rovloom 0.6.0 → 0.6.1

package/dist/src/{chunk-5s2emvww.js → chunk-j6svdqr8.js}

@@ -6,12 +6,7 @@ import {
   object2,
   fields2,
   id2,
-  sha2,
   boundedJson2,
-  hash2,
-  validateTarget2,
-  validateProvider2,
-  validateContractSource2,
   contractRef2,
   assertBinding2
 } from "./chunk-qt9m2kg2.js";
@@ -19,9 +14,6 @@ import {
   compileBundle2,
   createNativeValidator2
 } from "./chunk-mqyq5jh6.js";
-import {
-  LuvusAdapterError2
-} from "./chunk-57ayxqnb.js";
 import {
   macosProcessState,
   macosProcessUid,
@@ -30,7 +22,7 @@ import {
   windowsInspectPath,
   windowsProcessFacts,
   windowsProcessState
-} from "./chunk-09f9q26d.js";
+} from "./chunk-vdwzb63d.js";
 import {
   WINDOWS_PIPE,
   LUVUS_ENDPOINT_TRANSPORT,
@@ -50,27 +42,23 @@ import {
   readWindowsLuvusPeer2,
   readMacosLuvusPeer2,
   readLuvusPeer2
-} from "./chunk-0xgpxdgc.js";
-import {
-  LUVUS_OPERATION_METHODS2,
-  luvusOperationDescriptor2,
-  luvusOperationValidation2,
-  validateLuvusOperationParams2,
-  createLuvusRequestPreflight
-} from "./chunk-zj48jvfe.js";
+} from "./chunk-bbdtsg4b.js";
 import {
   LUVUS_CLAIMS_LOCK_FORMAT
-} from "./chunk-gbsbwssz.js";
+} from "./chunk-sf4ztxba.js";
+import {
+  LuvusAdapterError2
+} from "./chunk-pksaqt9a.js";
 import {
   lockOwnerFields,
   recordedProcess,
   ownedFile,
   recoverStaleLock
-} from "./chunk-zdxww7ms.js";
+} from "./chunk-h3xyq7zk.js";
 import {
   listening,
   ownerIsDead
-} from "./chunk-0pewfj89.js";
+} from "./chunk-qp8tgms2.js";
 import {
   syncParentDirectory
 } from "./chunk-0y5542k8.js";
@@ -1345,286 +1333,6 @@ async function startManagedLuvus2(root) {
   }
 }
 
-// src/runtime/luvus-operations-authority.ts
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
-function assertLuvusOperationsContract(contract) {
-  const source = contract.wire.source;
-  const capabilities = object2(object2(contract.capabilities).result);
-  if (contract.wire.support_status !== "validated" || source.provider_kind !== "luvus" || source.protocol_family !== "uhp" || source.schema_origin !== "installed_cli" || source.schema_command !== "luvus uhp schema" || !/^1\.\d+$/u.test(source.native_protocol_version ?? "") || source.support_basis !== "live_catalog" || source.adapter_revision !== MANAGED_LUVUS_REVISION2 || source.classification_revision !== MANAGED_LUVUS_CLASSIFICATION2 || typeof source.runtime_generation !== "string" || !source.runtime_generation.length || source.runtime_generation !== capabilities.server_generation || contract.compiled.identity.binary_sha256 !== source.binary_sha256 || contract.compiled.identity.schema_sha256 !== source.schema_sha256 || contract.compiled.identity.revision !== source.adapter_revision || !Array.isArray(capabilities.method_contracts)) {
-    throw new LuvusAdapterError2("luvus_operations_source_mismatch");
-  }
-}
-function createLuvusOperationsAuthority(contract, current, rawAllowed) {
-  assertLuvusOperationsContract(contract);
-  const methods = object2(object2(contract.capabilities).result).method_contracts;
-  return (attempt, native) => {
-    const proven = current(attempt.binding);
-    const descriptor = luvusOperationDescriptor2(attempt.method);
-    if (proven.authenticated !== true || proven.source_verified !== true || !descriptor || attempt.native_request.method !== attempt.method || attempt.mode !== luvusOperationValidation2(attempt.method) || !isDeepStrictEqual4(proven.binding, native)) {
-      throw new LuvusAdapterError2("luvus_operation_unreviewed");
-    }
-    const live = methods.filter((row) => row.method === attempt.method);
-    if (live.length !== 1 || !isDeepStrictEqual4({
-      method: live[0].method,
-      access: live[0].access,
-      scope: live[0].scope,
-      idempotent: live[0].idempotent
-    }, descriptor.native)) {
-      throw new LuvusAdapterError2("luvus_operations_contract_mismatch");
-    }
-    validateLuvusOperationParams2(attempt.method, attempt.native_request.params);
-    const raw = attempt.mode === "raw-contract";
-    const allowed = raw && rawAllowed(attempt) === true;
-    return {
-      owner: allowed,
-      raw_requested: raw,
-      ...allowed ? {
-        raw_grant: {
-          id: attempt.binding.call_id,
-          source_verified: true,
-          principal_id: attempt.principal_id,
-          binding: native,
-          methods: [attempt.method],
-          expires_at: attempt.binding.registration.deadline
-        }
-      } : {}
-    };
-  };
-}
-
-// src/runtime/remote-luvus.ts
-function checkedRemoteLuvusConfig(reference, input) {
-  const config = object2(JSON.parse(boundedJson2(input)));
-  fields2(config, ["kind", "authentication", "binding", "target", "contract", "peer_policy_revision"], ["raw_grant"]);
-  validateProvider2(config.binding);
-  validateTarget2(config.target);
-  id2(config.peer_policy_revision);
-  const pin = object2(config.contract);
-  fields2(pin, [
-    "binary_version",
-    "binary_sha256",
-    "schema_sha256",
-    "adapter_revision",
-    "classification_revision",
-    "schema_bundle"
-  ]);
-  sha2(pin.binary_sha256);
-  sha2(pin.schema_sha256);
-  if (config.kind !== "luvus" || config.authentication !== "remote_connector" || config.binding.kind !== "luvus" || config.target.profile !== "session" || config.binding.machine_id !== config.target.machine_id || config.binding.provider_id !== config.target.provider_id || config.binding.config_ref !== reference || typeof pin.binary_version !== "string" || !pin.binary_version.length || pin.binary_version.length > 128 || pin.adapter_revision !== MANAGED_LUVUS_REVISION2 || pin.classification_revision !== MANAGED_LUVUS_CLASSIFICATION2 || typeof pin.schema_bundle !== "string" || hash2(pin.schema_bundle) !== pin.schema_sha256) {
-    throw new LuvusAdapterError2("remote_luvus_pin_invalid");
-  }
-  if (config.raw_grant !== undefined) {
-    const grant = object2(config.raw_grant);
-    fields2(grant, ["principal_id", "methods"]);
-    id2(grant.principal_id);
-    if (!Array.isArray(grant.methods) || grant.methods.length > LUVUS_OPERATION_METHODS2.length || new Set(grant.methods).size !== grant.methods.length || grant.methods.some((method) => !LUVUS_OPERATION_METHODS2.includes(method))) {
-      throw new LuvusAdapterError2("remote_luvus_raw_grant_invalid");
-    }
-    Object.freeze(grant.methods);
-    Object.freeze(grant);
-  }
-  Object.freeze(config.binding);
-  Object.freeze(config.target);
-  Object.freeze(pin);
-  return Object.freeze(config);
-}
-async function createPinnedRemoteLuvus(config) {
-  const pin = config.contract;
-  const compiled = await compileBundle2(Buffer.from(pin.schema_bundle), {
-    identity: { binary_sha256: pin.binary_sha256, schema_sha256: pin.schema_sha256, revision: pin.adapter_revision }
-  });
-  if (!compiled.ok) {
-    throw new LuvusAdapterError2(compiled.error.code);
-  }
-  const contractHandle = compiled.value;
-  const target = config.target;
-  if (target.profile !== "session") {
-    throw new LuvusAdapterError2("remote_luvus_pin_invalid");
-  }
-  const validator = createNativeValidator2(contractHandle);
-  let closed = false;
-  let active;
-  function assertEpoch(epoch) {
-    if (closed || epoch.closed || active !== epoch) {
-      throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-    }
-    const checked = epoch.assertCurrent();
-    if (checked !== undefined) {
-      Promise.resolve(checked).catch(() => {});
-      throw new LuvusAdapterError2("synchronous_remote_source_required");
-    }
-    if (closed || epoch.closed || active !== epoch) {
-      throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-    }
-  }
-  function closeEpoch(epoch) {
-    epoch.closed = true;
-    epoch.record = undefined;
-    epoch.provider = undefined;
-    if (active === epoch) {
-      active = undefined;
-    }
-  }
-  function nativeBinding(epoch, policies) {
-    assertEpoch(epoch);
-    const record = epoch.record;
-    if (!record) {
-      throw new LuvusAdapterError2("remote_luvus_snapshot_required");
-    }
-    id2(policies.caller_policy_revision);
-    id2(policies.local_policy_revision);
-    const target = config.target;
-    if (target.profile !== "session") {
-      throw new LuvusAdapterError2("remote_luvus_pin_invalid");
-    }
-    const binding = Object.freeze({
-      kind: "luvus",
-      provider_id: target.provider_id,
-      binding_revision: config.binding.binding_revision,
-      contract_source_ref: contractRef2(record.wire.source),
-      target: Object.freeze({ machine_id: target.machine_id, profile: "session", session: target.session }),
-      server_generation: record.wire.source.runtime_generation,
-      connection_epoch: epoch.connection.connection_epoch,
-      recovery_generation: epoch.connection.recovery_generation,
-      capability_revision: record.capability_revision,
-      caller_policy_revision: policies.caller_policy_revision,
-      local_policy_revision: policies.local_policy_revision,
-      classification_revision: pin.classification_revision,
-      contract: contractHandle.identity
-    });
-    assertEpoch(epoch);
-    return Object.freeze({ binding, authenticated: true, source_verified: true });
-  }
-  function ready() {
-    try {
-      if (!active?.record) {
-        return false;
-      }
-      assertEpoch(active);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  const provider = Object.freeze({
-    remote_luvus: true,
-    binding: config.binding,
-    target: config.target,
-    peer_policy_revision: config.peer_policy_revision,
-    preflightRequest: createLuvusRequestPreflight(contractHandle),
-    ready,
-    open(connection, assertCurrent) {
-      if (closed || active || !connection.authenticated || !connection.active || connection.machine_id !== config.target.machine_id || !connection.negotiated.capabilities.includes("provider_snapshot")) {
-        throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-      }
-      const epoch = { connection: structuredClone(connection), assertCurrent, closed: false };
-      active = epoch;
-      try {
-        assertEpoch(epoch);
-      } catch (error) {
-        closeEpoch(epoch);
-        throw error;
-      }
-      return Object.freeze({
-        accept(input) {
-          assertEpoch(epoch);
-          const copied = parseNativeJson2(boundedJson2(input));
-          if (!copied.ok) {
-            throw new LuvusAdapterError2(copied.error.code);
-          }
-          const snapshot = copied.value;
-          fields2(object2(snapshot), ["binding", "target", "source", "capabilities", "capability_revision"]);
-          validateProvider2(snapshot.binding);
-          validateTarget2(snapshot.target);
-          validateContractSource2(snapshot.source);
-          sha2(snapshot.capability_revision);
-          if (boundedJson2(snapshot.binding) !== boundedJson2(config.binding) || boundedJson2(snapshot.target) !== boundedJson2(config.target)) {
-            throw new LuvusAdapterError2("remote_luvus_binding_mismatch");
-          }
-          const source = snapshot.source;
-          if (source.binary_sha256 !== pin.binary_sha256 || source.schema_sha256 !== pin.schema_sha256 || source.adapter_revision !== pin.adapter_revision || source.classification_revision !== pin.classification_revision || typeof source.runtime_generation !== "string" || !source.runtime_generation.length) {
-            throw new LuvusAdapterError2("remote_luvus_contract_mismatch");
-          }
-          const capabilities = object2(snapshot.capabilities);
-          const value = object2(capabilities.result);
-          if (hash2(boundedJson2(value)) !== snapshot.capability_revision) {
-            throw new LuvusAdapterError2("remote_luvus_capability_mismatch");
-          }
-          const shape = validator.checkCapabilitiesShape(capabilities, {
-            target: { machine_id: target.machine_id, profile: "session", session: target.session },
-            server_generation: source.runtime_generation
-          });
-          if (!shape.ok) {
-            throw new LuvusAdapterError2(shape.error.code);
-          }
-          const record = Object.freeze({
-            wire: Object.freeze({ source: Object.freeze(source), support_status: "validated" }),
-            compiled: contractHandle,
-            capabilities,
-            capability_revision: snapshot.capability_revision
-          });
-          assertLuvusOperationsContract(record);
-          const fingerprint = hash2(boundedJson2(snapshot));
-          if (epoch.fingerprint !== undefined) {
-            if (epoch.fingerprint !== fingerprint) {
-              throw new LuvusAdapterError2("remote_luvus_snapshot_changed");
-            }
-            assertEpoch(epoch);
-            return epoch.provider;
-          }
-          function sourceFor(binding) {
-            assertEpoch(epoch);
-            assertBinding2(binding, binding);
-            if (binding.machine_id !== epoch.connection.machine_id || binding.recovery_generation !== epoch.connection.recovery_generation || binding.connection_epoch !== epoch.connection.connection_epoch || binding.provider_kind !== "luvus" || binding.binding_revision !== config.binding.binding_revision || boundedJson2(binding.target) !== boundedJson2(config.target) || binding.contract_ref !== contractRef2(record.wire.source)) {
-              throw new LuvusAdapterError2("remote_luvus_binding_mismatch");
-            }
-            return nativeBinding(epoch, binding.registration);
-          }
-          const live = Object.freeze({
-            binding: config.binding,
-            target: config.target,
-            peer_policy_revision: config.peer_policy_revision,
-            contract: record,
-            source: sourceFor,
-            catalogSource(current, policies) {
-              if (boundedJson2(current) !== boundedJson2(epoch.connection)) {
-                throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-              }
-              return nativeBinding(epoch, policies);
-            },
-            authority: createLuvusOperationsAuthority(record, sourceFor, (attempt) => config.raw_grant?.principal_id === attempt.principal_id && config.raw_grant.methods.includes(attempt.method)),
-            ready() {
-              try {
-                assertEpoch(epoch);
-                return !!epoch.record;
-              } catch {
-                return false;
-              }
-            }
-          });
-          assertEpoch(epoch);
-          epoch.record = record;
-          epoch.fingerprint = fingerprint;
-          epoch.provider = live;
-          return live;
-        },
-        close() {
-          closeEpoch(epoch);
-        }
-      });
-    }
-  });
-  return Object.freeze({
-    provider,
-    close() {
-      closed = true;
-      if (active) {
-        closeEpoch(active);
-      }
-    }
-  });
-}
-
-export { OwnedProcessShutdownError, observeLuvusProcess, nativeRecordStamp, readNativeRecord, createNativeRecord, removeNativeRecord, recoverLuvusClaimsLock, recoverLuvusOwnerLock, assertManagedControlDirectory, initializeManagedLuvusRoot2, openManagedLuvusRoot2, assertManagedRoot, NativeInstanceContext, discoverLuvusInstallation, MANAGED_LUVUS_REVISION2, MANAGED_LUVUS_CLASSIFICATION2, registerLocalOwnerLuvus, assertLocalOwnerLuvus, observedLuvusContract, startManagedLuvus2, assertLuvusOperationsContract, createLuvusOperationsAuthority, checkedRemoteLuvusConfig, createPinnedRemoteLuvus };
+export { OwnedProcessShutdownError, observeLuvusProcess, nativeRecordStamp, readNativeRecord, createNativeRecord, removeNativeRecord, recoverLuvusClaimsLock, recoverLuvusOwnerLock, assertManagedControlDirectory, initializeManagedLuvusRoot2, openManagedLuvusRoot2, assertManagedRoot, NativeInstanceContext, discoverLuvusInstallation, MANAGED_LUVUS_REVISION2, MANAGED_LUVUS_CLASSIFICATION2, registerLocalOwnerLuvus, assertLocalOwnerLuvus, observedLuvusContract, startManagedLuvus2 };
 
-//# debugId=38EA45B552DA108E64756E2164756E21
+//# debugId=23AB0591A85323DB64756E2164756E21

package/dist/src/{chunk-9zkq0kc8.js → chunk-jkzfck98.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-d71r315c.js";
 import {
   cliMessages2
-} from "./chunk-5b8g62kw.js";
+} from "./chunk-pgs9jp6t.js";
 import {
   MAX_MCP_BYTES2,
   TOOLS_PAGE_SIZE,
@@ -16,13 +16,13 @@ import {
   SERVICE_ERROR_CODES,
   FacadeServiceError2,
   NativeRequestNotDispatchedError
-} from "./chunk-0dqx2mmz.js";
+} from "./chunk-73aq2qkz.js";
 import {
   parseNativeJson2
 } from "./chunk-7crhmqn2.js";
 import {
   PRODUCT_VERSION2
-} from "./chunk-s3ydr65k.js";
+} from "./chunk-j59ac0xs.js";
 import {
   canonicalLoopbackHost
 } from "./chunk-6n9s7nfe.js";

package/dist/src/{chunk-ssp57p43.js → chunk-m76cmkfy.js}

@@ -9,10 +9,8 @@ import"./chunk-g7pnjzkk.js";
 import {
   cliMessages2,
   formatMessage2
-} from "./chunk-5b8g62kw.js";
+} from "./chunk-pgs9jp6t.js";
 import {
-  setupFileStamp,
-  writeSetupFile,
   REGISTRY_MAX_BYTES,
   parseRegistry,
   createCaller,
@@ -22,7 +20,11 @@ import {
   revokeCaller,
   summarize,
   isAdminPlaceholder
-} from "./chunk-wxqhscsw.js";
+} from "./chunk-pnep7yhj.js";
+import {
+  setupFileStamp,
+  writeSetupFile
+} from "./chunk-1xer1ent.js";
 import {
   resolveRoleConfigPath2
 } from "./chunk-1bf0wmgk.js";
@@ -197,4 +199,4 @@ export {
   handleTokenCommand
 };
 
-//# debugId=97EFCC7F7ABCF40164756E2164756E21
+//# debugId=4D3B6508C39A168F64756E2164756E21