@agent-deck/backend 1.6.2 → 1.7.0

package/dist/test/auth-fixtures.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dashboardAuthHeaders = dashboardAuthHeaders;
+exports.agentSessionHeaders = agentSessionHeaders;
+const shared_1 = require("@agent-deck/shared");
+const auth_1 = require("../trusted-session/auth");
+const store_1 = require("../trusted-session/store");
+function dashboardAuthHeaders() {
+    const token = (0, auth_1.createDashboardSessionToken)();
+    return {
+        cookie: `${shared_1.AGENT_DECK_DASHBOARD_COOKIE}=${encodeURIComponent(token)}`,
+    };
+}
+function agentSessionHeaders(db, deckId, workspaceDigest = 'test-workspace-digest') {
+    const store = new store_1.TrustedSessionStore(db.getSqliteDatabase());
+    const workspace = store.getOrCreateWorkspaceKey(workspaceDigest);
+    const secret = (0, store_1.generateGrantSecret)();
+    const pending = store.createPendingGrant(workspace.id, deckId, secret);
+    store.activateGrant(pending.id);
+    const grant = store.findActiveGrantBySecret(secret);
+    const session = store.createRuntimeSession({
+        workspaceKeyId: workspace.id,
+        workspaceGrantId: grant.id,
+        deckId,
+    });
+    return { [shared_1.AGENT_DECK_SESSION_HEADER]: session.sessionId };
+}
+//# sourceMappingURL=auth-fixtures.js.map

package/dist/test/auth-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fixtures.js","sourceRoot":"","sources":["../../src/test/auth-fixtures.ts"],"names":[],"mappings":";;AASA,oDAKC;AAED,kDAiBC;AAjCD,+CAG4B;AAG5B,kDAAsE;AACtE,oDAAoF;AAEpF,SAAgB,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAA,kCAA2B,GAAE,CAAC;IAC5C,OAAO;QACL,MAAM,EAAE,GAAG,oCAA2B,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CACjC,EAAmB,EACnB,MAAc,EACd,eAAe,GAAG,uBAAuB;IAEzC,MAAM,KAAK,GAAG,IAAI,2BAAmB,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAA,2BAAmB,GAAE,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAE,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,oBAAoB,CAAC;QACzC,cAAc,EAAE,SAAS,CAAC,EAAE;QAC5B,gBAAgB,EAAE,KAAK,CAAC,EAAE;QAC1B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,kCAAyB,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;AAC5D,CAAC"}

package/dist/trusted-session/admin-secret.d.ts

@@ -0,0 +1,6 @@
+export declare function getAdminSecretPath(): Promise<string>;
+export declare function ensureAdminSecret(): Promise<string>;
+export declare function readAdminSecretFromEnvOrFile(): Promise<string | null>;
+export declare function hashAdminSecret(secret: string): string;
+export declare function verifyAdminSecret(provided: string, expected: string): boolean;
+//# sourceMappingURL=admin-secret.d.ts.map

package/dist/trusted-session/admin-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-secret.d.ts","sourceRoot":"","sources":["../../src/trusted-session/admin-secret.ts"],"names":[],"mappings":"AASA,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAE1D;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBzD;AAED,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAc3E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO7E"}

package/dist/trusted-session/admin-secret.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAdminSecretPath = getAdminSecretPath;
+exports.ensureAdminSecret = ensureAdminSecret;
+exports.readAdminSecretFromEnvOrFile = readAdminSecretFromEnvOrFile;
+exports.hashAdminSecret = hashAdminSecret;
+exports.verifyAdminSecret = verifyAdminSecret;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const shared_1 = require("@agent-deck/shared");
+const ADMIN_SECRET_FILENAME = 'admin-secret';
+const ADMIN_SECRET_ENV = 'AGENT_DECK_ADMIN_SECRET';
+async function getAdminSecretPath() {
+    return node_path_1.default.join((0, shared_1.resolveAgentDeckHome)(), ADMIN_SECRET_FILENAME);
+}
+async function ensureAdminSecret() {
+    const secretPath = await getAdminSecretPath();
+    try {
+        const existing = await promises_1.default.readFile(secretPath, 'utf8');
+        const trimmed = existing.trim();
+        if (trimmed.length >= 32) {
+            return trimmed;
+        }
+    }
+    catch {
+        // create below
+    }
+    const secret = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    await promises_1.default.mkdir(node_path_1.default.dirname(secretPath), { recursive: true, mode: 0o700 });
+    await promises_1.default.writeFile(secretPath, `${secret}\n`, { encoding: 'utf8', mode: 0o600 });
+    return secret;
+}
+async function readAdminSecretFromEnvOrFile() {
+    const fromEnv = process.env[ADMIN_SECRET_ENV]?.trim();
+    if (fromEnv && fromEnv.length >= 32) {
+        return fromEnv;
+    }
+    try {
+        const secretPath = await getAdminSecretPath();
+        const value = await promises_1.default.readFile(secretPath, 'utf8');
+        const trimmed = value.trim();
+        return trimmed.length >= 32 ? trimmed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hashAdminSecret(secret) {
+    return (0, node_crypto_1.createHash)('sha256').update(secret, 'utf8').digest('hex');
+}
+function verifyAdminSecret(provided, expected) {
+    const digest = Buffer.from(hashAdminSecret(provided), 'hex');
+    const expectedDigest = Buffer.from(hashAdminSecret(expected), 'hex');
+    if (digest.length !== expectedDigest.length) {
+        return false;
+    }
+    return (0, node_crypto_1.timingSafeEqual)(digest, expectedDigest);
+}
+//# sourceMappingURL=admin-secret.js.map

package/dist/trusted-session/admin-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-secret.js","sourceRoot":"","sources":["../../src/trusted-session/admin-secret.ts"],"names":[],"mappings":";;;;;AASA,gDAEC;AAED,8CAgBC;AAED,oEAcC;AAED,0CAEC;AAED,8CAOC;AA1DD,6CAAuE;AACvE,gEAAkC;AAClC,0DAA6B;AAE7B,+CAA0D;AAE1D,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAE5C,KAAK,UAAU,kBAAkB;IACtC,OAAO,mBAAI,CAAC,IAAI,CAAC,IAAA,6BAAoB,GAAE,EAAE,qBAAqB,CAAC,CAAC;AAClE,CAAC;AAEM,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,kBAAE,CAAC,KAAK,CAAC,mBAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,MAAM,kBAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,4BAA4B;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC5C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC"}

package/dist/trusted-session/auth.d.ts

@@ -0,0 +1,29 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { type AgentSessionMode, type RuntimeSession, type TrustedSessionErrorCode } from '@agent-deck/shared';
+import type { TrustedSessionStore } from './store';
+export type AuthPolicy = 'allowPublic' | 'requireTrustedWriter' | 'requireAgentResource' | 'requireAgentOrDashboard' | 'requireDeckAdmin' | 'requireDashboard';
+export type RequestPrincipal = {
+    kind: 'public';
+} | {
+    kind: 'dashboard';
+} | {
+    kind: 'agent';
+    session: RuntimeSession;
+    mode: AgentSessionMode;
+    deckId: string;
+    workspaceKey: string;
+};
+export declare class TrustedAuthError extends Error {
+    readonly code: TrustedSessionErrorCode;
+    constructor(code: TrustedSessionErrorCode, message: string);
+}
+export declare function createDashboardSessionToken(): string;
+export declare function validateDashboardSessionToken(token: string): boolean;
+export declare function resolveRequestPrincipal(request: FastifyRequest, store: TrustedSessionStore): Promise<RequestPrincipal>;
+export declare function requireTrustedWriterBearer(request: FastifyRequest): Promise<void>;
+export declare function enforcePolicy(policy: AuthPolicy, principal: RequestPrincipal): void;
+export declare function sendTrustedAuthError(reply: FastifyReply, error: TrustedAuthError): void;
+export declare function getAgentDeckId(principal: RequestPrincipal): string | null;
+export declare function isDashboardPrincipal(principal: RequestPrincipal): boolean;
+export declare function isAgentAdmin(principal: RequestPrincipal): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/trusted-session/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/trusted-session/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5D,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAG7B,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,MAAM,UAAU,GAClB,aAAa,GACb,sBAAsB,GACtB,sBAAsB,GACtB,yBAAyB,GACzB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IACE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM;CAKlB;AAqBD,wBAAgB,2BAA2B,IAAI,MAAM,CAIpD;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUpE;AA+DD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,GAAG,IAAI,CA0BnF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAGvF;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAEzE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAEzE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAEjE"}

package/dist/trusted-session/auth.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedAuthError = void 0;
+exports.createDashboardSessionToken = createDashboardSessionToken;
+exports.validateDashboardSessionToken = validateDashboardSessionToken;
+exports.resolveRequestPrincipal = resolveRequestPrincipal;
+exports.requireTrustedWriterBearer = requireTrustedWriterBearer;
+exports.enforcePolicy = enforcePolicy;
+exports.sendTrustedAuthError = sendTrustedAuthError;
+exports.getAgentDeckId = getAgentDeckId;
+exports.isDashboardPrincipal = isDashboardPrincipal;
+exports.isAgentAdmin = isAgentAdmin;
+const node_crypto_1 = require("node:crypto");
+const shared_1 = require("@agent-deck/shared");
+const http_auth_1 = require("../lib/http-auth");
+const admin_secret_1 = require("./admin-secret");
+class TrustedAuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'TrustedAuthError';
+    }
+}
+exports.TrustedAuthError = TrustedAuthError;
+const dashboardSessions = new Map();
+const DASHBOARD_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+function parseDashboardCookie(request) {
+    const cookieHeader = request.headers.cookie;
+    if (!cookieHeader || typeof cookieHeader !== 'string') {
+        return null;
+    }
+    const prefix = `${shared_1.AGENT_DECK_DASHBOARD_COOKIE}=`;
+    for (const part of cookieHeader.split(';')) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith(prefix)) {
+            return decodeURIComponent(trimmed.slice(prefix.length));
+        }
+    }
+    return null;
+}
+function createDashboardSessionToken() {
+    const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    dashboardSessions.set(token, { expiresAt: Date.now() + DASHBOARD_SESSION_TTL_MS });
+    return token;
+}
+function validateDashboardSessionToken(token) {
+    const entry = dashboardSessions.get(token);
+    if (!entry) {
+        return false;
+    }
+    if (entry.expiresAt <= Date.now()) {
+        dashboardSessions.delete(token);
+        return false;
+    }
+    return true;
+}
+async function resolveDashboardPrincipal(request) {
+    const dashboardToken = parseDashboardCookie(request);
+    if (dashboardToken && validateDashboardSessionToken(dashboardToken)) {
+        return { kind: 'dashboard' };
+    }
+    const bearer = (0, http_auth_1.parseBearerToken)(request);
+    if (bearer) {
+        const expected = await (0, admin_secret_1.readAdminSecretFromEnvOrFile)();
+        if (expected && (0, admin_secret_1.verifyAdminSecret)(bearer, expected)) {
+            return { kind: 'dashboard' };
+        }
+    }
+    return null;
+}
+function resolveAgentFromSessionHeader(request, store) {
+    const sessionHeader = request.headers[shared_1.AGENT_DECK_SESSION_HEADER];
+    const sessionId = typeof sessionHeader === 'string' ? sessionHeader.trim() : '';
+    if (!sessionId) {
+        return null;
+    }
+    const row = store.getRuntimeSessionRow(sessionId);
+    if (!row) {
+        throw new TrustedAuthError('SESSION_INVALID', 'Runtime session absent or expired');
+    }
+    if (row.revoked_at) {
+        throw new TrustedAuthError('SESSION_REVOKED', 'Grant rotation or explicit revocation ended the session');
+    }
+    if (Date.parse(row.expires_at) <= Date.now()) {
+        throw new TrustedAuthError('SESSION_INVALID', 'Runtime session absent or expired');
+    }
+    const session = store.touchRuntimeSession(sessionId);
+    if (!session) {
+        throw new TrustedAuthError('SESSION_INVALID', 'Runtime session absent or expired');
+    }
+    return session;
+}
+function resolveAgentFromGrantSecret(grantSecret, store) {
+    const grant = store.findActiveGrantBySecret(grantSecret);
+    if (!grant) {
+        throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    return store.createRuntimeSession({
+        workspaceKeyId: grant.workspace_key_id,
+        workspaceGrantId: grant.id,
+        deckId: grant.deck_id,
+    });
+}
+async function resolveRequestPrincipal(request, store) {
+    const dashboard = await resolveDashboardPrincipal(request);
+    if (dashboard) {
+        return dashboard;
+    }
+    const sessionFromHeader = resolveAgentFromSessionHeader(request, store);
+    if (sessionFromHeader) {
+        return {
+            kind: 'agent',
+            session: sessionFromHeader,
+            mode: sessionFromHeader.mode,
+            deckId: sessionFromHeader.deckId,
+            workspaceKey: sessionFromHeader.workspaceKey,
+        };
+    }
+    const grantSecret = (0, http_auth_1.parseBearerToken)(request);
+    if (grantSecret) {
+        const session = resolveAgentFromGrantSecret(grantSecret, store);
+        return {
+            kind: 'agent',
+            session,
+            mode: session.mode,
+            deckId: session.deckId,
+            workspaceKey: session.workspaceKey,
+        };
+    }
+    throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+}
+async function requireTrustedWriterBearer(request) {
+    const bearer = (0, http_auth_1.parseBearerToken)(request);
+    const expected = await (0, admin_secret_1.readAdminSecretFromEnvOrFile)();
+    if (!bearer || !expected || !(0, admin_secret_1.verifyAdminSecret)(bearer, expected)) {
+        throw new TrustedAuthError('DASHBOARD_REQUIRED', 'Trusted writer authentication required');
+    }
+}
+function enforcePolicy(policy, principal) {
+    if (policy === 'allowPublic') {
+        return;
+    }
+    if (policy === 'requireDashboard') {
+        if (principal.kind !== 'dashboard') {
+            throw new TrustedAuthError('DASHBOARD_REQUIRED', 'Dashboard authentication required');
+        }
+        return;
+    }
+    if (policy === 'requireAgentOrDashboard') {
+        if (principal.kind === 'dashboard' || principal.kind === 'agent') {
+            return;
+        }
+        throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    if (principal.kind !== 'agent') {
+        throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    if (policy === 'requireDeckAdmin' && principal.mode !== 'agent-admin') {
+        throw new TrustedAuthError('ADMIN_REQUIRED', 'Deck-admin elevation is required');
+    }
+}
+function sendTrustedAuthError(reply, error) {
+    const body = (0, shared_1.trustedSessionError)(error.code, error.message);
+    reply.status((0, shared_1.httpStatusForTrustedError)(error.code)).send(body);
+}
+function getAgentDeckId(principal) {
+    return principal.kind === 'agent' ? principal.deckId : null;
+}
+function isDashboardPrincipal(principal) {
+    return principal.kind === 'dashboard';
+}
+function isAgentAdmin(principal) {
+    return principal.kind === 'agent' && principal.mode === 'agent-admin';
+}
+//# sourceMappingURL=auth.js.map

package/dist/trusted-session/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/trusted-session/auth.ts"],"names":[],"mappings":";;;AAkEA,kEAIC;AAED,sEAUC;AA+DD,0DAiCC;AAED,gEAMC;AAED,sCA0BC;AAED,oDAGC;AAED,wCAEC;AAED,oDAEC;AAED,oCAEC;AAvOD,6CAA0C;AAI1C,+CAQ4B;AAE5B,gDAAoD;AACpD,iDAAiF;AAsBjF,MAAa,gBAAiB,SAAQ,KAAK;IAEvB;IADlB,YACkB,IAA6B,EAC7C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAyB;QAI7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAiC,CAAC;AACnE,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGrD,SAAS,oBAAoB,CAAC,OAAuB;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,oCAA2B,GAAG,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAa;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,OAAuB;IAC9D,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,cAAc,IAAI,6BAA6B,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,IAAA,2CAA4B,GAAE,CAAC;QACtD,IAAI,QAAQ,IAAI,IAAA,gCAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAuB,EACvB,KAA0B;IAE1B,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,kCAAyB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAClC,WAAmB,EACnB,KAA0B;IAE1B,MAAM,KAAK,GAAG,KAAK,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,KAAK,CAAC,oBAAoB,CAAC;QAChC,cAAc,EAAE,KAAK,CAAC,gBAAgB;QACtC,gBAAgB,EAAE,KAAK,CAAC,EAAE;QAC1B,MAAM,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAC3C,OAAuB,EACvB,KAA0B;IAE1B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,iBAAiB;YAC1B,IAAI,EAAE,iBAAiB,CAAC,IAAI;YAC5B,MAAM,EAAE,iBAAiB,CAAC,MAAM;YAChC,YAAY,EAAE,iBAAiB,CAAC,YAAY;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,2BAA2B,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;AAC3E,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAAC,OAAuB;IACtE,MAAM,MAAM,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,IAAA,2CAA4B,GAAE,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,gCAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,wCAAwC,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,MAAkB,EAAE,SAA2B;IAC3E,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAmB,EAAE,KAAuB;IAC/E,MAAM,IAAI,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,KAAK,CAAC,MAAM,CAAC,IAAA,kCAAyB,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAgB,cAAc,CAAC,SAA2B;IACxD,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAgB,oBAAoB,CAAC,SAA2B;IAC9D,OAAO,SAAS,CAAC,IAAI,KAAK,WAAW,CAAC;AACxC,CAAC;AAED,SAAgB,YAAY,CAAC,SAA2B;IACtD,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,CAAC;AACxE,CAAC"}

package/dist/trusted-session/policy-hook.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyInstance } from 'fastify';
+import { type RequestPrincipal } from './auth';
+import { type RegisteredRoute } from './route-policy-registry';
+declare module 'fastify' {
+    interface FastifyRequest {
+        requestPrincipal?: RequestPrincipal;
+    }
+}
+export declare const registeredHttpRoutes: RegisteredRoute[];
+export declare function registerHttpPolicyHook(fastify: FastifyInstance): void;
+export declare function assertAllRoutesHavePolicies(routes?: RegisteredRoute[]): void;
+//# sourceMappingURL=policy-hook.d.ts.map

package/dist/trusted-session/policy-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-hook.d.ts","sourceRoot":"","sources":["../../src/trusted-session/policy-hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;CACF;AAED,eAAO,MAAM,oBAAoB,EAAE,eAAe,EAAO,CAAC;AAE1D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CA6DrE;AAED,wBAAgB,2BAA2B,CAAC,MAAM,GAAE,eAAe,EAAyB,GAAG,IAAI,CAMlG"}

package/dist/trusted-session/policy-hook.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registeredHttpRoutes = void 0;
+exports.registerHttpPolicyHook = registerHttpPolicyHook;
+exports.assertAllRoutesHavePolicies = assertAllRoutesHavePolicies;
+const auth_1 = require("./auth");
+const route_policy_registry_1 = require("./route-policy-registry");
+exports.registeredHttpRoutes = [];
+function registerHttpPolicyHook(fastify) {
+    exports.registeredHttpRoutes.length = 0;
+    fastify.addHook('onRoute', (routeOptions) => {
+        const methods = Array.isArray(routeOptions.method)
+            ? routeOptions.method
+            : [routeOptions.method];
+        for (const method of methods) {
+            exports.registeredHttpRoutes.push({
+                method: String(method).toUpperCase(),
+                url: routeOptions.url,
+            });
+        }
+    });
+    fastify.addHook('onRequest', async (request, reply) => {
+        const pathname = request.url.split('?')[0];
+        if (!(0, route_policy_registry_1.shouldApplyHttpPolicy)(pathname)) {
+            return;
+        }
+        if (request.method === 'HEAD') {
+            return;
+        }
+        const policy = (0, route_policy_registry_1.resolveRoutePolicy)(request.method, pathname);
+        if (!policy) {
+            return (0, auth_1.sendTrustedAuthError)(reply, new auth_1.TrustedAuthError('DASHBOARD_REQUIRED', `No authorization policy for ${request.method} ${pathname}`));
+        }
+        if (policy === 'allowPublic') {
+            request.requestPrincipal = { kind: 'public' };
+            return;
+        }
+        if (policy === 'requireTrustedWriter') {
+            try {
+                await (0, auth_1.requireTrustedWriterBearer)(request);
+                request.requestPrincipal = { kind: 'dashboard' };
+            }
+            catch (error) {
+                if (error instanceof auth_1.TrustedAuthError) {
+                    return (0, auth_1.sendTrustedAuthError)(reply, error);
+                }
+                throw error;
+            }
+            return;
+        }
+        try {
+            const principal = await (0, auth_1.resolveRequestPrincipal)(request, fastify.trustedSessionStore);
+            (0, auth_1.enforcePolicy)(policy, principal);
+            request.requestPrincipal = principal;
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+    });
+}
+function assertAllRoutesHavePolicies(routes = exports.registeredHttpRoutes) {
+    const unmatched = (0, route_policy_registry_1.findUnmatchedRoutes)(routes);
+    if (unmatched.length > 0) {
+        const lines = unmatched.map((route) => `${route.method} ${route.url}`).join('\n');
+        throw new Error(`HTTP routes missing authorization policy:\n${lines}`);
+    }
+}
+//# sourceMappingURL=policy-hook.js.map

package/dist/trusted-session/policy-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-hook.js","sourceRoot":"","sources":["../../src/trusted-session/policy-hook.ts"],"names":[],"mappings":";;;AAyBA,wDA6DC;AAED,kEAMC;AA5FD,iCAOgB;AAChB,mEAKiC;AAQpB,QAAA,oBAAoB,GAAsB,EAAE,CAAC;AAE1D,SAAgB,sBAAsB,CAAC,OAAwB;IAC7D,4BAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,YAAY,CAAC,MAAM;YACrB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,4BAAoB,CAAC,IAAI,CAAC;gBACxB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;gBACpC,GAAG,EAAE,YAAY,CAAC,GAAG;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAA,6CAAqB,EAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,0CAAkB,EAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAA,2BAAoB,EACzB,KAAK,EACL,IAAI,uBAAgB,CAAC,oBAAoB,EAAE,+BAA+B,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CACxG,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,OAAO,CAAC,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAA,iCAA0B,EAAC,OAAO,CAAC,CAAC;gBAC1C,OAAO,CAAC,gBAAgB,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,uBAAgB,EAAE,CAAC;oBACtC,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAuB,EAAC,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACtF,IAAA,oBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAgB,EAAE,CAAC;gBACtC,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,2BAA2B,CAAC,SAA4B,4BAAoB;IAC1F,MAAM,SAAS,GAAG,IAAA,2CAAmB,EAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/trusted-session/route-policy-registry.d.ts

@@ -0,0 +1,20 @@
+import type { AuthPolicy } from './auth';
+export type RoutePolicyRule = {
+    methods: string[];
+    /** Regex against pathname (no query). Use [^/]+ for :param segments. */
+    pattern: RegExp;
+    policy: AuthPolicy;
+};
+/**
+ * Authoritative HTTP route → policy map (NOT-45 §6).
+ * Every /api/* route and /health must match exactly one rule.
+ */
+export declare const HTTP_ROUTE_POLICIES: RoutePolicyRule[];
+export declare function shouldApplyHttpPolicy(pathname: string): boolean;
+export declare function resolveRoutePolicy(method: string, pathname: string): AuthPolicy | null;
+export type RegisteredRoute = {
+    method: string;
+    url: string;
+};
+export declare function findUnmatchedRoutes(routes: RegisteredRoute[]): RegisteredRoute[];
+//# sourceMappingURL=route-policy-registry.d.ts.map

package/dist/trusted-session/route-policy-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-policy-registry.d.ts","sourceRoot":"","sources":["../../src/trusted-session/route-policy-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,eAAe,EA2HhD,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK/D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQtF;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE,CAmBhF"}

package/dist/trusted-session/route-policy-registry.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HTTP_ROUTE_POLICIES = void 0;
+exports.shouldApplyHttpPolicy = shouldApplyHttpPolicy;
+exports.resolveRoutePolicy = resolveRoutePolicy;
+exports.findUnmatchedRoutes = findUnmatchedRoutes;
+/**
+ * Authoritative HTTP route → policy map (NOT-45 §6).
+ * Every /api/* route and /health must match exactly one rule.
+ */
+exports.HTTP_ROUTE_POLICIES = [
+    // Public
+    { methods: ['GET'], pattern: /^\/health$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/callback$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/callback$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+\/icon$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/[^/]+\/icon$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/scope\/display$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/scope\/bindings$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/trusted-session\/admin\/challenges$/, policy: 'allowPublic' },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/mcp\/connect$/, policy: 'allowPublic' },
+    { methods: ['POST'], pattern: /^\/api\/dashboard-auth\/bootstrap\/session$/, policy: 'allowPublic' },
+    // Trusted writer (admin secret bearer only — enforced in policy hook)
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/workspace-grants\/issue$/, policy: 'requireTrustedWriter' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/trusted-session\/workspace-grants\/[^/]+\/revoke-pending$/,
+        policy: 'requireTrustedWriter',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/trusted-session\/workspace-grants\/[^/]+\/activate$/,
+        policy: 'requireTrustedWriter',
+    },
+    { methods: ['POST'], pattern: /^\/api\/dashboard-auth\/bootstrap\/nonce$/, policy: 'requireTrustedWriter' },
+    // Agent resource (runtime session or grant bearer)
+    { methods: ['GET'], pattern: /^\/api\/trusted-session\/runtime-session$/, policy: 'requireAgentResource' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/trusted-session\/admin\/request-elevation$/,
+        policy: 'requireAgentResource',
+    },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/admin\/exit$/, policy: 'requireAgentResource' },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/bind-workspace$/, policy: 'requireAgentResource' },
+    { methods: ['GET'], pattern: /^\/api\/scope\/deck$/, policy: 'requireAgentResource' },
+    { methods: ['POST'], pattern: /^\/api\/scope\/live-display$/, policy: 'requireAgentResource' },
+    { methods: ['DELETE'], pattern: /^\/api\/scope\/live-display\/[^/]+$/, policy: 'requireAgentResource' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/scope\/live-display\/[^/]+\/touch$/,
+        policy: 'requireAgentResource',
+    },
+    { methods: ['POST'], pattern: /^\/api\/scope\/deck-workspace$/, policy: 'requireAgentResource' },
+    // Deck admin (agent-admin mode)
+    { methods: ['POST'], pattern: /^\/api\/decks$/, policy: 'requireDeckAdmin' },
+    // Dashboard-only
+    { methods: ['GET'], pattern: /^\/api\/decks\/active$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/decks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/activate$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/services$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/services\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/services\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/services\/[^/]+\/refresh-icon$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+\/health$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/collection$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/vault$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/credentials$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/credentials\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/credentials\/[^/]+\/rotate$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/credentials\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/collection$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/vault$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/dependents\/check$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/[^/]+\/events\/count$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbooks$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/playbooks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/playbooks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/services\/[^/]+\/tool-settings$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbook-patches$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbook-patches\/[^/]+\/preview$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbook-patches\/[^/]+\/accept$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbook-patches\/[^/]+\/reject$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/feedback-signals$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/feedback-signals\/count$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/feedback-signals\/discard$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/feedback-signals\/import$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/collection\/warnings$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/export$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/import$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/discover$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/setup$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/oauth\/[^/]+\/connect$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/oauth\/[^/]+\/auto-setup$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/authorize$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/oauth\/[^/]+\/refresh$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/status$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/mcp\/discover$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/local-mcp\/import$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/local-mcp\/sample-config$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/local-mcp\/[^/]+\/start$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/local-mcp\/[^/]+\/stop$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/local-mcp\/[^/]+\/status$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/local-mcp\/list$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/admin\/approve$/, policy: 'requireDashboard' },
+    // Agent or dashboard (dual-auth routes — handler branches on principal kind)
+    { methods: ['GET'], pattern: /^\/api\/decks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/decks\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/decks\/[^/]+\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/decks\/[^/]+\/services\/reorder$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/services\/clear$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/credentials$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/credentials$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/playbooks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/playbooks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+\/tools$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/services\/[^/]+\/call$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/summaries$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbook-patches$/, policy: 'requireAgentOrDashboard' },
+];
+function shouldApplyHttpPolicy(pathname) {
+    if (pathname.startsWith('/api/ws/')) {
+        return false;
+    }
+    return pathname === '/health' || pathname === '/' || pathname.startsWith('/api/');
+}
+function resolveRoutePolicy(method, pathname) {
+    const upper = method.toUpperCase();
+    for (const rule of exports.HTTP_ROUTE_POLICIES) {
+        if (rule.methods.includes(upper) && rule.pattern.test(pathname)) {
+            return rule.policy;
+        }
+    }
+    return null;
+}
+function findUnmatchedRoutes(routes) {
+    const unmatched = [];
+    for (const route of routes) {
+        const methods = route.method.split(',').map((m) => m.trim().toUpperCase());
+        if (methods.every((method) => method === 'HEAD')) {
+            continue;
+        }
+        const pathname = route.url.split('?')[0];
+        if (!shouldApplyHttpPolicy(pathname)) {
+            continue;
+        }
+        const matched = methods
+            .filter((method) => method !== 'HEAD')
+            .some((method) => resolveRoutePolicy(method, pathname) !== null);
+        if (!matched) {
+            unmatched.push(route);
+        }
+    }
+    return unmatched;
+}
+//# sourceMappingURL=route-policy-registry.js.map