@agent-deck/backend 1.10.0 → 1.10.2

package/dist/playbooks/playbook-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbook-parser.js","sourceRoot":"","sources":["../../src/playbooks/playbook-parser.ts"],"names":[],"mappings":";;;AAcA,wDAsCC;AAMD,8CA4BC;AAtFD,+CAI4B;AAE5B,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED,iFAAiF;AACjF,SAAgB,sBAAsB,CAAC,KAAa;IAClD,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,IAAI,cAAc,GAAkB,IAAI,CAAC;IAEzC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC;QAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,cAAc,GAAG,GAAG,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kCAAyB,CAAC,KAAK,CAAC;QAClD,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACzD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;QAClE,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzD,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC,CAAC;IAEH,MAAM,MAAM,GAA8B,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAClF,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM;QACN,WAAW;QACX,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;KAClB,CAAC;AACJ,CAAC"}

package/dist/playbooks/playbook-service.d.ts

@@ -0,0 +1,9 @@
+import { Playbook, PlaybookSummary } from '@agent-deck/shared';
+export declare function getGlobalPlaybooksDir(): string;
+export declare function discoverPlaybookPaths(workspaceRoot?: string): Promise<Array<{
+    filePath: string;
+    source: PlaybookSummary['source'];
+}>>;
+export declare function listPlaybooks(workspaceRoot?: string): Promise<PlaybookSummary[]>;
+export declare function getPlaybook(playbookId: string, workspaceRoot?: string): Promise<Playbook | null>;
+//# sourceMappingURL=playbook-service.d.ts.map

package/dist/playbooks/playbook-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbook-service.d.ts","sourceRoot":"","sources":["../../src/playbooks/playbook-service.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,QAAQ,EACR,eAAe,EAEhB,MAAM,oBAAoB,CAAC;AAK5B,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AA8CD,wBAAsB,qBAAqB,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;CACnC,CAAC,CAAC,CA4BF;AAED,wBAAsB,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAiBtF;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAW1B"}

package/dist/playbooks/playbook-service.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGlobalPlaybooksDir = getGlobalPlaybooksDir;
+exports.discoverPlaybookPaths = discoverPlaybookPaths;
+exports.listPlaybooks = listPlaybooks;
+exports.getPlaybook = getPlaybook;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const shared_1 = require("@agent-deck/shared");
+const yaml_sync_1 = require("../vault/yaml-sync");
+const repo_deck_1 = require("../scope/repo-deck");
+const playbook_parser_1 = require("./playbook-parser");
+function getGlobalPlaybooksDir() {
+    return node_path_1.default.join((0, yaml_sync_1.getAgentDeckHome)(), 'playbooks');
+}
+async function pathExists(filePath) {
+    try {
+        await promises_1.default.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function listMarkdownFiles(dir) {
+    if (!(await pathExists(dir))) {
+        return [];
+    }
+    const entries = await promises_1.default.readdir(dir, { withFileTypes: true });
+    return entries
+        .filter((entry) => entry.isFile() && entry.name.endsWith('.md'))
+        .map((entry) => node_path_1.default.join(dir, entry.name));
+}
+function resolvePlaybookPath(workspaceRoot, playbookPath) {
+    if (node_path_1.default.isAbsolute(playbookPath)) {
+        return playbookPath;
+    }
+    return node_path_1.default.join(node_path_1.default.resolve(workspaceRoot), playbookPath);
+}
+async function loadPlaybookFromFile(filePath, source) {
+    try {
+        const content = await promises_1.default.readFile(filePath, 'utf8');
+        const playbook = (0, playbook_parser_1.parsePlaybookFile)(content, filePath);
+        return { ...playbook, source };
+    }
+    catch (error) {
+        if (error instanceof playbook_parser_1.PlaybookParseError) {
+            console.warn(error.message);
+            return null;
+        }
+        throw error;
+    }
+}
+async function discoverPlaybookPaths(workspaceRoot) {
+    const discovered = new Map();
+    const addPath = (filePath, source) => {
+        const resolved = node_path_1.default.resolve(filePath);
+        if (!discovered.has(resolved)) {
+            discovered.set(resolved, { filePath: resolved, source });
+        }
+    };
+    if (workspaceRoot) {
+        const manifest = await (0, repo_deck_1.loadRepoDeckManifest)(workspaceRoot);
+        for (const playbookPath of manifest?.playbooks ?? []) {
+            addPath(resolvePlaybookPath(workspaceRoot, playbookPath), 'repo');
+        }
+        const repoDir = node_path_1.default.join(node_path_1.default.resolve(workspaceRoot), shared_1.REPO_PLAYBOOKS_DIR);
+        for (const filePath of await listMarkdownFiles(repoDir)) {
+            addPath(filePath, 'repo');
+        }
+    }
+    const globalDir = getGlobalPlaybooksDir();
+    for (const filePath of await listMarkdownFiles(globalDir)) {
+        addPath(filePath, 'global');
+    }
+    return [...discovered.values()];
+}
+async function listPlaybooks(workspaceRoot) {
+    const paths = await discoverPlaybookPaths(workspaceRoot);
+    const summaries = [];
+    for (const { filePath, source } of paths) {
+        const playbook = await loadPlaybookFromFile(filePath, source);
+        if (playbook) {
+            summaries.push({
+                id: playbook.id,
+                path: playbook.path,
+                triggers: playbook.triggers,
+                source: playbook.source,
+            });
+        }
+    }
+    return summaries.sort((a, b) => a.id.localeCompare(b.id));
+}
+async function getPlaybook(playbookId, workspaceRoot) {
+    const paths = await discoverPlaybookPaths(workspaceRoot);
+    for (const { filePath, source } of paths) {
+        const playbook = await loadPlaybookFromFile(filePath, source);
+        if (playbook?.id === playbookId) {
+            return playbook;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=playbook-service.js.map

package/dist/playbooks/playbook-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbook-service.js","sourceRoot":"","sources":["../../src/playbooks/playbook-service.ts"],"names":[],"mappings":";;;;;AAWA,sDAEC;AA8CD,sDA+BC;AAED,sCAiBC;AAED,kCAcC;AA7HD,gEAAkC;AAClC,0DAA6B;AAC7B,+CAI4B;AAC5B,kDAAsD;AACtD,kDAA0D;AAC1D,uDAA0E;AAE1E,SAAgB,qBAAqB;IACnC,OAAO,mBAAI,CAAC,IAAI,CAAC,IAAA,4BAAgB,GAAE,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,kBAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,aAAqB,EAAE,YAAoB;IACtE,IAAI,mBAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,mBAAI,CAAC,IAAI,CAAC,mBAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,MAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAA,mCAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oCAAkB,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAC,aAAsB;IAIhE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmE,CAAC;IAE9F,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,MAAiC,EAAE,EAAE;QACtE,MAAM,QAAQ,GAAG,mBAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAoB,EAAC,aAAa,CAAC,CAAC;QAC3D,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YACrD,OAAO,CAAC,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,mBAAI,CAAC,IAAI,CAAC,mBAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,2BAAkB,CAAC,CAAC;QAC3E,KAAK,MAAM,QAAQ,IAAI,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,MAAM,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,aAAsB;IACxD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,aAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAEzD,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,EAAE,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/routes/execution-authority.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { ContractError } from '../execution-authority/types';
+export declare class EnrollmentAuthError extends Error {
+    readonly contract: ContractError;
+    constructor(contract: ContractError);
+}
+export declare const registerExecutionAuthorityRoutes: FastifyPluginAsync;
+//# sourceMappingURL=execution-authority.d.ts.map

package/dist/routes/execution-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-authority.d.ts","sourceRoot":"","sources":["../../src/routes/execution-authority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAMlD,OAAO,KAAK,EAAe,aAAa,EAAwB,MAAM,8BAA8B,CAAC;AAGrG,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,QAAQ,EAAE,aAAa;gBAAvB,QAAQ,EAAE,aAAa;CAIpD;AAyKD,eAAO,MAAM,gCAAgC,EAAE,kBA2Z9C,CAAC"}

package/dist/routes/execution-authority.js

@@ -0,0 +1,498 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerExecutionAuthorityRoutes = exports.EnrollmentAuthError = void 0;
+const http_auth_1 = require("../lib/http-auth");
+const invalid_deck_id_path_segment_1 = require("../lib/invalid-deck-id-path-segment");
+const auth_1 = require("../trusted-session/auth");
+const bearer_1 = require("../execution-authority/bearer");
+const execution_authority_http_1 = require("../lib/execution-authority-http");
+class EnrollmentAuthError extends Error {
+    contract;
+    constructor(contract) {
+        super(contract.message);
+        this.contract = contract;
+        this.name = 'EnrollmentAuthError';
+    }
+}
+exports.EnrollmentAuthError = EnrollmentAuthError;
+function intersectTools(policy, hint) {
+    if (hint === undefined)
+        return policy;
+    const key = (t) => `${t.serviceId}\0${t.toolName}`;
+    const allowed = new Set(policy.map(key));
+    return hint.filter((t) => allowed.has(key(t)));
+}
+function requireEnrollmentAuth(request, store) {
+    const token = (0, http_auth_1.parseBearerToken)({ headers: request.headers });
+    if (!token) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Enrollment bearer required (enr_…:secret)',
+        });
+    }
+    const parsed = (0, bearer_1.parseEnrollmentBearer)(token);
+    if (!parsed) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Enrollment bearer required (enr_…:secret)',
+        });
+    }
+    const enrollment = store.getEnrollment(parsed.enrollmentId);
+    if (!enrollment) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Unknown enrollment',
+            correlation: { enrollmentId: parsed.enrollmentId },
+        });
+    }
+    if (enrollment.status !== 'active') {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'ENROLLMENT_REVOKED',
+            message: 'Enrollment is revoked',
+            reason: 'enrollment_revoked',
+            correlation: { enrollmentId: parsed.enrollmentId },
+        });
+    }
+    if (!store.verifyEnrollmentSecret(parsed.enrollmentId, parsed.secret)) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Invalid enrollment secret',
+            correlation: { enrollmentId: parsed.enrollmentId },
+        });
+    }
+    return { enrollmentId: parsed.enrollmentId };
+}
+/** Shared enrollment bearer resolve used by coordinator metadata + mint routes. */
+function resolveEnrollmentAuth(request, store) {
+    try {
+        const { enrollmentId } = requireEnrollmentAuth(request, store);
+        const enrollment = store.getEnrollment(enrollmentId);
+        if (!enrollment) {
+            return {
+                ok: false,
+                contract: {
+                    ok: false,
+                    error_code: 'COORDINATOR_NOT_ENROLLED',
+                    message: 'Unknown enrollment',
+                    correlation: { enrollmentId },
+                },
+            };
+        }
+        return { ok: true, enrollmentId, enrollment };
+    }
+    catch (error) {
+        if (error instanceof EnrollmentAuthError) {
+            return { ok: false, contract: error.contract };
+        }
+        throw error;
+    }
+}
+function deckNotPermittedError(enrollmentId, deckId) {
+    return {
+        ok: false,
+        error_code: 'RESOURCE_OUT_OF_SCOPE',
+        message: 'Deck is not in allowedDeckIds',
+        reason: 'deck_not_permitted',
+        correlation: { enrollmentId, deckId },
+    };
+}
+function deckNotFoundError(enrollmentId, deckId) {
+    return {
+        ok: false,
+        error_code: 'RESOURCE_OUT_OF_SCOPE',
+        message: 'Deck not found',
+        reason: 'deck_not_found',
+        correlation: { enrollmentId, deckId },
+    };
+}
+/** Re-check enrollment after awaits so revoke cannot race a successful response. */
+function revalidateActiveEnrollment(store, enrollmentId, deckId) {
+    const enrollment = store.getEnrollment(enrollmentId);
+    if (!enrollment || enrollment.status !== 'active') {
+        return {
+            ok: false,
+            error_code: 'ENROLLMENT_REVOKED',
+            message: 'Enrollment is revoked',
+            reason: 'enrollment_revoked',
+            correlation: { enrollmentId },
+        };
+    }
+    if (deckId !== undefined && !enrollment.allowedDeckIds.includes(deckId)) {
+        return deckNotPermittedError(enrollmentId, deckId);
+    }
+    return null;
+}
+async function requireEnrollmentOrTrustedWriter(request, store) {
+    try {
+        return { kind: 'enrollment', ...requireEnrollmentAuth(request, store) };
+    }
+    catch (error) {
+        if (!(error instanceof EnrollmentAuthError))
+            throw error;
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+            return { kind: 'trusted-writer' };
+        }
+        catch {
+            throw error;
+        }
+    }
+}
+const registerExecutionAuthorityRoutes = async (fastify) => {
+    const store = () => fastify.executionAuthorityStore;
+    fastify.post('/enrollments', async (request, reply) => {
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+        const body = (request.body ?? {});
+        if (!body.coordinatorId?.trim() || !Array.isArray(body.allowedDeckIds) || body.allowedDeckIds.length === 0) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'coordinatorId and allowedDeckIds are required',
+            });
+        }
+        const result = store().enrollCoordinator({
+            coordinatorId: body.coordinatorId.trim(),
+            allowedDeckIds: body.allowedDeckIds.map(String),
+        });
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/enrollments/:id', async (request, reply) => {
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+        const enrollment = store().getEnrollment(request.params.id);
+        if (!enrollment) {
+            return reply.status(404).send({
+                ok: false,
+                error_code: 'COORDINATOR_NOT_ENROLLED',
+                message: 'Unknown enrollment',
+            });
+        }
+        return { ok: true, data: enrollment };
+    });
+    fastify.post('/enrollments/:id/revoke', async (request, reply) => {
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+        const result = store().revokeEnrollment(request.params.id);
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/decks', async (request, reply) => {
+        const auth = resolveEnrollmentAuth(request, store());
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth.contract, (0, execution_authority_http_1.statusForContract)(auth.contract));
+        }
+        const decks = [];
+        for (const id of auth.enrollment.allowedDeckIds) {
+            const deck = await fastify.db.getDeck(id);
+            if (deck) {
+                decks.push({ id: deck.id, name: deck.name });
+            }
+        }
+        const stale = revalidateActiveEnrollment(store(), auth.enrollmentId);
+        if (stale) {
+            return (0, execution_authority_http_1.sendContractError)(reply, stale, (0, execution_authority_http_1.statusForContract)(stale));
+        }
+        return { ok: true, data: { decks } };
+    });
+    fastify.get('/decks/:deckId/playbooks', async (request, reply) => {
+        const auth = resolveEnrollmentAuth(request, store());
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth.contract, (0, execution_authority_http_1.statusForContract)(auth.contract));
+        }
+        const { deckId } = request.params;
+        if ((0, invalid_deck_id_path_segment_1.invalidDeckIdPathSegment)(deckId)) {
+            const badSegment = {
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'deckId must be a single path segment',
+                correlation: { deckId },
+            };
+            return (0, execution_authority_http_1.sendContractError)(reply, badSegment, (0, execution_authority_http_1.statusForContract)(badSegment));
+        }
+        if (!auth.enrollment.allowedDeckIds.includes(deckId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotPermittedError(auth.enrollmentId, deckId));
+        }
+        // Fail closed for deleted-but-still-allowed decks (distinct from not-in-allowedDeckIds).
+        // Sibling GET /decks omits missing ids from the list; path-param discovery must not.
+        if (!(await fastify.db.hasDeck(deckId))) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotFoundError(auth.enrollmentId, deckId));
+        }
+        const playbooks = await fastify.playbookManager.listSummariesForDeck(deckId);
+        const stale = revalidateActiveEnrollment(store(), auth.enrollmentId, deckId);
+        if (stale) {
+            return (0, execution_authority_http_1.sendContractError)(reply, stale, (0, execution_authority_http_1.statusForContract)(stale));
+        }
+        return { ok: true, data: playbooks };
+    });
+    fastify.post('/authorities', async (request, reply) => {
+        const auth = resolveEnrollmentAuth(request, store());
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth.contract, (0, execution_authority_http_1.statusForContract)(auth.contract));
+        }
+        const { enrollmentId } = auth;
+        const body = (request.body ?? {});
+        if (body.enrollmentId && body.enrollmentId !== enrollmentId) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'enrollmentId does not match bearer',
+            });
+        }
+        if (!body.runId?.trim() ||
+            !body.attemptId?.trim() ||
+            !body.deckId?.trim() ||
+            !body.idempotencyKey?.trim() ||
+            body.audience !== 'dealer-worker' ||
+            !(body.ttlMs > 0)) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'runId, attemptId, deckId, audience=dealer-worker, idempotencyKey, ttlMs>0 required',
+            });
+        }
+        const deckId = body.deckId.trim();
+        // Scope check before existence so missing out-of-scope ids stay deck_not_permitted.
+        if (!auth.enrollment.allowedDeckIds.includes(deckId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotPermittedError(enrollmentId, deckId));
+        }
+        const deck = await fastify.db.getDeck(deckId);
+        if (!deck) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotFoundError(enrollmentId, deckId));
+        }
+        const services = deck.services ?? [];
+        const allowedTools = [];
+        const allowedServices = [];
+        for (const service of services) {
+            allowedServices.push(service.id);
+            const discovered = await fastify.serviceManager.discoverServiceTools(service.id, {
+                forAgent: true,
+            });
+            if (Array.isArray(discovered)) {
+                for (const tool of discovered) {
+                    allowedTools.push({ serviceId: service.id, toolName: tool.name });
+                }
+            }
+        }
+        const narrowedTools = intersectTools(allowedTools, body.toolScopeHint);
+        const narrowedServiceIds = [...new Set(narrowedTools.map((t) => t.serviceId))];
+        // undefined hint → full deck services; explicit hint (incl. []) → services from snapshot only
+        const mintServices = body.toolScopeHint === undefined ? allowedServices : narrowedServiceIds;
+        const stale = revalidateActiveEnrollment(store(), enrollmentId, deckId);
+        if (stale) {
+            return (0, execution_authority_http_1.sendContractError)(reply, stale, (0, execution_authority_http_1.statusForContract)(stale));
+        }
+        const result = store().mintAuthority({
+            enrollmentId,
+            runId: body.runId.trim(),
+            attemptId: body.attemptId.trim(),
+            deckId,
+            audience: 'dealer-worker',
+            idempotencyKey: body.idempotencyKey.trim(),
+            allowedServices: mintServices,
+            allowedTools: narrowedTools,
+            ttlMs: body.ttlMs,
+        });
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/authorities/:id', async (request, reply) => {
+        let principal;
+        try {
+            principal = await requireEnrollmentOrTrustedWriter(request, store());
+        }
+        catch (error) {
+            if (error instanceof EnrollmentAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract, (0, execution_authority_http_1.statusForContract)(error.contract));
+            }
+            throw error;
+        }
+        const peeked = store().peekAuthority(request.params.id);
+        if (!peeked ||
+            (principal.kind === 'enrollment' && peeked.enrollmentId !== principal.enrollmentId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, {
+                ok: false,
+                error_code: 'AUTHORITY_UNKNOWN',
+                message: 'Unknown authority',
+                correlation: { authorityId: request.params.id },
+            }, 404);
+        }
+        const result = store().inspectAuthority(request.params.id);
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.post('/authorities/:id/revoke', async (request, reply) => {
+        let principal;
+        try {
+            principal = await requireEnrollmentOrTrustedWriter(request, store());
+        }
+        catch (error) {
+            if (error instanceof EnrollmentAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract, (0, execution_authority_http_1.statusForContract)(error.contract));
+            }
+            throw error;
+        }
+        const peeked = store().peekAuthority(request.params.id);
+        if (!peeked ||
+            (principal.kind === 'enrollment' && peeked.enrollmentId !== principal.enrollmentId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, {
+                ok: false,
+                error_code: 'AUTHORITY_UNKNOWN',
+                message: 'Unknown authority',
+                correlation: { authorityId: request.params.id },
+            }, 404);
+        }
+        const result = store().revokeAuthority(request.params.id);
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/audit', async (request, reply) => {
+        let principal;
+        try {
+            principal = await requireEnrollmentOrTrustedWriter(request, store());
+        }
+        catch (error) {
+            if (error instanceof EnrollmentAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract, (0, execution_authority_http_1.statusForContract)(error.contract));
+            }
+            throw error;
+        }
+        const q = request.query;
+        if (principal.kind === 'enrollment') {
+            if (q.enrollmentId && q.enrollmentId !== principal.enrollmentId) {
+                return (0, execution_authority_http_1.sendContractError)(reply, {
+                    ok: false,
+                    error_code: 'RESOURCE_OUT_OF_SCOPE',
+                    message: 'Cannot query audit for another enrollment',
+                    correlation: { enrollmentId: principal.enrollmentId },
+                }, 403);
+            }
+            if (q.authorityId) {
+                const owned = store().peekAuthority(q.authorityId);
+                if (!owned || owned.enrollmentId !== principal.enrollmentId) {
+                    return (0, execution_authority_http_1.sendContractError)(reply, {
+                        ok: false,
+                        error_code: 'AUTHORITY_UNKNOWN',
+                        message: 'Unknown authority',
+                        correlation: { authorityId: q.authorityId },
+                    }, 404);
+                }
+            }
+        }
+        const events = store().listAuditEvents({
+            runId: q.runId,
+            attemptId: q.attemptId,
+            authorityId: q.authorityId,
+            enrollmentId: principal.kind === 'enrollment' ? principal.enrollmentId : q.enrollmentId,
+            requestId: q.requestId,
+        });
+        return { ok: true, data: { events } };
+    });
+    fastify.post('/mcp/connect', async (request, reply) => {
+        const body = (request.body ?? {});
+        const token = (0, http_auth_1.parseBearerToken)(request);
+        const fromBearer = token ? (0, bearer_1.parseAuthorityBearer)(token) : null;
+        const authorityId = fromBearer?.authorityId ?? body.authorityId?.trim();
+        const authoritySecret = fromBearer?.secret ?? body.authoritySecret?.trim();
+        const audience = body.audience?.trim() || 'dealer-worker';
+        if (!authorityId || !authoritySecret) {
+            return reply.status(401).send({
+                ok: false,
+                error_code: 'AUTHORITY_SECRET_INVALID',
+                message: 'authorityId and authoritySecret required',
+            });
+        }
+        const auth = store().authenticateAuthority(authorityId, authoritySecret);
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth, (0, execution_authority_http_1.statusForContract)(auth));
+        }
+        if (audience !== auth.data.audience) {
+            return reply.status(403).send({
+                ok: false,
+                error_code: 'AUDIENCE_MISMATCH',
+                message: 'Caller audience does not match authority audience',
+                correlation: { authorityId },
+            });
+        }
+        return {
+            ok: true,
+            data: {
+                authorityId: auth.data.authorityId,
+                deckId: auth.data.deckId,
+                audience: auth.data.audience,
+                runId: auth.data.runId,
+                attemptId: auth.data.attemptId,
+                allowedServices: auth.data.allowedServices,
+                allowedTools: auth.data.allowedTools,
+                expiresAt: auth.data.expiresAt,
+                status: auth.data.status,
+            },
+        };
+    });
+    /** Authorize one tool call under execution authority (MCP / internal). */
+    fastify.post('/authorize-call', async (request, reply) => {
+        const body = (request.body ?? {});
+        if (!body.authorityId ||
+            !body.authoritySecret ||
+            !body.audience ||
+            !body.serviceId ||
+            !body.toolName) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'authorityId, authoritySecret, audience, serviceId, toolName required',
+            });
+        }
+        const result = store().invokeAuthorizedCall({
+            authorityId: body.authorityId,
+            authoritySecret: body.authoritySecret,
+            audience: body.audience,
+            serviceId: body.serviceId,
+            toolName: body.toolName,
+            requiresInteraction: body.requiresInteraction,
+        });
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+};
+exports.registerExecutionAuthorityRoutes = registerExecutionAuthorityRoutes;
+//# sourceMappingURL=execution-authority.js.map