hoi4-agent-tools 0.2.0 → 1.0.0

package/dist/hoi4_agent_tools/core/workspace.js

@@ -1,20 +1,9 @@
-import { link, lstat, mkdir, open, readFile, realpath, unlink } from 'node:fs/promises';
+import { lstat, mkdir, opendir, realpath } from 'node:fs/promises';
 import path from 'node:path';
-import { z } from 'zod/v4';
-import { WORKSPACE_MAX_REGISTRATIONS, } from './configuration.js';
-import { compareCodeUnits, canonicalJson, hashCanonical, secureId, sha256Bytes, } from './canonical.js';
+import { WORKSPACE_MAX_REGISTRATIONS, workspaceRegistrationSchema, } from './configuration.js';
+import { compareCodeUnits, hashCanonical, sha256Bytes } from './canonical.js';
 import { ServiceError } from './result.js';
 import { ServerState } from './server-state.js';
-const runtimeRegistrationClaimFile = '.runtime-registration-owner.json';
-const sha256Schema = z.string().regex(/^[a-f0-9]{64}$/u);
-const runtimeRegistrationClaimSchema = z
-    .object({
-    version: z.literal(1),
-    workspaceIdentity: sha256Schema,
-    ownerIdentity: sha256Schema,
-    claimHash: sha256Schema,
-})
-    .strict();
 async function exists(value, signal) {
     signal?.throwIfAborted();
     try {
@@ -59,6 +48,17 @@ export function isWithin(root, candidate) {
 function pathsOverlap(left, right) {
     return isWithin(left, right) || isWithin(right, left);
 }
+function discoveredWorkspaceId(rootPath) {
+    const basename = path.basename(rootPath);
+    const slug = basename
+        .normalize('NFKD')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/gu, '_')
+        .replace(/^_+|_+$/gu, '')
+        .slice(0, 40);
+    const identityPath = process.platform === 'win32' ? rootPath.toLowerCase() : rootPath;
+    return `mod_${slug.length === 0 ? 'workspace' : slug}_${sha256Bytes(identityPath).slice(0, 12)}`;
+}
 /**
  * Hash the resolved root topology without persisting canonical host paths. Canonicalization happens
  * before this function is called, so filesystem aliases converge on the same stable identity.
@@ -86,121 +86,6 @@ function configuredOwnerIdentity(workspaceIdentity) {
         workspaceIdentity,
     });
 }
-function runtimeOwnerIdentity(workspaceIdentity, principal) {
-    return hashCanonical({
-        domain: 'hoi4-agent-runtime-workspace-owner-v1',
-        workspaceIdentity,
-        principal: principal ?? null,
-    });
-}
-function runtimeClaimHash(claim) {
-    return hashCanonical(claim);
-}
-function registrationClaimConflict() {
-    return new ServiceError('WORKSPACE_REGISTRATION_CONFLICT', 'Runtime workspace registration conflicts with an existing registration');
-}
-async function readRuntimeRegistrationClaim(claimPath, signal) {
-    signal?.throwIfAborted();
-    let claimStatus;
-    try {
-        claimStatus = await lstat(claimPath);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw registrationClaimConflict();
-    }
-    signal?.throwIfAborted();
-    if (claimStatus.isSymbolicLink() || !claimStatus.isFile() || claimStatus.size > 4_096) {
-        throw registrationClaimConflict();
-    }
-    let parsed;
-    try {
-        const text = signal === undefined
-            ? await readFile(claimPath, 'utf8')
-            : await readFile(claimPath, { encoding: 'utf8', signal });
-        signal?.throwIfAborted();
-        parsed = JSON.parse(text);
-    }
-    catch (error) {
-        if (error.name === 'AbortError')
-            throw error;
-        throw registrationClaimConflict();
-    }
-    signal?.throwIfAborted();
-    const validated = runtimeRegistrationClaimSchema.safeParse(parsed);
-    if (!validated.success)
-        throw registrationClaimConflict();
-    const claim = validated.data;
-    if (runtimeClaimHash({
-        version: claim.version,
-        workspaceIdentity: claim.workspaceIdentity,
-        ownerIdentity: claim.ownerIdentity,
-    }) !== claim.claimHash) {
-        throw registrationClaimConflict();
-    }
-    return claim;
-}
-async function assertRuntimeRegistrationClaim(workspace, signal) {
-    signal?.throwIfAborted();
-    const claimRoot = await containedGeneratedPath(workspace.artifactRoot);
-    signal?.throwIfAborted();
-    const claimPath = path.join(claimRoot, runtimeRegistrationClaimFile);
-    const expectedWithoutHash = {
-        version: 1,
-        workspaceIdentity: workspace.workspaceIdentity,
-        ownerIdentity: workspace.ownerIdentity,
-    };
-    const expected = {
-        ...expectedWithoutHash,
-        claimHash: runtimeClaimHash(expectedWithoutHash),
-    };
-    const assertMatches = (claim) => {
-        if (claim.workspaceIdentity !== expected.workspaceIdentity ||
-            claim.ownerIdentity !== expected.ownerIdentity ||
-            claim.claimHash !== expected.claimHash) {
-            throw registrationClaimConflict();
-        }
-    };
-    const existing = await readRuntimeRegistrationClaim(claimPath, signal);
-    if (existing !== undefined) {
-        assertMatches(existing);
-        return;
-    }
-    signal?.throwIfAborted();
-    const temporaryPath = path.join(claimRoot, `.runtime-registration-${secureId('claim')}.tmp`);
-    let temporaryHandle;
-    try {
-        temporaryHandle = await open(temporaryPath, 'wx', 0o600);
-        await temporaryHandle.writeFile(`${canonicalJson(expected)}\n`, 'utf8');
-        await temporaryHandle.sync();
-        await temporaryHandle.close();
-        temporaryHandle = undefined;
-        signal?.throwIfAborted();
-        try {
-            // A hard link publishes fully flushed bytes without replacing a competing claim.
-            await link(temporaryPath, claimPath);
-        }
-        catch (error) {
-            if (error.code !== 'EEXIST') {
-                throw registrationClaimConflict();
-            }
-            const racedClaim = await readRuntimeRegistrationClaim(claimPath, signal);
-            if (racedClaim === undefined)
-                throw registrationClaimConflict();
-            assertMatches(racedClaim);
-        }
-    }
-    catch (error) {
-        if (error instanceof ServiceError || error.name === 'AbortError')
-            throw error;
-        throw registrationClaimConflict();
-    }
-    finally {
-        await temporaryHandle?.close().catch(() => undefined);
-        await unlink(temporaryPath).catch(() => undefined);
-    }
-}
 function containsAsciiControlCharacter(value) {
     for (let index = 0; index < value.length; index += 1) {
         if (value.charCodeAt(index) <= 0x1f)
@@ -252,18 +137,12 @@ function assertRelative(relativePath) {
 export class WorkspaceResolver {
     configuration;
     #byId = new Map();
-    #runtimePrincipalWorkspaces = new Map();
-    #runtimeWorkspaceIds = new Set();
-    #runtimeWorkspaceOwners = new Map();
-    #registrationRoots = [];
-    #registrationLexicalRoots = [];
-    #writableRegistrationRoots = [];
-    #writableRegistrationLexicalRoots = [];
+    #discoveredWorkspaceIds = new Set();
     #storageRoots = [];
-    #storageLexicalRoots = [];
+    #modRoots = [];
+    #workspaceStorageRoot;
     #serverStateRoot;
     #serverState;
-    #registrationQueue = Promise.resolve();
     constructor(configuration) {
         this.configuration = configuration;
     }
@@ -272,34 +151,41 @@ export class WorkspaceResolver {
         if (configuration.serverStateRoot !== undefined) {
             resolver.#serverStateRoot = await canonicalPath(configuration.serverStateRoot);
         }
-        resolver.#registrationLexicalRoots = configuration.registrationRoots.map((root) => path.normalize(path.resolve(root)));
-        resolver.#registrationRoots = await Promise.all(configuration.registrationRoots.map((root) => canonicalPath(root)));
-        resolver.#writableRegistrationLexicalRoots = configuration.writableRegistrationRoots.map((root) => path.normalize(path.resolve(root)));
-        resolver.#writableRegistrationRoots = await Promise.all(configuration.writableRegistrationRoots.map((root) => canonicalPath(root)));
-        for (const candidate of resolver.#writableRegistrationLexicalRoots) {
-            if (!resolver.#registrationLexicalRoots.some((root) => isWithin(root, candidate))) {
-                throw new ServiceError('WORKSPACE_WRITABLE_REGISTRATION_ROOT_FORBIDDEN', 'Writable runtime registration roots must be lexical descendants of registration roots');
+        resolver.#storageRoots = await Promise.all(configuration.storageRoots.map((root) => canonicalPath(root)));
+        resolver.#modRoots = await Promise.all(configuration.modRoots.map(async (root) => {
+            const status = await lstat(root).catch(() => undefined);
+            if (status === undefined || !status.isDirectory() || status.isSymbolicLink()) {
+                throw new ServiceError('WORKSPACE_MOD_ROOT_UNSAFE', 'Configured mod roots must be existing real directories');
+            }
+            return canonicalPath(root);
+        }));
+        for (const [index, candidate] of resolver.#modRoots.entries()) {
+            if (resolver.#modRoots.slice(0, index).some((root) => pathsOverlap(root, candidate))) {
+                throw new ServiceError('WORKSPACE_MOD_ROOT_OVERLAP', 'Configured mod roots must be distinct and non-overlapping');
             }
         }
-        for (const candidate of resolver.#writableRegistrationRoots) {
-            if (!resolver.#registrationRoots.some((root) => isWithin(root, candidate))) {
-                throw new ServiceError('WORKSPACE_WRITABLE_REGISTRATION_ROOT_FORBIDDEN', 'Writable runtime registration roots must resolve beneath registration roots');
+        if (configuration.workspaceStorageRoot !== undefined) {
+            resolver.#workspaceStorageRoot = await canonicalPath(configuration.workspaceStorageRoot);
+            if (resolver.#modRoots.some((root) => pathsOverlap(root, resolver.#workspaceStorageRoot))) {
+                throw new ServiceError('WORKSPACE_STORAGE_ROOT_OVERLAP', 'Workspace storage root must not overlap a configured mod root');
             }
+            resolver.#storageRoots.push(resolver.#workspaceStorageRoot);
         }
-        resolver.#storageLexicalRoots = configuration.storageRoots.map((root) => path.normalize(path.resolve(root)));
-        resolver.#storageRoots = await Promise.all(configuration.storageRoots.map((root) => canonicalPath(root)));
         if (resolver.#serverStateRoot !== undefined) {
             for (const root of [
-                ...resolver.#registrationRoots,
-                ...resolver.#writableRegistrationRoots,
                 ...resolver.#storageRoots,
+                ...resolver.#modRoots,
+                ...(configuration.gameRoot === undefined
+                    ? []
+                    : [await canonicalPath(configuration.gameRoot)]),
             ]) {
                 if (pathsOverlap(resolver.#serverStateRoot, root)) {
                     throw new ServiceError('SERVER_STATE_ROOT_OVERLAP', 'Server state root must not overlap a registration or generated-storage capability root');
                 }
             }
         }
-        for (const registration of configuration.workspaces) {
+        for (const configured of configuration.workspaces) {
+            const registration = resolver.withGlobalWorkspaceDefaults(configured);
             const workspace = await resolver.resolveRegistration(registration);
             if (resolver.#byId.has(workspace.id)) {
                 throw new ServiceError('WORKSPACE_DUPLICATE', `Duplicate workspace ID: ${workspace.id}`);
@@ -307,6 +193,7 @@ export class WorkspaceResolver {
             resolver.assertWorkspaceIsolation(workspace);
             resolver.#byId.set(workspace.id, workspace);
         }
+        await resolver.discoverModWorkspaces();
         if (configuration.serverStateRoot !== undefined) {
             resolver.#serverState = await ServerState.create(configuration.serverStateRoot);
             resolver.#serverStateRoot = resolver.#serverState.root;
@@ -319,179 +206,67 @@ export class WorkspaceResolver {
     serverState() {
         return this.#serverState;
     }
-    async register(registration, principal, signal) {
-        signal?.throwIfAborted();
-        let release;
-        const previous = this.#registrationQueue;
-        this.#registrationQueue = new Promise((resolve) => {
-            release = resolve;
-        });
-        await previous;
-        signal?.throwIfAborted();
-        try {
-            return await this.registerExclusive(registration, principal, signal);
-        }
-        finally {
-            release();
-        }
+    withGlobalWorkspaceDefaults(registration) {
+        const gameRoot = registration.kind === 'mod' && registration.gameRoot === undefined
+            ? this.configuration.gameRoot
+            : registration.gameRoot;
+        const storageBase = this.#workspaceStorageRoot === undefined
+            ? undefined
+            : path.join(this.#workspaceStorageRoot, registration.id);
+        return {
+            ...registration,
+            ...(gameRoot === undefined ? {} : { gameRoot }),
+            ...(registration.artifactRoot !== undefined || storageBase === undefined
+                ? {}
+                : { artifactRoot: path.join(storageBase, 'artifacts') }),
+            ...(registration.cacheRoot !== undefined || storageBase === undefined
+                ? {}
+                : { cacheRoot: path.join(storageBase, 'cache') }),
+        };
     }
-    async registerExclusive(registration, principal, signal) {
-        signal?.throwIfAborted();
-        if (principal !== undefined && !this.registrationAllowed(principal)) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_FORBIDDEN', 'Principal cannot register workspaces');
-        }
-        const registrationConflict = (code, message) => principal === undefined
-            ? new ServiceError(code, message)
-            : new ServiceError('WORKSPACE_REGISTRATION_CONFLICT', 'Runtime workspace registration conflicts with an existing registration');
-        if (this.#byId.has(registration.id)) {
-            throw registrationConflict('WORKSPACE_DUPLICATE', `Workspace ID is already registered: ${registration.id}`);
-        }
-        if (this.#byId.size >= WORKSPACE_MAX_REGISTRATIONS) {
-            throw registrationConflict('WORKSPACE_REGISTRATION_LIMIT', 'Workspace registration limit has been reached');
-        }
-        this.assertLexicalRegistrationPath(registration.root, 'workspace root', 'WORKSPACE_REGISTRATION_ROOT_FORBIDDEN');
-        if (registration.kind === 'mod')
-            this.assertLexicalWritableRegistrationPath(registration.root);
-        const candidateRoot = await canonicalPath(registration.root, signal);
-        signal?.throwIfAborted();
-        if (!this.#registrationRoots.some((root) => isWithin(root, candidateRoot))) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_ROOT_FORBIDDEN', 'Workspace is outside configured registration roots', {
-                workspaceId: registration.id,
-            });
-        }
-        if (registration.kind === 'mod' &&
-            !this.#writableRegistrationRoots.some((root) => isWithin(root, candidateRoot))) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_ROOT_FORBIDDEN', 'Runtime mod roots require an operator-approved writable registration root');
-        }
-        const readRoots = [
-            registration.gameRoot,
-            ...registration.dependencyRoots,
-            ...registration.dependencies.map(({ root }) => root),
-            registration.fixtureRoot,
-        ].filter((value) => value !== undefined);
-        const canonicalReadRoots = [];
-        for (const requestedRoot of readRoots) {
-            signal?.throwIfAborted();
-            this.assertLexicalRegistrationPath(requestedRoot, 'workspace source root', 'WORKSPACE_REGISTRATION_SOURCE_ROOT_FORBIDDEN');
-            const candidate = await canonicalPath(requestedRoot, signal);
-            if (!this.#registrationRoots.some((root) => isWithin(root, candidate))) {
-                throw new ServiceError('WORKSPACE_REGISTRATION_SOURCE_ROOT_FORBIDDEN', 'A requested game, dependency, or fixture root is outside configured registration roots', { workspaceId: registration.id });
-            }
-            canonicalReadRoots.push(candidate);
-        }
-        for (const existing of this.#byId.values()) {
-            signal?.throwIfAborted();
-            if (existing.roots.some((root) => pathsOverlap(candidateRoot, root.path))) {
-                throw registrationConflict('WORKSPACE_REGISTRATION_ROOT_OVERLAP', 'Runtime workspace root overlaps an existing registered workspace root');
-            }
-            const protectedRoots = existing.roots.filter((root) => ['mod', 'artifact', 'cache'].includes(root.kind));
-            if (canonicalReadRoots.some((requestedRoot) => protectedRoots.some((root) => pathsOverlap(requestedRoot, root.path)))) {
-                throw registrationConflict('WORKSPACE_REGISTRATION_SOURCE_OVERLAP', 'Runtime source root overlaps an existing workspace-owned root');
-            }
-        }
-        for (const [index, requestedRoot] of canonicalReadRoots.entries()) {
-            signal?.throwIfAborted();
-            if (pathsOverlap(candidateRoot, requestedRoot) ||
-                canonicalReadRoots
-                    .slice(0, index)
-                    .some((existingRequestedRoot) => pathsOverlap(requestedRoot, existingRequestedRoot))) {
-                throw new ServiceError('WORKSPACE_REGISTRATION_INTERNAL_OVERLAP', 'Runtime workspace roots must be distinct and non-overlapping', { workspaceId: registration.id });
-            }
-        }
-        const generatedCandidates = new Map();
-        for (const [generatedKind, configuredRoot] of [
-            ['artifacts', registration.artifactRoot],
-            ['cache', registration.cacheRoot],
-        ]) {
-            signal?.throwIfAborted();
-            const generatedRoot = configuredRoot ??
-                (registration.kind === 'mod'
-                    ? path.join(registration.root, '.hoi4-agent', generatedKind)
-                    : undefined);
-            if (generatedRoot === undefined)
-                continue;
-            this.assertLexicalGeneratedPath(registration, generatedRoot, generatedKind);
-            const candidate = await canonicalPath(generatedRoot, signal);
-            const relativeToPrimary = path
-                .relative(candidateRoot, candidate)
-                .replaceAll('\\', '/')
-                .toLowerCase();
-            const allowed = (registration.kind === 'mod' &&
-                isWithin(candidateRoot, candidate) &&
-                (relativeToPrimary === `.hoi4-agent/${generatedKind}` ||
-                    relativeToPrimary.startsWith(`.hoi4-agent/${generatedKind}/`))) ||
-                this.#storageRoots.some((root) => isWithin(root, candidate));
-            if (!allowed) {
-                throw new ServiceError('WORKSPACE_REGISTRATION_GENERATED_ROOT_FORBIDDEN', 'Runtime artifact and cache roots must remain inside the registered workspace', { workspaceId: registration.id });
+    async discoverModWorkspaces() {
+        const registrations = [];
+        for (const modRoot of this.#modRoots) {
+            const directory = await opendir(modRoot);
+            for await (const entry of directory) {
+                if (entry.name.startsWith('.') || entry.isSymbolicLink() || !entry.isDirectory())
+                    continue;
+                const lexicalCandidate = path.normalize(path.join(modRoot, entry.name));
+                if (!isWithin(modRoot, lexicalCandidate))
+                    continue;
+                const candidateStatus = await lstat(lexicalCandidate).catch(() => undefined);
+                if (candidateStatus === undefined ||
+                    candidateStatus.isSymbolicLink() ||
+                    !candidateStatus.isDirectory()) {
+                    continue;
+                }
+                const candidate = await canonicalPath(lexicalCandidate);
+                if (!isWithin(modRoot, candidate))
+                    continue;
+                if ([...this.#byId.values()].some((workspace) => workspace.modRoot === candidate))
+                    continue;
+                if (this.#byId.size + registrations.length >= WORKSPACE_MAX_REGISTRATIONS) {
+                    throw new ServiceError('WORKSPACE_REGISTRATION_LIMIT', 'Workspace registration limit has been reached');
+                }
+                const id = discoveredWorkspaceId(candidate);
+                const registration = workspaceRegistrationSchema.parse({
+                    id,
+                    name: entry.name.slice(0, 200),
+                    root: candidate,
+                    kind: 'mod',
+                });
+                registrations.push(this.withGlobalWorkspaceDefaults(registration));
             }
-            generatedCandidates.set(generatedKind, candidate);
-        }
-        const artifactCandidate = generatedCandidates.get('artifacts');
-        const cacheCandidate = generatedCandidates.get('cache');
-        if (artifactCandidate !== undefined &&
-            cacheCandidate !== undefined &&
-            pathsOverlap(artifactCandidate, cacheCandidate)) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_GENERATED_ROOT_FORBIDDEN', 'Runtime artifact and cache roots must be distinct and non-overlapping', { workspaceId: registration.id });
         }
-        for (const candidate of generatedCandidates.values()) {
-            signal?.throwIfAborted();
-            const overlapsOwnSources = (registration.kind !== 'mod' && pathsOverlap(candidateRoot, candidate)) ||
-                (registration.kind === 'mod' &&
-                    !isWithin(candidateRoot, candidate) &&
-                    pathsOverlap(candidateRoot, candidate)) ||
-                canonicalReadRoots.some((sourceRoot) => pathsOverlap(sourceRoot, candidate));
-            if (overlapsOwnSources) {
-                throw new ServiceError('WORKSPACE_REGISTRATION_GENERATED_ROOT_FORBIDDEN', 'Runtime generated storage must not overlap a source root', { workspaceId: registration.id });
+        registrations.sort((left, right) => compareCodeUnits(left.id, right.id));
+        for (const registration of registrations) {
+            if (this.#byId.has(registration.id)) {
+                throw new ServiceError('WORKSPACE_DUPLICATE', `Duplicate workspace ID: ${registration.id}`);
             }
-            if ([...this.#byId.values()].some((existing) => existing.roots.some((root) => pathsOverlap(candidate, root.path)))) {
-                throw registrationConflict('WORKSPACE_REGISTRATION_GENERATED_ROOT_OVERLAP', 'Runtime generated storage overlaps an existing workspace root');
-            }
-        }
-        const workspace = await this.resolveRegistration(registration, {
-            principal,
-            ...(signal === undefined ? {} : { signal }),
-        });
-        signal?.throwIfAborted();
-        if (this.#byId.has(registration.id)) {
-            throw registrationConflict('WORKSPACE_DUPLICATE', `Workspace ID is already registered: ${registration.id}`);
-        }
-        this.assertResolvedRuntimeRegistration(workspace);
-        try {
+            const workspace = await this.resolveRegistration(registration);
             this.assertWorkspaceIsolation(workspace);
-        }
-        catch (error) {
-            if (principal !== undefined && error instanceof ServiceError) {
-                throw registrationConflict(error.code, error.message);
-            }
-            throw error;
-        }
-        signal?.throwIfAborted();
-        await assertRuntimeRegistrationClaim(workspace, signal);
-        signal?.throwIfAborted();
-        this.#byId.set(workspace.id, workspace);
-        this.#runtimeWorkspaceIds.add(workspace.id);
-        this.#runtimeWorkspaceOwners.set(workspace.id, principal);
-        if (principal !== undefined) {
-            const ids = this.#runtimePrincipalWorkspaces.get(principal) ?? new Set();
-            ids.add(workspace.id);
-            this.#runtimePrincipalWorkspaces.set(principal, ids);
-        }
-        return workspace;
-    }
-    unregisterRuntime(workspaceId, principal) {
-        if (this.#runtimeWorkspaceIds.has(workspaceId) &&
-            this.#runtimeWorkspaceOwners.get(workspaceId) !== principal) {
-            throw new ServiceError('WORKSPACE_INACCESSIBLE', 'Workspace is unavailable to the authenticated principal');
-        }
-        if (!this.#runtimeWorkspaceIds.delete(workspaceId))
-            return;
-        this.#runtimeWorkspaceOwners.delete(workspaceId);
-        this.#byId.delete(workspaceId);
-        if (principal !== undefined) {
-            const ids = this.#runtimePrincipalWorkspaces.get(principal);
-            ids?.delete(workspaceId);
-            if (ids?.size === 0)
-                this.#runtimePrincipalWorkspaces.delete(principal);
+            this.#byId.set(workspace.id, workspace);
+            this.#discoveredWorkspaceIds.add(workspace.id);
         }
     }
     list(principal) {
@@ -574,56 +349,12 @@ export class WorkspaceResolver {
         return new Set([
             ...(token?.workspaceIds ?? []),
             ...(oauth?.workspaceIds ?? []),
-            ...(this.#runtimePrincipalWorkspaces.get(principal) ?? []),
+            ...(this.discoveredModsAllowed(principal) ? this.#discoveredWorkspaceIds : []),
         ]);
     }
-    registrationAllowed(principal) {
-        return (this.configuration.http.tokens.some((entry) => entry.principal === principal && entry.allowRegistration) ||
-            this.configuration.http.principals.some((entry) => entry.principal === principal && entry.allowRegistration));
-    }
-    assertLexicalRegistrationPath(value, label, code) {
-        const candidate = path.normalize(path.resolve(value));
-        if (!this.#registrationLexicalRoots.some((root) => isWithin(root, candidate))) {
-            throw new ServiceError(code, `Runtime ${label} is lexically outside configured registration roots`);
-        }
-    }
-    assertLexicalWritableRegistrationPath(value) {
-        const candidate = path.normalize(path.resolve(value));
-        if (!this.#writableRegistrationLexicalRoots.some((root) => isWithin(root, candidate))) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_ROOT_FORBIDDEN', 'Runtime mod roots are lexically outside operator-approved writable registration roots');
-        }
-    }
-    assertLexicalGeneratedPath(registration, value, generatedKind) {
-        const candidate = path.normalize(path.resolve(value));
-        const primary = path.normalize(path.resolve(registration.root));
-        const expectedRoot = path.join(primary, '.hoi4-agent', generatedKind);
-        const insideWritableMod = registration.kind === 'mod' && isWithin(expectedRoot, candidate);
-        const insideStorage = this.#storageLexicalRoots.some((root) => isWithin(root, candidate));
-        if (!insideWritableMod && !insideStorage) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_GENERATED_ROOT_FORBIDDEN', 'Runtime generated storage is outside the writable mod or configured storage roots');
-        }
-    }
-    assertResolvedRuntimeRegistration(workspace) {
-        const allowed = (candidate) => this.#registrationRoots.some((root) => isWithin(root, candidate));
-        if (!allowed(workspace.modRoot)) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_ROOT_FORBIDDEN', 'Resolved runtime workspace is outside configured registration roots');
-        }
-        if (workspace.registration.kind === 'mod' &&
-            !this.#writableRegistrationRoots.some((root) => isWithin(root, workspace.modRoot))) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_ROOT_FORBIDDEN', 'Resolved runtime mod root is outside operator-approved writable registration roots');
-        }
-        for (const root of workspace.roots.filter((candidate) => ['game', 'dependency', 'fixture'].includes(candidate.kind))) {
-            if (!allowed(root.path)) {
-                throw new ServiceError('WORKSPACE_REGISTRATION_SOURCE_ROOT_FORBIDDEN', 'Resolved runtime source is outside configured registration roots');
-            }
-        }
-        const generatedAllowed = (candidate, generatedKind) => (workspace.registration.kind === 'mod' &&
-            isWithin(path.join(workspace.modRoot, '.hoi4-agent', generatedKind), candidate)) ||
-            this.#storageRoots.some((root) => isWithin(root, candidate));
-        if (!generatedAllowed(workspace.artifactRoot, 'artifacts') ||
-            !generatedAllowed(workspace.cacheRoot, 'cache')) {
-            throw new ServiceError('WORKSPACE_REGISTRATION_GENERATED_ROOT_FORBIDDEN', 'Resolved runtime generated storage must remain inside its workspace');
-        }
+    discoveredModsAllowed(principal) {
+        return (this.configuration.http.tokens.some((entry) => entry.principal === principal && entry.allowDiscoveredMods) ||
+            this.configuration.http.principals.some((entry) => entry.principal === principal && entry.allowDiscoveredMods));
     }
     assertWorkspaceIsolation(workspace) {
         const readRoots = workspace.roots.filter((root) => ['game', 'dependency', 'fixture'].includes(root.kind));
@@ -641,31 +372,25 @@ export class WorkspaceResolver {
             }
         }
     }
-    async resolveRegistration(registration, runtimeOwner) {
-        const signal = runtimeOwner?.signal;
-        signal?.throwIfAborted();
-        const modRoot = await canonicalPath(registration.root, signal);
-        if (!(await exists(modRoot, signal))) {
+    async resolveRegistration(registration) {
+        const modRoot = await canonicalPath(registration.root);
+        if (!(await exists(modRoot))) {
             throw new ServiceError('WORKSPACE_ROOT_MISSING', `Workspace root does not exist: ${registration.root}`);
         }
-        const gameRoot = registration.gameRoot === undefined
-            ? undefined
-            : await canonicalPath(registration.gameRoot, signal);
+        const gameRoot = registration.gameRoot === undefined ? undefined : await canonicalPath(registration.gameRoot);
         const dependencyRegistrations = registration.dependencies.length > 0
             ? registration.dependencies
             : registration.dependencyRoots.map((root) => ({ root, replacePaths: [] }));
-        const dependencyRoots = await Promise.all(dependencyRegistrations.map(({ root }) => canonicalPath(root, signal)));
-        signal?.throwIfAborted();
+        const dependencyRoots = await Promise.all(dependencyRegistrations.map(({ root }) => canonicalPath(root)));
         if (registration.kind !== 'mod' &&
             (registration.artifactRoot === undefined || registration.cacheRoot === undefined)) {
             throw new ServiceError('WORKSPACE_GENERATED_ROOT_REQUIRED', 'Read-only game and dependency workspaces require explicit operator-owned storage roots', { workspaceId: registration.id });
         }
-        const artifactRoot = await canonicalPath(registration.artifactRoot ?? path.join(modRoot, '.hoi4-agent', 'artifacts'), signal);
-        const cacheRoot = await canonicalPath(registration.cacheRoot ?? path.join(modRoot, '.hoi4-agent', 'cache'), signal);
+        const artifactRoot = await canonicalPath(registration.artifactRoot ?? path.join(modRoot, '.hoi4-agent', 'artifacts'));
+        const cacheRoot = await canonicalPath(registration.cacheRoot ?? path.join(modRoot, '.hoi4-agent', 'cache'));
         const fixtureRoot = registration.fixtureRoot === undefined
             ? undefined
-            : await canonicalPath(registration.fixtureRoot, signal);
-        signal?.throwIfAborted();
+            : await canonicalPath(registration.fixtureRoot);
         const generatedAllowed = (candidate, generatedKind) => (registration.kind === 'mod' &&
             isWithin(path.join(modRoot, '.hoi4-agent', generatedKind), candidate)) ||
             this.#storageRoots.some((root) => isWithin(root, candidate));
@@ -679,8 +404,7 @@ export class WorkspaceResolver {
             throw new ServiceError('WORKSPACE_GENERATED_ROOT_OVERLAP', 'Artifact and cache storage roots must be distinct and non-overlapping', { workspaceId: registration.id });
         }
         for (const sourceRoot of [gameRoot, ...dependencyRoots, fixtureRoot].filter((value) => value !== undefined)) {
-            signal?.throwIfAborted();
-            if (!(await exists(sourceRoot, signal))) {
+            if (!(await exists(sourceRoot))) {
                 throw new ServiceError('WORKSPACE_SOURCE_ROOT_MISSING', 'Configured game, dependency, or fixture root does not exist', { workspaceId: registration.id });
             }
         }
@@ -707,9 +431,7 @@ export class WorkspaceResolver {
             throw new ServiceError('SERVER_STATE_ROOT_OVERLAP', 'Server state root must not overlap a workspace source or generated-storage root', { workspaceId: registration.id });
         }
         await mkdir(artifactRoot, { recursive: true });
-        signal?.throwIfAborted();
         await mkdir(cacheRoot, { recursive: true });
-        signal?.throwIfAborted();
         const roots = [
             {
                 kind: registration.kind,
@@ -763,8 +485,7 @@ export class WorkspaceResolver {
                 ]),
         ];
         for (const root of roots) {
-            signal?.throwIfAborted();
-            root.path = await canonicalPath(root.path, signal);
+            root.path = await canonicalPath(root.path);
         }
         const workspaceBase = {
             id: registration.id,
@@ -777,18 +498,13 @@ export class WorkspaceResolver {
             artifactRoot,
             cacheRoot,
             ...(fixtureRoot === undefined ? {} : { fixtureRoot }),
-            writeEnabled: registration.kind === 'mod' &&
-                this.configuration.writePolicy !== 'read-only' &&
-                registration.writeEnabled,
+            writeEnabled: registration.kind === 'mod',
         };
         const workspaceIdentity = resolvedWorkspaceIdentity(workspaceBase);
         return {
             ...workspaceBase,
             workspaceIdentity,
-            ownerIdentity: runtimeOwner === undefined
-                ? configuredOwnerIdentity(workspaceIdentity)
-                : runtimeOwnerIdentity(workspaceIdentity, runtimeOwner.principal),
+            ownerIdentity: configuredOwnerIdentity(workspaceIdentity),
         };
     }
 }
-//# sourceMappingURL=workspace.js.map

package/dist/hoi4_agent_tools/focus/compiler.js

@@ -280,4 +280,3 @@ export function compileContinuousFocusPaletteWithSourceMap(plan, generatedPath =
         },
     };
 }
-//# sourceMappingURL=compiler.js.map

package/dist/hoi4_agent_tools/focus/continuous-render.js

@@ -176,4 +176,3 @@ export async function storeContinuousFocusRenderArtifacts(workspace, store, plan
     }));
     return store.withAtomicChunkedWrites(workspace, writes, (stored) => Promise.resolve([...stored]), options.signal);
 }
-//# sourceMappingURL=continuous-render.js.map

package/dist/hoi4_agent_tools/focus/drift.js

@@ -121,4 +121,3 @@ export function detectContinuousFocusDrift(savedPlan, currentDocument) {
         currentSourcePlan,
     };
 }
-//# sourceMappingURL=drift.js.map