidAid(owner) && !isExplicitGroupId(owner))
+            roles[owner] = 'owner';
+    }
+    const relationsRoot = agentRelationsDir(selfAid);
+    let entries = [];
+    try {
+        entries = fs.readdirSync(relationsRoot, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const peerKeys = new Set(entries.filter(entry => entry.isDirectory()).map(entry => entry.name));
+    for (const change of changes) {
+        const parts = path.relative(relationsRoot, change.file).split(path.sep);
+        if (parts.length === 2 && parts[1] === 'config.json')
+            peerKeys.add(parts[0]);
+    }
+    for (const peerKey of peerKeys) {
+        if (peerKey.startsWith('_'))
+            continue;
+        let parsed;
+        try {
+            parsed = parsePeerKey(peerKey);
+        }
+        catch {
+            continue;
+        }
+        if (parsed.channelType !== 'aun' || !isValidAid(parsed.channelId) || isExplicitGroupId(parsed.channelId))
+            continue;
+        const config = readTransactionJson(path.join(relationsRoot, peerKey, 'config.json'), changes);
+        if (config?.targetKind !== 'group' && config?.role === 'admin' && roles[parsed.channelId] !== 'owner') {
+            roles[parsed.channelId] = 'admin';
+        }
+    }
+    return roles;
+}
+export function synchronizeAllManagementContactsSync() {
+    const agentsRoot = resolvePaths().agentsDir;
+    let entries = [];
+    try {
+        entries = fs.readdirSync(agentsRoot, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return 0;
+        throw error;
+    }
+    let changed = 0;
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !isValidAid(entry.name) || !fs.existsSync(agentConfig(entry.name)))
+            continue;
+        if (synchronizeManagementContactsSync(entry.name).changed)
+            changed += 1;
+    }
+    return changed;
+}
 /** Recover every interrupted Contact transaction before startup reads config. */
 export function recoverAllContactBookMutationsSync() {
     const agentsRoot = resolvePaths().agentsDir;
@@ -121,11 +204,22 @@ function mutateContactBookSyncInternal(request, transactionChanges) {
                 contactRevision: previousRevision,
             });
         }
+        validateTransactionChanges(selfAid, transactionChanges);
         const next = cloneBook(current);
         applyMutation(next, request.mutation, selfAid);
-        validateContactBook(next, selfAid);
-        const nextRevision = contactRevision(next);
-        validateTransactionChanges(selfAid, transactionChanges);
+        synchronizeManagementRoles(next, selfAid, transactionChanges);
+        if (request.mutation.type === 'replace') {
+            const errors = validateConfig(ConfigTarget.Contact, next);
+            if (errors.length)
+                throw new ContactMutationError('INVALID_CONTACT_BOOK', errors.join('; '));
+        }
+        else {
+            validateContactBook(next, selfAid, transactionChanges);
+        }
+        const omitEmptySync = request.mutation.type === 'sync-management-roles'
+            && current === null
+            && Object.keys(next.contacts).length === 0;
+        const nextRevision = omitEmptySync ? previousRevision : contactRevision(next);
         if (nextRevision === previousRevision && transactionChanges.length === 0) {
             return { changed: false, contactRevision: previousRevision, previousContactRevision: previousRevision, contact: next };
         }
@@ -176,6 +270,7 @@ function mutateContactBookPreparedSyncInternal(selfAid, prepare) {
         const prepared = prepare({ contact: next, contactRevision: previousRevision });
         if (prepared.mutation)
             applyMutation(next, prepared.mutation, selfAid);
+        synchronizeManagementRoles(next, selfAid, []);
         validateContactBook(next, selfAid);
         const nextRevision = contactRevision(next);
         if (nextRevision === previousRevision) {
@@ -232,6 +327,10 @@ function mutateContactBookPreparedSyncInternal(selfAid, prepare) {
     }
 }
 function applyMutation(book, mutation, selfAid) {
+    if (mutation.type === 'replace') {
+        book.contacts = cloneBook(mutation.contact).contacts;
+        return;
+    }
     const contacts = book.contacts;
     if (mutation.type === 'batch') {
         for (const item of mutation.mutations)
@@ -246,11 +345,14 @@ function applyMutation(book, mutation, selfAid) {
         }
         return;
     }
+    if (mutation.type === 'sync-management-roles') {
+        return;
+    }
     const primaryId = normalizeContactAid(mutation.primaryId);
     const existing = contacts[primaryId];
     if (mutation.type === 'set-status') {
-        if (isOwner(selfAid, primaryId) && mutation.status === 'blocked') {
-            throw new ContactMutationError('OWNER_PROTECTED', 'An Agent owner cannot be blocked');
+        if (isOwner(selfAid, primaryId) && mutation.status !== 'active') {
+            throw new ContactMutationError('OWNER_PROTECTED', 'An Agent owner must remain active');
         }
         contacts[primaryId] = compactEntry({
             ...existing,
@@ -334,13 +436,27 @@ function applyMutation(book, mutation, selfAid) {
     }
     throw new ContactMutationError('INVALID_MUTATION', `Unsupported Contact Book mutation: ${String(mutation?.type)}`);
 }
-function validateContactBook(book, selfAid) {
+function synchronizeManagementRoles(book, selfAid, changes) {
+    const roles = managementRoleMapForAgent(selfAid, changes);
+    for (const [primaryId, entry] of Object.entries(book.contacts)) {
+        book.contacts[primaryId] = compactEntry({
+            ...entry,
+            ...(roles[primaryId] === 'owner' ? { status: undefined, pendingRequest: undefined, declinedAt: undefined } : {}),
+            managementRole: roles[primaryId],
+        });
+    }
+    for (const [primaryId, managementRole] of Object.entries(roles)) {
+        book.contacts[primaryId] = compactEntry({ ...book.contacts[primaryId], managementRole });
+    }
+}
+function validateContactBook(book, selfAid, changes = []) {
     const schemaErrors = validateConfig(ConfigTarget.Contact, book);
     if (schemaErrors.length) {
         throw new ContactMutationError('INVALID_CONTACT_BOOK', schemaErrors.join('; '));
     }
     const aliases = new Map();
-    const configuredChannelKeys = readConfiguredContactChannelKeys(selfAid);
+    const agent = readTransactionJson(agentConfig(selfAid), changes);
+    const configuredChannelKeys = readConfiguredContactChannelKeys(selfAid, agent);
     for (const [primaryId, entry] of Object.entries(book.contacts)) {
         if (!isValidAid(primaryId) || isExplicitGroupId(primaryId)) {
             throw new ContactMutationError('INVALID_CONTACT_BOOK', `Invalid contact AID: ${primaryId}`);
@@ -380,14 +496,7 @@ function validateContactBook(book, selfAid) {
         }
     }
 }
-function readConfiguredContactChannelKeys(selfAid) {
-    let agent;
-    try {
-        agent = atomicReadJson(agentConfig(selfAid));
-    }
-    catch (error) {
-        throw new ContactMutationError('INVALID_CONTACT_BOOK', `Cannot read Agent channel inventory: ${error instanceof Error ? error.message : String(error)}`);
-    }
+function readConfiguredContactChannelKeys(selfAid, agent) {
     return new Set((Array.isArray(agent?.channels) ? agent.channels : [])
         .filter((channel) => channel && typeof channel === 'object' && String(channel.type || '').toLowerCase() !== 'aun')
         .map((channel) => {
@@ -406,7 +515,7 @@ function cloneBook(book) {
             ...(entry.pendingRequest ? { pendingRequest: { ...entry.pendingRequest } } : {}),
         };
     }
-    return { $schema_version: 3, contacts };
+    return { $schema_version: currentVersion('contact-book'), contacts };
 }
 function compactEntry(entry) {
     return Object.fromEntries(Object.entries(entry).filter(([, value]) => value !== undefined));
@@ -428,6 +537,15 @@ function readContactBookFromDisk(selfAid) {
         throw new ContactMutationError('INVALID_CONTACT_BOOK', `Cannot read contact book: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+function readTransactionJson(file, changes) {
+    const change = changes.find(candidate => path.resolve(candidate.file) === path.resolve(file));
+    try {
+        return change ? change.after === null ? null : JSON.parse(change.after) : atomicReadJson(file);
+    }
+    catch (error) {
+        throw new ContactMutationError('INVALID_AUTHORITY', `Cannot read management role authority ${file}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 function acquireAgentLock(selfAid) {
     const legacyLockDir = path.join(agentDir(selfAid), LOCK_NAME);
     const lockDir = resolveManagedLockPath('contact', selfAid, legacyLockDir);
@@ -456,14 +574,18 @@ function acquireAgentLock(selfAid) {
                 return () => releaseAgentLock(lockDir, ownerFile, lockToken);
             }
             catch (error) {
+                const windowsRenameDenied = process.platform === 'win32' && error?.code === 'EPERM';
                 const lockMayAlreadyExist = error?.code === 'EEXIST'
                     || error?.code === 'ENOTEMPTY'
-                    || (process.platform === 'win32' && error?.code === 'EPERM' && fs.existsSync(lockDir));
+                    || windowsRenameDenied;
                 if (!lockMayAlreadyExist)
                     throw error;
-                if (removeStaleLock(lockDir, ownerFile))
+                const lockExists = fs.existsSync(lockDir);
+                if (lockExists && removeStaleLock(lockDir, ownerFile))
                     continue;
                 if (Date.now() >= deadline) {
+                    if (windowsRenameDenied && !lockExists)
+                        throw error;
                     throw new ContactMutationError('LOCK_TIMEOUT', `Timed out waiting for contact mutation lock: ${lockDir}`);
                 }
                 Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_RETRY_MS);
@@ -618,13 +740,7 @@ function appendAudit(selfAid, request, previousContactRevision, contactRevisionV
     })}\n`, { mode: 0o600 });
 }
 function isOwner(selfAid, primaryId) {
-    try {
-        const config = atomicReadJson(path.join(agentDir(selfAid), 'config.json'));
-        return config?.owners?.some(value => String(value || '').trim() === primaryId) ?? false;
-    }
-    catch {
-        return false;
-    }
+    return ownerResolver.protocolOwners(selfAid).includes(primaryId);
 }
 function normalizeAid(value, label) {
     const aid = String(value || '').trim();

package/dist/config/contact-book.js

@@ -4,6 +4,7 @@ import { isExplicitGroupId } from '../aun/group/index.js';
 import { ConfigTarget, read, validateConfig } from './config-manager.js';
 import { ContactMutationError, contactRevision, mutateContactBookSync } from './contact-book-store.js';
 import { formatContactAlias, normalizeContactChannelKey, parseContactAlias, } from './contact-alias.js';
+import { getProtocolOwners } from '../core/ownership/owner-resolver.js';
 export class ContactBookError extends Error {
     code;
     constructor(code, message) {
@@ -133,10 +134,12 @@ export function resolveContactView(selfAid, primaryId) {
     const owner = listAgentOwners(selfAid).includes(id);
     const entry = getContactSnapshot(selfAid).contacts.get(id);
     const status = owner ? 'active' : entry?.status ?? 'active';
+    const managementRole = owner ? 'owner' : entry?.managementRole === 'admin' ? 'admin' : undefined;
     return {
         primaryId: id,
         ...(entry?.displayName ? { displayName: entry.displayName } : {}),
         aliases: entry?.aliases ?? [],
+        ...(managementRole ? { managementRole } : {}),
         status,
         blocked: status === 'blocked',
         isOwner: owner,
@@ -251,6 +254,5 @@ function normalizePrimaryId(value) {
     return id;
 }
 function listAgentOwners(selfAid) {
-    const agent = read(ConfigTarget.Agent, { self: selfAid }, { cache: true });
-    return [...new Set((agent?.owners ?? []).map(value => String(value || '').trim()).filter(Boolean))];
+    return getProtocolOwners(selfAid);
 }

package/dist/config/lifecycle.js

@@ -1,5 +1,5 @@
 import { CONFIG_SCHEMA_VERSION } from '../types.js';
-const VALID_LIFECYCLES = new Set(['created', 'bootstrapping', 'active']);
+const VALID_LIFECYCLES = new Set(['created', 'ownerpending', 'bootstrapping', 'active']);
 export function isAgentLifecycle(value) {
     return typeof value === 'string' && VALID_LIFECYCLES.has(value);
 }

package/dist/config/owner-config.js

@@ -0,0 +1,96 @@
+function normalizeOwnerValue(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const owner = value.trim();
+    return owner || undefined;
+}
+/** Resolve the canonical owner, preferring the new scalar field. */
+export function firstConfiguredOwner(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const record = value;
+    const explicit = normalizeOwnerValue(record.owner);
+    if (explicit)
+        return explicit;
+    if (Array.isArray(record.owners)) {
+        for (const candidate of record.owners) {
+            const owner = normalizeOwnerValue(candidate);
+            if (owner)
+                return owner;
+        }
+    }
+    return undefined;
+}
+/** Runtime compatibility projection for code that still consumes an owner list. */
+export function configuredOwnerList(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return [];
+    const record = value;
+    const values = [record.owner, ...(Array.isArray(record.owners) ? record.owners : [])];
+    return [...new Set(values
+            .filter((candidate) => typeof candidate === 'string')
+            .map(candidate => candidate.trim())
+            .filter(Boolean))];
+}
+export function assertOwnerConfigRecord(value, label, validateId) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    const record = value;
+    if (record.owner !== undefined && (typeof record.owner !== 'string' || !record.owner.trim())) {
+        throw new Error(`${label}.owner must be a non-empty string`);
+    }
+    if (typeof record.owner === 'string' && validateId && !validateId(record.owner.trim())) {
+        throw new Error(`${label}.owner is invalid: ${JSON.stringify(record.owner)}`);
+    }
+    if (record.owners !== undefined && !Array.isArray(record.owners)) {
+        throw new Error(`${label}.owners must be an array`);
+    }
+    if (Array.isArray(record.owners)) {
+        record.owners.forEach((owner, index) => {
+            if (typeof owner !== 'string' || !owner.trim()) {
+                throw new Error(`${label}.owners[${index}] must be a non-empty string`);
+            }
+            if (validateId && !validateId(owner.trim())) {
+                throw new Error(`${label}.owners[${index}] is invalid: ${JSON.stringify(owner)}`);
+            }
+        });
+    }
+    for (const owner of configuredOwnerList(record)) {
+        if (validateId && !validateId(owner)) {
+            throw new Error(`${label}.owner is invalid: ${JSON.stringify(owner)}`);
+        }
+    }
+}
+/** Normalize one config record for persistence: write only the scalar owner. */
+export function normalizeSingleOwnerRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const record = value;
+    const normalized = { ...record };
+    const owner = firstConfiguredOwner(record);
+    delete normalized.owners;
+    if (owner)
+        normalized.owner = owner;
+    else
+        delete normalized.owner;
+    return normalized;
+}
+/** Normalize root owner plus channel instance owner compatibility fields. */
+export function normalizeOwnerConfigTree(value, options = {}) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const normalized = { ...value };
+    // Keep root-level local owner values intact. Ownership consensus is a
+    // separate runtime source and must not overwrite development configuration.
+    if (options.projectChannels !== false && Array.isArray(normalized.channels)) {
+        normalized.channels = normalized.channels.map((channel) => normalizeSingleOwnerRecord(channel));
+    }
+    return normalized;
+}
+/** Add a legacy list projection for old runtime callers without persisting it. */
+export function withOwnerListCompatibility(value) {
+    return normalizeOwnerConfigTree(value);
+}
+export function assertNoRootOwner(value) {
+    // Compatibility no-op: local root owners remain supported during rollout.
+}

package/dist/config/peer-role-resolver.js

@@ -4,19 +4,26 @@ import path from 'path';
 import { agentConfig, agentContactConfig, agentRelationsDir } from '../paths.js';
 import { formatPeerKey, parsePeerKey } from '../core/relation/peer-identity.js';
 import { hasTrustedPrincipal } from '../core/auth/authenticated-actor.js';
-import { ConfigTarget, read, write } from './config-manager.js';
+import { ConfigTarget, read } from './config-manager.js';
 import { isManagementRole } from './builtin-roles.js';
 import { getRoleDefinition, getRoleRank, normalizeDefaultRole, roleExists } from './roles.js';
 import { getStoredRoleRegistry, roleRegistryExists } from './role-store.js';
 import { resolvePrincipal } from './contact-book.js';
+import { configuredOwnerList } from './owner-config.js';
 import { tryParseChannelKey } from '../core/channel-loader.js';
 import { isValidAid } from '../aun/aid/validation.js';
 import { isExplicitGroupId } from '../aun/group/index.js';
+import { getOwners, ownerResolver } from '../core/ownership/owner-resolver.js';
 export function isAuthenticated(userId) {
     return isValidAid(String(userId || '').trim());
 }
 export function listStaticAgentOwners(aid, opts = {}) {
-    return listAgentOwners(aid, opts);
+    try {
+        const config = read(ConfigTarget.Agent, { self: aid }, { cache: opts.fresh !== true });
+        ownerResolver.setAgentConfiguredOwners(aid, configuredOwnerList(config));
+    }
+    catch { }
+    return getOwners(aid);
 }
 /** Direct AUN relations with role=admin are the addressable Agent admin set. */
 export function listStaticAgentAdmins(aid, opts = {}) {
@@ -53,7 +60,7 @@ export function getFirstStaticAgentOwner(aid) {
 }
 /** Revision for security-sensitive owner/contact/relation authorization inputs. */
 export function authorizationConfigRevision(aid) {
-    const fingerprints = [fileRevision(agentConfig(aid)), fileRevision(agentContactConfig(aid))];
+    const fingerprints = [ownerResolver.revision(aid), fileRevision(agentConfig(aid)), fileRevision(agentContactConfig(aid))];
     const relations = agentRelationsDir(aid);
     try {
         for (const entry of fs.readdirSync(relations, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
@@ -75,12 +82,7 @@ export function isStaticAgentAdmin(aid, actorId) {
     return config?.targetKind !== 'group' && config?.role === 'admin';
 }
 export function addStaticAgentOwner(aid, ownerAid) {
-    if (!aid || !ownerAid)
-        return;
-    const config = read(ConfigTarget.Agent, { self: aid }) ?? { $schema_version: 3, aid, channels: [] };
-    const owners = new Set((config.owners ?? []).filter(Boolean));
-    owners.add(ownerAid);
-    write(ConfigTarget.Agent, { ...config, aid, owners: [...owners] }, { self: aid });
+    throw new Error('Owner is protocol-managed; use ec aid bind');
 }
 export function hasStaticAgentOwner(aid) {
     return listStaticAgentOwners(aid).length > 0;
@@ -203,15 +205,7 @@ function resultFor(role, source, actor, selfAid) {
     };
 }
 function listAgentOwners(aid, opts = {}) {
-    if (!aid)
-        return [];
-    try {
-        const config = read(ConfigTarget.Agent, { self: aid }, { cache: opts.fresh !== true });
-        return Array.from(new Set((config?.owners ?? []).map(value => String(value || '').trim()).filter(Boolean)));
-    }
-    catch {
-        return [];
-    }
+    return getOwners(aid);
 }
 function readAgentDefaultRole(aid, chatType) {
     return getStoredRoleRegistry(aid).defaultRoles[chatType] ?? null;