rovloom 0.5.0 → 0.6.1

package/dist/src/{chunk-ebm3kvnq.js → chunk-pnep7yhj.js}

@@ -3,109 +3,14 @@ import {
   object2,
   fields2,
   id2,
-  boundedJson2,
   validatePolicies2
 } from "./chunk-qt9m2kg2.js";
-import {
-  DEFAULT_PAIRING_POLICY_REF
-} from "./chunk-5j0gj6w2.js";
-import {
-  readRuntimeJson
-} from "./chunk-z7kkfrgz.js";
 import {
   CliError2
 } from "./chunk-hpzr94hm.js";
-import {
-  privatePath,
-  readPrivateBytes
-} from "./chunk-0y5542k8.js";
-
-// src/cli/setup-files.ts
-import {
-  closeSync,
-  fsyncSync,
-  fchmodSync,
-  linkSync,
-  statSync,
-  openSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { createHash, randomUUID } from "crypto";
-import { dirname, join } from "path";
-function setupFileStamp(path) {
-  const bytes = readPrivateBytes(path, 16777216);
-  try {
-    return createHash("sha256").update(bytes).digest("hex");
-  } finally {
-    bytes.fill(0);
-  }
-}
-function writeSetupFile(path, bytes, replace = false, expectedStamp) {
-  privatePath(path);
-  const previous = replace ? expectedStamp ?? setupFileStamp(path) : undefined;
-  if (replace && setupFileStamp(path) !== previous) {
-    throw new CliError2("config_changed");
-  }
-  const temporary = join(dirname(path), ".rovloom-setup-" + randomUUID() + ".tmp");
-  let fd;
-  let created = false;
-  try {
-    const mode = replace ? statSync(path).mode & 511 : 384;
-    fd = openSync(temporary, "wx", mode);
-    created = true;
-    if (replace && process.platform !== "win32") {
-      fchmodSync(fd, mode);
-    }
-    writeFileSync(fd, bytes);
-    fsyncSync(fd);
-    const complete = fd;
-    fd = undefined;
-    closeSync(complete);
-    if (replace) {
-      if (setupFileStamp(path) !== previous) {
-        throw new CliError2("config_changed");
-      }
-      renameSync(temporary, path);
-    } else {
-      linkSync(temporary, path);
-      unlinkSync(temporary);
-    }
-    created = false;
-  } catch (error) {
-    if (error instanceof CliError2) {
-      throw error;
-    }
-    throw new CliError2("config_unreadable");
-  } finally {
-    try {
-      if (fd !== undefined) {
-        closeSync(fd);
-      }
-    } finally {
-      if (created) {
-        unlinkSync(temporary);
-      }
-    }
-  }
-}
-function readSetupJson(path, maximum = 16384) {
-  try {
-    return readRuntimeJson(path, maximum);
-  } catch (error) {
-    if (error instanceof CliError2 && error.code === "backend_unavailable") {
-      return;
-    }
-    throw error;
-  }
-}
-function writeSetupJson(path, value, replace = false, maximum = 16384) {
-  writeSetupFile(path, boundedJson2(value, maximum), replace);
-}
 
 // src/cli/token-registry.ts
-import { createHash as createHash2, randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 var REGISTRY_MAX_BYTES = 262144;
 var MAX_CALLERS = 64;
 var DEFAULT_TTL_DAYS = 30;
@@ -113,7 +18,7 @@ var DAY = 86400000;
 var HEX = /^[a-f0-9]{64}$/;
 var PRINCIPAL = /^[a-zA-Z0-9_-]{1,128}$/;
 function digestToken(token) {
-  return createHash2("sha256").update(token).digest("hex");
+  return createHash("sha256").update(token).digest("hex");
 }
 function newToken() {
   return randomBytes(32).toString("base64url");
@@ -133,7 +38,10 @@ function parseRegistry(value, resource) {
     const digests = new Set;
     for (const input of source.callers) {
       const caller = object2(input);
-      fields2(caller, ["principal", "token_sha256", "issued_at", "expires_at"], ["previous"]);
+      fields2(caller, ["principal", "token_sha256", "issued_at", "expires_at"], ["previous", "token", "scope"]);
+      if (caller.scope !== undefined && caller.scope !== "gateway" || caller.token !== undefined && (typeof caller.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(caller.token) || digestToken(caller.token) !== caller.token_sha256)) {
+        invalid();
+      }
       const principal = object2(caller.principal);
       fields2(principal, ["id", "policy"], ["permissions"]);
       if (principal.permissions !== undefined) {
@@ -190,7 +98,9 @@ function createCaller(registry, principal, like, now, days) {
   const expires_at = now + ttl(days);
   const entry = {
     principal: { ...structuredClone(template.principal), id: principal },
+    ...template.scope ? { scope: template.scope } : {},
     token_sha256: digestToken(token),
+    token,
     issued_at: now,
     expires_at
   };
@@ -223,7 +133,9 @@ function rotateCaller(registry, principal, now, options = {}) {
   const expires_at = now + ttl(options.days);
   const entry = {
     principal: old.principal,
+    ...old.scope ? { scope: old.scope } : {},
     token_sha256: digestToken(token),
+    token,
     issued_at: now,
     expires_at,
     ...grace > 0 ? { previous: { token_sha256: old.token_sha256, expires_at: Math.min(now + grace * 60000, old.expires_at) } } : {}
@@ -250,6 +162,25 @@ function summarize(registry, now) {
     rotating: entry.previous !== undefined && now < entry.previous.expires_at
   }));
 }
+function createGatewayCaller(registry, principal, now, days = 365) {
+  if (!PRINCIPAL.test(principal) || registry.callers.some((entry) => entry.principal.id === principal) || registry.callers.length >= MAX_CALLERS) {
+    throw new CliError2("invalid_arguments");
+  }
+  const token = newToken();
+  const expires_at = now + ttl(days);
+  const entry = {
+    principal: { id: principal, policy: structuredClone(registry.local_policy) },
+    scope: "gateway",
+    token,
+    token_sha256: digestToken(token),
+    issued_at: now,
+    expires_at
+  };
+  return { registry: { ...registry, callers: [...registry.callers, entry] }, token, expires_at };
+}
+
+// src/pairing-policy.ts
+var DEFAULT_PAIRING_POLICY_REF = "rovloom_setup_v1";
 
 // src/cli/admin-registry.ts
 var ADMIN_POLICY_REVISION = "rovloom_admin_v1";
@@ -351,6 +282,6 @@ function summarizeAdmins(management, now) {
   }));
 }
 
-export { setupFileStamp, writeSetupFile, readSetupJson, writeSetupJson, REGISTRY_MAX_BYTES, parseRegistry, createCaller, setDiscardPermission, renewCaller, rotateCaller, revokeCaller, summarize, DEFAULT_ADMIN_TTL_DAYS, emptyManagement, isAdminPlaceholder, issueAdmin, revokeAdmin, summarizeAdmins };
+export { REGISTRY_MAX_BYTES, digestToken, parseRegistry, createCaller, setDiscardPermission, renewCaller, rotateCaller, revokeCaller, summarize, createGatewayCaller, DEFAULT_ADMIN_TTL_DAYS, emptyManagement, isAdminPlaceholder, issueAdmin, revokeAdmin, summarizeAdmins };
 
-//# debugId=3023B85F5DE2326664756E2164756E21
+//# debugId=96015426A0C339E864756E2164756E21

package/dist/src/chunk-qn5xae7g.js

@@ -0,0 +1,66 @@
+// @bun
+import {
+  HERDR_WORKFLOW_METHODS
+} from "./chunk-9tt13dm0.js";
+import {
+  LUVUS_OPERATION_METHODS2
+} from "./chunk-efty77sb.js";
+import {
+  luvusMode,
+  CliError2
+} from "./chunk-hpzr94hm.js";
+
+// src/cli/setup-policy.ts
+var SIMPLE_SETUP_ACTOR = "operator_simple_pairing";
+var SIMPLE_SETUP_LINEAGE = "simple";
+function setupSessions(input) {
+  if (input === undefined) {
+    return Object.freeze({});
+  }
+  const row = input;
+  if (row === null || typeof row !== "object" || Array.isArray(row) || Object.keys(row).some((key) => key !== "luvus") || row.luvus !== undefined && row.luvus !== "default" && row.luvus !== "rovloom") {
+    throw new CliError2("configuration_required");
+  }
+  return Object.freeze(row.luvus === undefined ? {} : { luvus: row.luvus });
+}
+function setupTarget(machine, kind = "luvus", sessions = {}) {
+  return {
+    machine_id: machine,
+    provider_id: kind,
+    profile: "session",
+    session: kind === "luvus" ? sessions.luvus ?? "rovloom" : "default"
+  };
+}
+function setupProviderKinds(input) {
+  if (!Array.isArray(input) || input.some((kind) => kind !== "luvus" && kind !== "herdr") || !["luvus", "herdr", "luvus,herdr"].includes(input.join(","))) {
+    throw new CliError2("configuration_required");
+  }
+  return Object.freeze([...input]);
+}
+function selectedSetupPolicies(plan, machine, kinds, sessions = {}) {
+  const grants = setupProviderKinds(kinds).map((kind) => ({
+    target: setupTarget(machine, kind, sessions),
+    methods: [...kind === "luvus" ? LUVUS_OPERATION_METHODS2 : HERDR_WORKFLOW_METHODS],
+    actions: ["dispatch", "read", "cancel"]
+  }));
+  return {
+    principal_id: plan.actor,
+    policies: {
+      caller: { revision: "setup_caller_" + (plan.lineage ?? plan.attempt_id), grants },
+      local: { revision: "setup_local_" + (plan.lineage ?? plan.attempt_id), grants: structuredClone(grants) }
+    }
+  };
+}
+function setupReference(attempt, kind = "luvus") {
+  return kind + "_" + attempt;
+}
+function setupSessionsFor(config) {
+  return Object.freeze({ luvus: luvusMode(config) === "attach" ? "default" : "rovloom" });
+}
+function simpleSetupAuthorization(machine, kinds, sessions = {}) {
+  return selectedSetupPolicies({ attempt_id: SIMPLE_SETUP_LINEAGE, actor: SIMPLE_SETUP_ACTOR, lineage: SIMPLE_SETUP_LINEAGE }, machine, kinds, sessions);
+}
+
+export { SIMPLE_SETUP_ACTOR, SIMPLE_SETUP_LINEAGE, setupSessions, setupTarget, setupProviderKinds, selectedSetupPolicies, setupReference, setupSessionsFor, simpleSetupAuthorization };
+
+//# debugId=E4B9A88833E96D5764756E2164756E21

package/dist/src/{chunk-0pewfj89.js → chunk-qp8tgms2.js}

@@ -2,7 +2,7 @@
 import {
   macosProcessState,
   windowsProcessState
-} from "./chunk-09f9q26d.js";
+} from "./chunk-vdwzb63d.js";
 
 // src/storage/process-identity.ts
 import { connect } from "net";

package/dist/src/{chunk-7k9g0x5e.js → chunk-rmgw8h27.js}

@@ -22,21 +22,23 @@ import {
   SERVICE_ERROR_CODES,
   FacadeServiceError2,
   NativeRequestNotDispatchedError
-} from "./chunk-smpevv7n.js";
+} from "./chunk-73aq2qkz.js";
 import {
-  LuvusAdapterError2,
   terminalExecutionCatalog
-} from "./chunk-57ayxqnb.js";
+} from "./chunk-8fy8w7ds.js";
 import {
   createLuvusCatalog2
-} from "./chunk-0xgpxdgc.js";
-import {
-  NativeRequestPreflightError
-} from "./chunk-zj48jvfe.js";
+} from "./chunk-bbdtsg4b.js";
 import {
   sampleManagementTransport2,
   createManagementTransportProjection2
 } from "./chunk-2tansfxf.js";
+import {
+  NativeRequestPreflightError
+} from "./chunk-xtvgm6kf.js";
+import {
+  LuvusAdapterError2
+} from "./chunk-pksaqt9a.js";
 
 // src/mcp/store-service.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -989,4 +991,4 @@ class RuntimeGatewayService2 {
 
 export { resolveGatewayPrincipal, StoreGatewayService2, RuntimeGatewayService2 };
 
-//# debugId=13A7F49E5E901EE764756E2164756E21
+//# debugId=045A814985626BAA64756E2164756E21

package/dist/src/{chunk-gbsbwssz.js → chunk-sf4ztxba.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   windowsInspectPath
-} from "./chunk-09f9q26d.js";
+} from "./chunk-vdwzb63d.js";
 import {
   id2,
   boundedJson2,
@@ -10,10 +10,10 @@ import {
 import {
   LuvusAdapterError2,
   ConnectorCapacityError
-} from "./chunk-57ayxqnb.js";
+} from "./chunk-pksaqt9a.js";
 import {
   currentProcessIdentity
-} from "./chunk-0pewfj89.js";
+} from "./chunk-qp8tgms2.js";
 import {
   privatePath,
   privateFile,

package/dist/src/{chunk-7q96e161.js → chunk-shez7hkc.js}

@@ -1,4 +1,7 @@
 // @bun
+import {
+  cliMessages2
+} from "./chunk-pgs9jp6t.js";
 import {
   isRole,
   servicePlatform,
@@ -10,15 +13,6 @@ import {
 
 // src/service/command.ts
 var actions = new Set(["install", "uninstall", "start", "restart", "stop"]);
-var SERVICE_HELP2 = `service install --role gateway|connector [--executable ABS] [--config ABS] --workdir ABS --user ACCOUNT
-service uninstall|start|restart|stop --role gateway|connector
-install registers boot startup without starting; uninstall only revokes future boot startup and preserves running instances and their control records.
-Omitted --executable uses the current standalone binary; a different binary is rejected.
-Omitted --config uses the same current-user role file as foreground startup. Installation fixes its absolute path; background startup does not select another home.
-Linux uses systemd system units; macOS uses system LaunchDaemons; Windows uses boot-triggered tasks, not SCM services or login tasks.
-Gateway services support Linux systemd, macOS system LaunchDaemons and Windows boot-triggered tasks; the local native Connector service supports Linux x64, Windows x64 and macOS (x64 / arm64).
-Windows uses the explicitly selected existing user with S4U, without storing a password or requiring login. It does not provide an interactive desktop or Windows network credentials/EFS access. Running services receive a local shutdown request; queued/start-racing tasks return service_busy without forced termination; uninstall never stops it.
-`;
 function parseServiceCommand2(args, platform, resolveDefaultConfig, executable) {
   if (args[0] !== "service") {
     return;
@@ -64,7 +58,7 @@ async function handleServiceCommand2(args, host) {
   }
   try {
     if (args.length === 2 && args[1] === "--help") {
-      host.diagnostic(SERVICE_HELP2);
+      host.diagnostic(cliMessages2(host.language)["help.service"]);
       return 0;
     }
     const request = parseServiceCommand2(args, servicePlatform(host.platform), host.resolveDefaultConfig, host.executable);
@@ -79,6 +73,6 @@ async function handleServiceCommand2(args, host) {
   }
 }
 
-export { SERVICE_HELP2, parseServiceCommand2, handleServiceCommand2 };
+export { parseServiceCommand2, handleServiceCommand2 };
 
-//# debugId=48AFF39224DEDE2664756E2164756E21
+//# debugId=D7F60C51F033ABF664756E2164756E21

package/dist/src/chunk-sqz614bh.js

@@ -0,0 +1,30 @@
+// @bun
+import {
+  hasPairingState2,
+  retirePairingState2,
+  handleConnectorUnpair2
+} from "./chunk-y8zm75jt.js";
+import"./chunk-1xer1ent.js";
+import"./chunk-8ykrqhxh.js";
+import"./chunk-1bf0wmgk.js";
+import"./chunk-z7kkfrgz.js";
+import"./chunk-hpzr94hm.js";
+import"./chunk-pgs9jp6t.js";
+import"./chunk-sf4ztxba.js";
+import"./chunk-3nnahj0j.js";
+import"./chunk-h3xyq7zk.js";
+import"./chunk-qp8tgms2.js";
+import"./chunk-0y5542k8.js";
+import"./chunk-vdwzb63d.js";
+import"./chunk-g7pnjzkk.js";
+import"./chunk-qt9m2kg2.js";
+import"./chunk-9tt13dm0.js";
+import"./chunk-7crhmqn2.js";
+import"./chunk-d71r315c.js";
+export {
+  handleConnectorUnpair2 as handleConnectorUnpair,
+  hasPairingState2 as hasPairingState,
+  retirePairingState2 as retirePairingState
+};
+
+//# debugId=4B1FD15DC6D4072D64756E2164756E21

package/dist/src/{chunk-09f9q26d.js → chunk-vdwzb63d.js}

@@ -414,6 +414,6 @@ function windowsProcessState(pid) {
   }
 }
 
-export { macosPeer, macosProcessState, macosProcessUid, macosProcessImage, macosProcessArgv, windowsCurrentUserSid, windowsInspectPath, windowsPipeServerPid, windowsProcessFacts, windowsProcessState };
+export { macosPeer, macosProcessState, macosProcessUid, macosProcessImage, macosProcessArgv, windowsInspectPath, windowsPipeServerPid, windowsProcessFacts, windowsProcessState };
 
-//# debugId=24B541853D8128AB64756E2164756E21
+//# debugId=792167EE7EF656EE64756E2164756E21

package/dist/src/chunk-xtvgm6kf.js

@@ -0,0 +1,48 @@
+// @bun
+import {
+  GatewayError2
+} from "./chunk-d71r315c.js";
+import {
+  createNativeValidator2
+} from "./chunk-mqyq5jh6.js";
+import {
+  luvusOperationDescriptor2,
+  luvusOperationValidation2
+} from "./chunk-efty77sb.js";
+
+// src/runtime/request-preflight.ts
+class NativeRequestPreflightError extends GatewayError2 {
+  outcome = "not_dispatched";
+  constructor() {
+    super("native_request_invalid");
+  }
+}
+function createLuvusRequestPreflight(contract) {
+  const validator = createNativeValidator2(contract);
+  return (request) => {
+    const checked = validator.checkRequestShape(request);
+    if (!checked.ok) {
+      if (checked.error.code === "native_request_invalid") {
+        throw new NativeRequestPreflightError;
+      }
+      throw new GatewayError2(checked.error.code);
+    }
+  };
+}
+function luvusValidation(kind, request, options) {
+  if (kind !== "luvus" || !luvusOperationDescriptor2(request.method)) {
+    return options;
+  }
+  const required = luvusOperationValidation2(request.method);
+  if (options.validation === undefined) {
+    return { ...options, validation: required };
+  }
+  if (options.validation !== required) {
+    throw new NativeRequestPreflightError;
+  }
+  return options;
+}
+
+export { NativeRequestPreflightError, createLuvusRequestPreflight, luvusValidation };
+
+//# debugId=B81CED09F0DF168264756E2164756E21

package/dist/src/chunk-y8zm75jt.js

@@ -0,0 +1,157 @@
+// @bun
+import {
+  boundedJson2
+} from "./chunk-qt9m2kg2.js";
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-pgs9jp6t.js";
+import {
+  setupFileStamp,
+  writeSetupFile
+} from "./chunk-1xer1ent.js";
+import {
+  privateDirectory
+} from "./chunk-8ykrqhxh.js";
+import {
+  runtimeReference
+} from "./chunk-z7kkfrgz.js";
+import {
+  CliError2,
+  configDocument2,
+  readConfig2
+} from "./chunk-hpzr94hm.js";
+import {
+  LUVUS_CLAIMS_LOCK_FORMAT
+} from "./chunk-sf4ztxba.js";
+import {
+  recordedProcess,
+  ownedFile
+} from "./chunk-h3xyq7zk.js";
+import {
+  ownerIsDead
+} from "./chunk-qp8tgms2.js";
+import {
+  syncParentDirectory
+} from "./chunk-0y5542k8.js";
+
+// src/cli/unpair.ts
+import { existsSync, lstatSync, readFileSync, renameSync } from "fs";
+import { dirname, join } from "path";
+var PAIRING_FILES = ["device", "pairing", "pairing-claim", "providers", "native-setup", "herdr-setup"];
+var PAIRING_DIRECTORIES = ["control", "n", "h", "w", "hr"];
+var CLAIM_LOCKS = ["control/luvus-claims.db.lock", "hr/control/claims.db.lock"];
+function hasPairingState2(directory) {
+  return PAIRING_FILES.some((reference) => existsSync(runtimeReference(directory, reference))) || PAIRING_DIRECTORIES.some((name) => existsSync(join(directory, name)));
+}
+function entry(path) {
+  try {
+    const info = lstatSync(path);
+    if (info.isFile()) {
+      return "file";
+    }
+    return info.isDirectory() ? "directory" : undefined;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return;
+    }
+    throw new CliError2("config_unreadable");
+  }
+}
+function assertConnectorIdle(stateDir) {
+  for (const name of CLAIM_LOCKS) {
+    const path = join(stateDir, name);
+    if (ownedFile(path) !== true) {
+      continue;
+    }
+    try {
+      const bytes = readFileSync(path);
+      if (bytes.length === 0 || bytes.length > 1024) {
+        continue;
+      }
+      const recorded = recordedProcess(JSON.parse(bytes.toString("utf8")), LUVUS_CLAIMS_LOCK_FORMAT);
+      if (recorded && !ownerIsDead(recorded)) {
+        throw new CliError2("configuration_required");
+      }
+    } catch (error) {
+      if (error instanceof CliError2) {
+        throw error;
+      }
+    }
+  }
+}
+function retireStamp(stateDir) {
+  const base = new Date().toISOString().replace(/[-:]/gu, "").replace(/\.\d+Z$/u, "Z");
+  for (let index = 0;; index++) {
+    const name = index === 0 ? base : base + "-" + index;
+    if (entry(join(stateDir, "retired", name)) === undefined) {
+      return name;
+    }
+  }
+}
+function retirePairingState2(config, console) {
+  console.assertOwner();
+  assertConnectorIdle(config.state_dir);
+  const moves = [];
+  const root = join(config.state_dir, "retired", retireStamp(config.state_dir));
+  for (const reference of PAIRING_FILES) {
+    const source = runtimeReference(config.state_dir, reference);
+    if (entry(source) === "file") {
+      moves.push({ source, target: join(root, "managed", reference + ".json") });
+    }
+  }
+  for (const name of PAIRING_DIRECTORIES) {
+    const source = join(config.state_dir, name);
+    if (entry(source) === "directory") {
+      moves.push({ source, target: join(root, name) });
+    }
+  }
+  if (moves.length === 0) {
+    return;
+  }
+  try {
+    privateDirectory(join(config.state_dir, "retired"));
+    privateDirectory(root);
+    for (const move of moves) {
+      privateDirectory(dirname(move.target));
+      renameSync(move.source, move.target);
+      syncParentDirectory(move.target);
+      syncParentDirectory(move.source);
+    }
+  } catch (error) {
+    throw error instanceof CliError2 ? error : new CliError2("config_unreadable");
+  }
+  return root;
+}
+async function handleConnectorUnpair2(path, io) {
+  const config = readConfig2(path);
+  if (config.role !== "connector") {
+    throw new CliError2("config_role_mismatch");
+  }
+  if (io.signal.aborted) {
+    return 0;
+  }
+  const console = {
+    io,
+    show: (text) => {
+      io.stderr.write(text);
+    },
+    confirm: async () => true,
+    assertOwner: () => {}
+  };
+  const retired = retirePairingState2(config, console);
+  privateDirectory(join(config.state_dir, "managed"));
+  if (config.gateway_url !== "" || retired !== undefined) {
+    if (boundedJson2(configDocument2(readConfig2(path))) !== boundedJson2(configDocument2(config))) {
+      throw new CliError2("config_changed");
+    }
+    writeSetupFile(path, JSON.stringify({ ...configDocument2(config), gateway: { url: "" } }, null, 2) + `
+`, true, setupFileStamp(path));
+  }
+  io.stderr.write(retired === undefined ? cliMessages2(io.language)["unpair.empty"] : formatMessage2(cliMessages2(io.language)["unpair.completed"], { retired }));
+  return 0;
+}
+
+export { hasPairingState2, retirePairingState2, handleConnectorUnpair2 };
+
+//# debugId=3C1C123FA665D9EE64756E2164756E21