openmates 0.27.0-alpha.63 → 0.27.0-alpha.64

package/dist/{chunk-D6TL3ILK.js → chunk-RNMPBFM6.js}

@@ -17710,10 +17710,47 @@ var OpenMatesClient = class _OpenMatesClient {
       if (Array.isArray(embed.version_history_rows)) {
         for (const row3 of embed.version_history_rows) {
           if (!row3.embed_id || typeof row3.version_number !== "number") continue;
+          if (row3.embed_id !== embed.embed_id) {
+            throw new Error(`Embed ${embed.embed_id} history row has a different embed identity.`);
+          }
+          if (row3.version_number === 1) {
+            const query = new URLSearchParams({ capability: "bounded-v1", chat_id: params.chatId });
+            if (params.teamId) query.set("team_id", params.teamId);
+            const existing = await this.http.get(
+              `/v1/embeds/${encodeURIComponent(embed.embed_id)}/versions/1?${query}`,
+              this.getCliRequestHeaders()
+            );
+            if (existing.ok) {
+              const rows2 = existing.data?.rows;
+              if (existing.data?.embed_id !== embed.embed_id || existing.data.version_number !== 1 || !Array.isArray(rows2) || rows2.length !== 1 || rows2[0].version_number !== 1 || typeof rows2[0].encrypted_snapshot !== "string" || rows2[0].encrypted_patch != null || typeof row3.snapshot !== "string" || typeof row3.patch === "string") {
+                throw new Error(`Canonical embed ${embed.embed_id} v1 history is invalid.`);
+              }
+              const canonicalSnapshot = await decryptWithAesGcmCombined(rows2[0].encrypted_snapshot, embedKey);
+              if (canonicalSnapshot !== row3.snapshot) {
+                throw new Error(`Existing canonical embed ${embed.embed_id} v1 does not match streamed source.`);
+              }
+              continue;
+            }
+            if (existing.status !== 404) {
+              throw new Error(`Canonical embed ${embed.embed_id} v1 read failed (HTTP ${existing.status}).`);
+            }
+          }
           const encryptedSnapshot = typeof row3.snapshot === "string" ? await encryptWithAesGcmCombined(row3.snapshot, embedKey) : void 0;
           const encryptedPatch = typeof row3.patch === "string" ? await encryptWithAesGcmCombined(row3.patch, embedKey) : void 0;
           if (!encryptedSnapshot && !encryptedPatch) continue;
+          const diffRequestId = randomUUID9();
+          const diffConfirmed = params.ws.waitForMessage(
+            "store_embed_diff_confirmed",
+            (payload) => {
+              const p = payload;
+              return p.request_id === diffRequestId && p.embed_id === row3.embed_id && p.version_number === row3.version_number;
+            },
+            3e4
+          );
+          void diffConfirmed.catch(() => {
+          });
           await params.ws.sendAsync("store_embed_diff", {
+            request_id: diffRequestId,
             embed_id: row3.embed_id,
             version_number: row3.version_number,
             encrypted_snapshot: encryptedSnapshot ?? null,
@@ -17721,6 +17758,11 @@ var OpenMatesClient = class _OpenMatesClient {
             hashed_user_id: hashedUserId,
             created_at: normalizeUnixSeconds(row3.created_at, now)
           });
+          const diffReceipt = (await diffConfirmed).payload;
+          const expectedDigest = computeSHA256(JSON.stringify([encryptedSnapshot ?? null, encryptedPatch ?? null]));
+          if (diffReceipt.canonical_source !== "version_row" || diffReceipt.canonical_digest !== expectedDigest) {
+            throw new Error(`Embed ${embed.embed_id} v${row3.version_number} durable receipt did not match the stored source.`);
+          }
         }
       }
     };

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   shouldRequireTrustedAccountGuard,
   waitForSafeE2ETotpWindow,
   waitForWorkflowRun
-} from "./chunk-D6TL3ILK.js";
+} from "./chunk-RNMPBFM6.js";
 import "./chunk-Q6PGA2B3.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-F2U6KIMR.js";

package/dist/index.js

@@ -44,7 +44,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-D6TL3ILK.js";
+} from "./chunk-RNMPBFM6.js";
 import "./chunk-Q6PGA2B3.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-F2U6KIMR.js";

package/fixtures/privacy-runtime/linux-arm64/manifest.json

@@ -17,47 +17,47 @@
     {
       "name": "libggml-base.so",
       "bytes": 1110088,
-      "sha256": "bdb1a65cc110d622ca0ca0a9274b9a9f0949d86e0f6136b8b5d159a685096c44"
+      "sha256": "a53ddafb5d89e67fdf7ac8b9ca01ba918b8499abf01457e9dd0671d13d2c3488"
     },
     {
       "name": "libggml-base.so.0",
       "bytes": 1110088,
-      "sha256": "bdb1a65cc110d622ca0ca0a9274b9a9f0949d86e0f6136b8b5d159a685096c44"
+      "sha256": "a53ddafb5d89e67fdf7ac8b9ca01ba918b8499abf01457e9dd0671d13d2c3488"
     },
     {
       "name": "libggml-base.so.0.15.1",
       "bytes": 1110088,
-      "sha256": "bdb1a65cc110d622ca0ca0a9274b9a9f0949d86e0f6136b8b5d159a685096c44"
+      "sha256": "a53ddafb5d89e67fdf7ac8b9ca01ba918b8499abf01457e9dd0671d13d2c3488"
     },
     {
       "name": "libggml-cpu.so",
       "bytes": 869800,
-      "sha256": "fc1ed2b090628912eee7d6618014efe0be9bec527adf108677873c796a22eb7d"
+      "sha256": "3f553ec40e5344225e445b20c8de96708ae4204dfe08e24a202d5af36cdd4d23"
     },
     {
       "name": "libggml-cpu.so.0",
       "bytes": 869800,
-      "sha256": "fc1ed2b090628912eee7d6618014efe0be9bec527adf108677873c796a22eb7d"
+      "sha256": "3f553ec40e5344225e445b20c8de96708ae4204dfe08e24a202d5af36cdd4d23"
     },
     {
       "name": "libggml-cpu.so.0.15.1",
       "bytes": 869800,
-      "sha256": "fc1ed2b090628912eee7d6618014efe0be9bec527adf108677873c796a22eb7d"
+      "sha256": "3f553ec40e5344225e445b20c8de96708ae4204dfe08e24a202d5af36cdd4d23"
     },
     {
       "name": "libggml.so",
       "bytes": 1899104,
-      "sha256": "53aac984ca4703e965c1cbc9cbb49aa21126558f566695c441d932c18a03a3fd"
+      "sha256": "b5e07a905cfe06748287b8ab7116f120bcc7ff1a1f3357c49d9b1c590241e5a0"
     },
     {
       "name": "libggml.so.0",
       "bytes": 1899104,
-      "sha256": "53aac984ca4703e965c1cbc9cbb49aa21126558f566695c441d932c18a03a3fd"
+      "sha256": "b5e07a905cfe06748287b8ab7116f120bcc7ff1a1f3357c49d9b1c590241e5a0"
     },
     {
       "name": "libggml.so.0.15.1",
       "bytes": 1899104,
-      "sha256": "53aac984ca4703e965c1cbc9cbb49aa21126558f566695c441d932c18a03a3fd"
+      "sha256": "b5e07a905cfe06748287b8ab7116f120bcc7ff1a1f3357c49d9b1c590241e5a0"
     },
     {
       "name": "openmates-pii-worker",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.27.0-alpha.63",
+  "version": "0.27.0-alpha.64",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",