overlane 0.1.125 → 0.1.127

package/dist/overlane.mjs

@@ -22378,6 +22378,208 @@ var init_onboarding = __esm({
   }
 });
 
+// ../contracts/src/audit.ts
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+function sha256Hex(text) {
+  const data = new TextEncoder().encode(text);
+  const bitLength = data.length * 8;
+  const padded = new Uint8Array(Math.ceil((data.length + 9) / 64) * 64);
+  padded.set(data);
+  padded[data.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(bitLength / 2 ** 32));
+  view.setUint32(padded.length - 4, bitLength >>> 0);
+  const h = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+  const w = new Uint32Array(64);
+  const rotr = (x, n) => x >>> n | x << 32 - n;
+  for (let offset = 0; offset < padded.length; offset += 64) {
+    for (let i2 = 0; i2 < 16; i2 += 1) w[i2] = view.getUint32(offset + i2 * 4);
+    for (let i2 = 16; i2 < 64; i2 += 1) {
+      const a2 = w[i2 - 15];
+      const b2 = w[i2 - 2];
+      const s0 = rotr(a2, 7) ^ rotr(a2, 18) ^ a2 >>> 3;
+      const s1 = rotr(b2, 17) ^ rotr(b2, 19) ^ b2 >>> 10;
+      w[i2] = w[i2 - 16] + s0 + w[i2 - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i2 = 0; i2 < 64; i2 += 1) {
+      const t1 = hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[i2] + w[i2] >>> 0;
+      const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    const sums = [a, b, c, d, e, f, g, hh];
+    for (let i2 = 0; i2 < 8; i2 += 1) h[i2] = h[i2] + sums[i2] >>> 0;
+  }
+  return [...h].map((n) => n.toString(16).padStart(8, "0")).join("");
+}
+function auditHash(prevHash, body2) {
+  return sha256Hex(`${prevHash}
+${canonicalJson(AuditEventBody.parse(body2))}`);
+}
+function chainAuditEvent(prevHash, body2) {
+  const previous = prevHash ?? AUDIT_GENESIS_HASH;
+  return AuditEvent.parse({ ...body2, prevHash: previous, hash: auditHash(previous, body2) });
+}
+var AUDIT_CATEGORIES, AuditCategory, AUDIT_ACTIONS, AUDIT_ACTION_NAMES, AuditActionName, AUDIT_RESULTS, AuditResult, AuditPrincipalType, AuditTarget, Hash, AUDIT_GENESIS_HASH, AuditEventBody, AuditEvent, AuditList, AuditVerification, K, FIXTURE_AT, fixtureBodies, AUDIT_FIXTURE;
+var init_audit = __esm({
+  "../contracts/src/audit.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    AUDIT_CATEGORIES = ["admin", "policy", "token"];
+    AuditCategory = external_exports.enum(AUDIT_CATEGORIES);
+    AUDIT_ACTIONS = {
+      "member.removed": "admin",
+      "member.role_changed": "admin",
+      "invitation.created": "admin",
+      "invitation.revoked": "admin",
+      "run_policy.updated": "policy",
+      "project.updated": "policy",
+      "release.published": "policy",
+      "release.promoted": "policy",
+      "release.withdrawn": "policy",
+      "release.pinned": "policy",
+      "release.rolled_back": "policy",
+      "memory_settings.updated": "policy",
+      "issue_sync.updated": "policy",
+      "loop.created": "policy",
+      "loop.updated": "policy",
+      "loop.deleted": "policy",
+      "bot.registered": "policy",
+      "bot.revoked": "policy",
+      "bot.key_rotated": "policy",
+      "token.created": "token",
+      "token.revoked": "token"
+    };
+    AUDIT_ACTION_NAMES = Object.keys(AUDIT_ACTIONS);
+    AuditActionName = external_exports.enum(Object.keys(AUDIT_ACTIONS));
+    AUDIT_RESULTS = ["success", "denied", "failure"];
+    AuditResult = external_exports.enum(AUDIT_RESULTS);
+    AuditPrincipalType = external_exports.enum(["user", "agent", "system"]);
+    AuditTarget = external_exports.object({ type: external_exports.string().min(1).max(40), id: external_exports.string().max(200) }).strict();
+    Hash = external_exports.string().regex(/^[0-9a-f]{64}$/, "must be 64 lowercase hex characters");
+    AUDIT_GENESIS_HASH = "0".repeat(64);
+    AuditEventBody = external_exports.object({
+      tenantId: TenantId,
+      /** 1, 2, 3 ... per tenant, with no gaps. */
+      seq: external_exports.number().int().positive(),
+      eventId: external_exports.string().min(1).max(64),
+      at: Timestamp,
+      /** User ID, agent token ID or `system`. */
+      actor: external_exports.string().min(1).max(200),
+      principalType: AuditPrincipalType,
+      role: external_exports.string().min(1).max(40).nullable(),
+      action: AuditActionName,
+      category: AuditCategory,
+      target: AuditTarget,
+      result: AuditResult
+    }).strict();
+    AuditEvent = AuditEventBody.extend({ prevHash: Hash, hash: Hash }).strict().refine((event) => AUDIT_ACTIONS[event.action] === event.category, { message: "category does not match the action", path: ["category"] });
+    AuditList = external_exports.object({
+      tenantId: TenantId,
+      events: external_exports.array(AuditEvent),
+      /** Pass as `after` to read the next page; null when this is the last page. */
+      nextAfter: external_exports.number().int().nonnegative().nullable(),
+      /** Hash of the newest row of the tenant's chain (null for an empty log). */
+      head: Hash.nullable()
+    }).strict();
+    AuditVerification = external_exports.object({
+      tenantId: TenantId,
+      ok: external_exports.boolean(),
+      checked: external_exports.number().int().nonnegative(),
+      head: Hash.nullable(),
+      /** The first row that fails (its seq) and why. */
+      brokenAt: external_exports.number().int().positive().optional(),
+      reason: external_exports.enum(["bad_hash", "bad_link", "bad_sequence", "wrong_tenant", "bad_category"]).optional()
+    }).strict();
+    K = new Uint32Array([
+      1116352408,
+      1899447441,
+      3049323471,
+      3921009573,
+      961987163,
+      1508970993,
+      2453635748,
+      2870763221,
+      3624381080,
+      310598401,
+      607225278,
+      1426881987,
+      1925078388,
+      2162078206,
+      2614888103,
+      3248222580,
+      3835390401,
+      4022224774,
+      264347078,
+      604807628,
+      770255983,
+      1249150122,
+      1555081692,
+      1996064986,
+      2554220882,
+      2821834349,
+      2952996808,
+      3210313671,
+      3336571891,
+      3584528711,
+      113926993,
+      338241895,
+      666307205,
+      773529912,
+      1294757372,
+      1396182291,
+      1695183700,
+      1986661051,
+      2177026350,
+      2456956037,
+      2730485921,
+      2820302411,
+      3259730800,
+      3345764771,
+      3516065817,
+      3600352804,
+      4094571909,
+      275423344,
+      430227734,
+      506948616,
+      659060556,
+      883997877,
+      958139571,
+      1322822218,
+      1537002063,
+      1747873779,
+      1955562222,
+      2024104815,
+      2227730452,
+      2361852424,
+      2428436474,
+      2756734187,
+      3204031479,
+      3329325298
+    ]);
+    FIXTURE_AT = "2026-10-09T00:00:00.000Z";
+    fixtureBodies = [
+      { tenantId: "tm-1", seq: 1, eventId: "aud_1", at: FIXTURE_AT, actor: "u-owner", principalType: "user", role: "owner", action: "invitation.created", category: "admin", target: { type: "invitation", id: "inv_1" }, result: "success" },
+      { tenantId: "tm-1", seq: 2, eventId: "aud_2", at: "2026-10-09T00:05:00.000Z", actor: "u-admin", principalType: "user", role: "admin", action: "run_policy.updated", category: "policy", target: { type: "project", id: "prj-demo" }, result: "success" },
+      { tenantId: "tm-1", seq: 3, eventId: "aud_3", at: "2026-10-09T00:10:00.000Z", actor: "u-viewer", principalType: "user", role: "viewer", action: "token.created", category: "token", target: { type: "token", id: "" }, result: "denied" }
+    ];
+    AUDIT_FIXTURE = fixtureBodies.reduce((rows, body2) => [...rows, chainAuditEvent(rows.at(-1)?.hash ?? null, body2)], []);
+  }
+});
+
 // ../contracts/src/docs-service.ts
 function scoped(shape2) {
   return external_exports.discriminatedUnion("visibility", [external_exports.object({ ...shape2, ...PublicScope }).strict(), external_exports.object({ ...shape2, ...PrivateScope }).strict()]);
@@ -23156,6 +23358,151 @@ var init_code_map = __esm({
   }
 });
 
+// ../contracts/src/agent.ts
+function classifyMethod(method) {
+  const m = method.toUpperCase();
+  return m === "GET" || m === "HEAD" || m === "OPTIONS" ? "read" : "write";
+}
+function blockedClassFor(op) {
+  const words = op.operationId.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  const text = `${op.path.toLowerCase()} ${words}`;
+  if (op.method.toUpperCase() === "DELETE" || DESTRUCTIVE.test(text)) return "destructive";
+  if (BILLING.test(text)) return "billing";
+  if (SECRETS.test(text)) return "secrets";
+  return null;
+}
+var AGENT_PLANS, AgentPlan, AGENT_PROVIDERS, AgentProvider, TOOL_CLASSES, AgentToolClass, BLOCKED_CLASSES, BlockedClass, BILLING, SECRETS, DESTRUCTIVE, AgentOperation, AgentToolDefinition, AGENT_REFUSAL_CODES, AgentRefusalCode, AgentRefusal, AgentDiffEntry, APPROVAL_STATES, AgentApprovalState, AgentInverseChange, AgentApproval, AgentWriteToolResult, AgentReadToolResult, AgentToolResult, AgentCitation, MESSAGE_ORIGINS, AgentMessageOrigin, AgentMessage, AgentChatRequest, AgentFeedback, AGENT_AUDIT_RESULTS, AgentAuditResult, AgentAuditEvent, AgentReadOnlyMode, RouteIndexEntry, RouteIndex, AgentRouteHit;
+var init_agent = __esm({
+  "../contracts/src/agent.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    init_identity();
+    AGENT_PLANS = ["free", "pro", "team", "business", "enterprise"];
+    AgentPlan = external_exports.enum(AGENT_PLANS);
+    AGENT_PROVIDERS = ["overlane", "github", "gitlab", "linear", "jira"];
+    AgentProvider = external_exports.enum(AGENT_PROVIDERS);
+    TOOL_CLASSES = ["read", "write"];
+    AgentToolClass = external_exports.enum(TOOL_CLASSES);
+    BLOCKED_CLASSES = ["billing", "secrets", "destructive"];
+    BlockedClass = external_exports.enum(BLOCKED_CLASSES);
+    BILLING = /(^|[\s\/_.-])(billing|invoices?|payments?|subscriptions?|checkout|seats|plan-change)([\s\/_.-]|$)/i;
+    SECRETS = /(^|[\s\/_.-])(secrets?|tokens?|api-?keys?|credentials?|keys|signing|sso|scim)([\s\/_.-]|$)/i;
+    DESTRUCTIVE = /(^|[\s\/_.-])(purge|delete|destroy|erase|wipe|drop|revoke|remove|truncate|reset)([\s\/_.-]|$)/i;
+    AgentOperation = external_exports.object({
+      operationId: external_exports.string().min(1).max(100),
+      method: external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]),
+      path: external_exports.string().min(1).max(300).startsWith("/"),
+      /** Where the operation is defined: the OpenAPI document, a contract fixture until the API route exists (REQ-WEB-11), or local code that makes no API call (docs search, navigation). */
+      source: external_exports.enum(["openapi", "contract-fixture", "local"])
+    }).strict();
+    AgentToolDefinition = external_exports.object({
+      tenantId: TenantId,
+      name: external_exports.string().regex(/^[a-z][A-Za-z0-9]{1,48}$/),
+      description: external_exports.string().min(1).max(300),
+      class: AgentToolClass,
+      operation: AgentOperation,
+      /** Lowest role that may call the tool (REQ-AGT-05). The role table in identity.ts still decides per action. */
+      minRole: Role,
+      /** JSON-schema-like description of the arguments, property name to a short hint. */
+      arguments: external_exports.record(external_exports.string().min(1).max(64), external_exports.string().max(200))
+    }).strict().refine((t) => t.class === classifyMethod(t.operation.method), { message: "class must match the HTTP method (REQ-AGT-09)", path: ["class"] }).refine((t) => blockedClassFor(t.operation) === null, { message: "billing, secrets and destructive operations are never tools (REQ-AGT-08)", path: ["operation"] });
+    AGENT_REFUSAL_CODES = [
+      "role_forbidden",
+      "read_only_mode",
+      "blocked_class",
+      "unknown_tool",
+      "invalid_arguments",
+      "approval_required",
+      "approval_expired",
+      "approval_not_pending",
+      "rate_limited",
+      "unavailable"
+    ];
+    AgentRefusalCode = external_exports.enum(AGENT_REFUSAL_CODES);
+    AgentRefusal = external_exports.object({ kind: external_exports.literal("refusal"), tenantId: TenantId, code: AgentRefusalCode, tool: external_exports.string().max(100).optional(), reason: external_exports.string().min(1).max(300) }).strict();
+    AgentDiffEntry = external_exports.object({ field: external_exports.string().min(1).max(200), before: external_exports.string().max(2e3).nullable(), after: external_exports.string().max(2e3).nullable() }).strict();
+    APPROVAL_STATES = ["pending", "approved", "executed", "rejected", "expired", "failed"];
+    AgentApprovalState = external_exports.enum(APPROVAL_STATES);
+    AgentInverseChange = external_exports.object({
+      tenantId: TenantId,
+      approvalId: external_exports.string().min(1).max(128),
+      tool: external_exports.string().min(1).max(100),
+      arguments: external_exports.record(external_exports.string(), external_exports.unknown()),
+      summary: external_exports.string().min(1).max(500)
+    }).strict();
+    AgentApproval = external_exports.object({
+      tenantId: TenantId,
+      id: external_exports.string().min(1).max(128),
+      conversationId: external_exports.string().min(1).max(128),
+      requestedBy: UserId,
+      tool: external_exports.string().min(1).max(100),
+      summary: external_exports.string().min(1).max(500),
+      diff: external_exports.array(AgentDiffEntry).max(50),
+      argumentsDigest: Sha256Digest,
+      state: AgentApprovalState,
+      createdAt: Timestamp,
+      expiresAt: Timestamp,
+      decidedAt: Timestamp.optional(),
+      /** Present once executed, when the tool has an inverse. */
+      inverse: AgentInverseChange.optional(),
+      /** Set when this approval is itself the undo of another. */
+      undoOf: external_exports.string().min(1).max(128).optional()
+    }).strict();
+    AgentWriteToolResult = external_exports.object({ kind: external_exports.literal("approval"), tenantId: TenantId, approval: AgentApproval }).strict();
+    AgentReadToolResult = external_exports.object({ kind: external_exports.literal("result"), tenantId: TenantId, tool: external_exports.string().min(1).max(100), data: external_exports.unknown() }).strict();
+    AgentToolResult = external_exports.discriminatedUnion("kind", [AgentWriteToolResult, AgentReadToolResult, AgentRefusal]);
+    AgentCitation = external_exports.object({
+      tenantId: TenantId,
+      sourceId: external_exports.string().min(1).max(200),
+      title: external_exports.string().min(1).max(200),
+      /** Docs page or app route. Always a path on an Overlane host; checked by the route index. */
+      url: external_exports.string().min(1).max(500),
+      snippet: external_exports.string().max(600).optional()
+    }).strict();
+    MESSAGE_ORIGINS = ["user", "assistant", "retrieved", "tool"];
+    AgentMessageOrigin = external_exports.enum(MESSAGE_ORIGINS);
+    AgentMessage = external_exports.object({
+      tenantId: TenantId,
+      id: external_exports.string().min(1).max(128),
+      conversationId: external_exports.string().min(1).max(128),
+      origin: AgentMessageOrigin,
+      content: external_exports.string().max(8e3),
+      citations: external_exports.array(AgentCitation).max(10).default([]),
+      /** "not_found" when the answer is the deterministic below-threshold reply. */
+      outcome: external_exports.enum(["answer", "not_found", "navigation", "tool_result", "approval", "refusal", "info"]).optional(),
+      createdAt: Timestamp
+    }).strict();
+    AgentChatRequest = external_exports.object({ tenantId: TenantId, conversationId: external_exports.string().min(1).max(128), text: external_exports.string().min(1).max(4e3), currentPath: external_exports.string().max(300).optional(), escalate: external_exports.boolean().optional() }).strict();
+    AgentFeedback = external_exports.object({ tenantId: TenantId, messageId: external_exports.string().min(1).max(128), rating: external_exports.enum(["up", "down"]), note: external_exports.string().max(500).optional(), at: Timestamp }).strict();
+    AGENT_AUDIT_RESULTS = ["ok", "refused", "error", "approval_proposed", "approval_decided"];
+    AgentAuditResult = external_exports.enum(AGENT_AUDIT_RESULTS);
+    AgentAuditEvent = external_exports.object({
+      tenantId: TenantId,
+      id: external_exports.string().min(1).max(128),
+      at: Timestamp,
+      actor: external_exports.object({ userId: UserId, role: Role }).strict(),
+      conversationId: external_exports.string().min(1).max(128),
+      tool: external_exports.string().min(1).max(100),
+      argumentsDigest: Sha256Digest,
+      result: AgentAuditResult,
+      detail: external_exports.string().max(300).optional(),
+      approvalId: external_exports.string().min(1).max(128).optional()
+    }).strict();
+    AgentReadOnlyMode = external_exports.object({ tenantId: TenantId, enabled: external_exports.boolean(), setBy: UserId, setAt: Timestamp }).strict();
+    RouteIndexEntry = external_exports.object({
+      path: external_exports.string().regex(/^\/[A-Za-z0-9\/_.-]*$/),
+      title: external_exports.string().min(1).max(120),
+      description: external_exports.string().min(1).max(300),
+      keywords: external_exports.array(external_exports.string().min(1).max(40)).max(20).default([]),
+      roles: external_exports.array(Role).min(1),
+      plan: AgentPlan
+    }).strict();
+    RouteIndex = external_exports.object({ version: external_exports.literal("1"), routes: external_exports.array(RouteIndexEntry).min(1) }).strict();
+    AgentRouteHit = external_exports.object({ tenantId: TenantId, path: external_exports.string().startsWith("/"), title: external_exports.string().min(1).max(120), score: external_exports.number().nonnegative() }).strict();
+  }
+});
+
 // ../contracts/src/plans.ts
 var PLAN_IDS, BillingPlanId, CHECKOUT_PLANS, CheckoutPlanId, METERS, Meter, AllowanceValue, PlanAllowances, PlanData, OverageRates, FreeTierControls, PlanCatalog, TenantPlanLimits;
 var init_plans = __esm({
@@ -23551,10 +23898,12 @@ var init_src = __esm({
     init_memory();
     init_issues();
     init_onboarding();
+    init_audit();
     init_docs_service();
     init_review();
     init_guardrails();
     init_code_map();
+    init_agent();
     init_plans();
     init_billing();
   }
@@ -30909,7 +31258,7 @@ var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.125" : "0.0.0-dev";
+    VERSION = true ? "0.1.127" : "0.0.0-dev";
   }
 });
 
@@ -38841,9 +39190,9 @@ import { lstat, readFile as readFile4 } from "node:fs/promises";
 import { join as join25 } from "node:path";
 import { promisify } from "node:util";
 function shardKeyOf(shard) {
-  return `sha256:${sha256Hex(Buffer.from(`${shard.path}\0${shard.contentHash}\0${shard.precision}`, "utf8"))}`;
+  return `sha256:${sha256Hex2(Buffer.from(`${shard.path}\0${shard.contentHash}\0${shard.precision}`, "utf8"))}`;
 }
-function sha256Hex(bytes) {
+function sha256Hex2(bytes) {
   return createHash6("sha256").update(bytes).digest("hex");
 }
 async function listTrackedFiles(repoRoot) {
@@ -38869,7 +39218,7 @@ async function hashRegularFile(repoRoot, path) {
   try {
     const stats = await lstat(absolute);
     if (!stats.isFile()) return null;
-    return `sha256:${sha256Hex(await readFile4(absolute))}`;
+    return `sha256:${sha256Hex2(await readFile4(absolute))}`;
   } catch (error62) {
     if (error62 instanceof Error && "code" in error62 && error62.code === "ENOENT") return null;
     throw error62;
@@ -38905,7 +39254,7 @@ async function buildSnapshot(options) {
     if (languageForPath(path) === null) return { path, shard: null };
     const bytes = await readFile4(join25(options.repoRoot, path));
     if (bytes.byteLength > MAX_PARSE_BYTES) return { path, shard: null };
-    const hash2 = `sha256:${sha256Hex(bytes)}`;
+    const hash2 = `sha256:${sha256Hex2(bytes)}`;
     if (hash2 !== hashes.get(path)) throw new Error(`${path} changed while the snapshot was being built`);
     const shard = await parseDeclarations(path, bytes.toString("utf8"));
     return { path, shard: shard ? { ...shard, contentHash: hash2 } : null };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlane",
-  "version": "0.1.125",
+  "version": "0.1.127",
   "description": "Overlane: connect a GitHub project to your coding agents. One portable CLI with project memory, tasks, a code index, guardrails and the Claude Code and Codex plugin.",
   "keywords": [
     "overlane",

package/plugins/claude/plugins/mvrx-harness/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mvrx-harness",
-  "version": "0.1.125",
+  "version": "0.1.127",
   "description": "Overlane context at session start and the shared Overlane skills.",
   "author": {
     "name": "owenob1"