@agent-deck/backend 1.6.4 → 1.7.1

package/dist/trusted-session/policy-hook.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registeredHttpRoutes = void 0;
+exports.registerHttpPolicyHook = registerHttpPolicyHook;
+exports.assertAllRoutesHavePolicies = assertAllRoutesHavePolicies;
+const auth_1 = require("./auth");
+const route_policy_registry_1 = require("./route-policy-registry");
+exports.registeredHttpRoutes = [];
+function registerHttpPolicyHook(fastify) {
+    exports.registeredHttpRoutes.length = 0;
+    fastify.addHook('onRoute', (routeOptions) => {
+        const methods = Array.isArray(routeOptions.method)
+            ? routeOptions.method
+            : [routeOptions.method];
+        for (const method of methods) {
+            exports.registeredHttpRoutes.push({
+                method: String(method).toUpperCase(),
+                url: routeOptions.url,
+            });
+        }
+    });
+    fastify.addHook('onRequest', async (request, reply) => {
+        const pathname = request.url.split('?')[0];
+        if (!(0, route_policy_registry_1.shouldApplyHttpPolicy)(pathname)) {
+            return;
+        }
+        if (request.method === 'HEAD') {
+            return;
+        }
+        const policy = (0, route_policy_registry_1.resolveRoutePolicy)(request.method, pathname);
+        if (!policy) {
+            return (0, auth_1.sendTrustedAuthError)(reply, new auth_1.TrustedAuthError('DASHBOARD_REQUIRED', `No authorization policy for ${request.method} ${pathname}`));
+        }
+        if (policy === 'allowPublic') {
+            request.requestPrincipal = { kind: 'public' };
+            return;
+        }
+        if (policy === 'requireTrustedWriter') {
+            try {
+                await (0, auth_1.requireTrustedWriterBearer)(request);
+                request.requestPrincipal = { kind: 'dashboard' };
+            }
+            catch (error) {
+                if (error instanceof auth_1.TrustedAuthError) {
+                    return (0, auth_1.sendTrustedAuthError)(reply, error);
+                }
+                throw error;
+            }
+            return;
+        }
+        try {
+            const principal = await (0, auth_1.resolveRequestPrincipal)(request, fastify.trustedSessionStore);
+            (0, auth_1.enforcePolicy)(policy, principal);
+            request.requestPrincipal = principal;
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+    });
+}
+function assertAllRoutesHavePolicies(routes = exports.registeredHttpRoutes) {
+    const unmatched = (0, route_policy_registry_1.findUnmatchedRoutes)(routes);
+    if (unmatched.length > 0) {
+        const lines = unmatched.map((route) => `${route.method} ${route.url}`).join('\n');
+        throw new Error(`HTTP routes missing authorization policy:\n${lines}`);
+    }
+}
+//# sourceMappingURL=policy-hook.js.map

package/dist/trusted-session/policy-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-hook.js","sourceRoot":"","sources":["../../src/trusted-session/policy-hook.ts"],"names":[],"mappings":";;;AAyBA,wDA6DC;AAED,kEAMC;AA5FD,iCAOgB;AAChB,mEAKiC;AAQpB,QAAA,oBAAoB,GAAsB,EAAE,CAAC;AAE1D,SAAgB,sBAAsB,CAAC,OAAwB;IAC7D,4BAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,YAAY,CAAC,MAAM;YACrB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,4BAAoB,CAAC,IAAI,CAAC;gBACxB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;gBACpC,GAAG,EAAE,YAAY,CAAC,GAAG;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAA,6CAAqB,EAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,0CAAkB,EAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAA,2BAAoB,EACzB,KAAK,EACL,IAAI,uBAAgB,CAAC,oBAAoB,EAAE,+BAA+B,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CACxG,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,OAAO,CAAC,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAA,iCAA0B,EAAC,OAAO,CAAC,CAAC;gBAC1C,OAAO,CAAC,gBAAgB,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,uBAAgB,EAAE,CAAC;oBACtC,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAuB,EAAC,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACtF,IAAA,oBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAgB,EAAE,CAAC;gBACtC,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,2BAA2B,CAAC,SAA4B,4BAAoB;IAC1F,MAAM,SAAS,GAAG,IAAA,2CAAmB,EAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/trusted-session/route-policy-registry.d.ts

@@ -0,0 +1,20 @@
+import type { AuthPolicy } from './auth';
+export type RoutePolicyRule = {
+    methods: string[];
+    /** Regex against pathname (no query). Use [^/]+ for :param segments. */
+    pattern: RegExp;
+    policy: AuthPolicy;
+};
+/**
+ * Authoritative HTTP route → policy map (NOT-45 §6).
+ * Every /api/* route and /health must match exactly one rule.
+ */
+export declare const HTTP_ROUTE_POLICIES: RoutePolicyRule[];
+export declare function shouldApplyHttpPolicy(pathname: string): boolean;
+export declare function resolveRoutePolicy(method: string, pathname: string): AuthPolicy | null;
+export type RegisteredRoute = {
+    method: string;
+    url: string;
+};
+export declare function findUnmatchedRoutes(routes: RegisteredRoute[]): RegisteredRoute[];
+//# sourceMappingURL=route-policy-registry.d.ts.map

package/dist/trusted-session/route-policy-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-policy-registry.d.ts","sourceRoot":"","sources":["../../src/trusted-session/route-policy-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,eAAe,EA2HhD,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK/D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAQtF;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE,CAmBhF"}

package/dist/trusted-session/route-policy-registry.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HTTP_ROUTE_POLICIES = void 0;
+exports.shouldApplyHttpPolicy = shouldApplyHttpPolicy;
+exports.resolveRoutePolicy = resolveRoutePolicy;
+exports.findUnmatchedRoutes = findUnmatchedRoutes;
+/**
+ * Authoritative HTTP route → policy map (NOT-45 §6).
+ * Every /api/* route and /health must match exactly one rule.
+ */
+exports.HTTP_ROUTE_POLICIES = [
+    // Public
+    { methods: ['GET'], pattern: /^\/health$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/callback$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/callback$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+\/icon$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/[^/]+\/icon$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/scope\/display$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/scope\/bindings$/, policy: 'allowPublic' },
+    { methods: ['GET'], pattern: /^\/api\/trusted-session\/admin\/challenges$/, policy: 'allowPublic' },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/mcp\/connect$/, policy: 'allowPublic' },
+    { methods: ['POST'], pattern: /^\/api\/dashboard-auth\/bootstrap\/session$/, policy: 'allowPublic' },
+    // Trusted writer (admin secret bearer only — enforced in policy hook)
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/workspace-grants\/issue$/, policy: 'requireTrustedWriter' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/trusted-session\/workspace-grants\/[^/]+\/revoke-pending$/,
+        policy: 'requireTrustedWriter',
+    },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/trusted-session\/workspace-grants\/[^/]+\/activate$/,
+        policy: 'requireTrustedWriter',
+    },
+    { methods: ['POST'], pattern: /^\/api\/dashboard-auth\/bootstrap\/nonce$/, policy: 'requireTrustedWriter' },
+    // Agent resource (runtime session or grant bearer)
+    { methods: ['GET'], pattern: /^\/api\/trusted-session\/runtime-session$/, policy: 'requireAgentResource' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/trusted-session\/admin\/request-elevation$/,
+        policy: 'requireAgentResource',
+    },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/admin\/exit$/, policy: 'requireAgentResource' },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/bind-workspace$/, policy: 'requireAgentResource' },
+    { methods: ['GET'], pattern: /^\/api\/scope\/deck$/, policy: 'requireAgentResource' },
+    { methods: ['POST'], pattern: /^\/api\/scope\/live-display$/, policy: 'requireAgentResource' },
+    { methods: ['DELETE'], pattern: /^\/api\/scope\/live-display\/[^/]+$/, policy: 'requireAgentResource' },
+    {
+        methods: ['POST'],
+        pattern: /^\/api\/scope\/live-display\/[^/]+\/touch$/,
+        policy: 'requireAgentResource',
+    },
+    { methods: ['POST'], pattern: /^\/api\/scope\/deck-workspace$/, policy: 'requireAgentResource' },
+    // Deck admin (agent-admin mode)
+    { methods: ['POST'], pattern: /^\/api\/decks$/, policy: 'requireDeckAdmin' },
+    // Dashboard-only
+    { methods: ['GET'], pattern: /^\/api\/decks\/active$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/decks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/activate$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/services$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/services\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/services\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/services\/[^/]+\/refresh-icon$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+\/health$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/collection$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/vault$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/credentials$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/credentials\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/credentials\/[^/]+\/rotate$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/credentials\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/collection$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/vault$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/dependents\/check$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/[^/]+\/events\/count$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbooks$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/playbooks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/playbooks\/[^/]+$/, policy: 'requireDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/services\/[^/]+\/tool-settings$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbook-patches$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbook-patches\/[^/]+\/preview$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbook-patches\/[^/]+\/accept$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbook-patches\/[^/]+\/reject$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/feedback-signals$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/feedback-signals\/count$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/feedback-signals\/discard$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/feedback-signals\/import$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/collection\/warnings$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/export$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/import$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/discover$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/setup$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/oauth\/[^/]+\/connect$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/oauth\/[^/]+\/auto-setup$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/authorize$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/oauth\/[^/]+\/refresh$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/oauth\/[^/]+\/status$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/mcp\/discover$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/local-mcp\/import$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/local-mcp\/sample-config$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/local-mcp\/[^/]+\/start$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/local-mcp\/[^/]+\/stop$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/local-mcp\/[^/]+\/status$/, policy: 'requireDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/local-mcp\/list$/, policy: 'requireDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/trusted-session\/admin\/approve$/, policy: 'requireDashboard' },
+    // Agent or dashboard (dual-auth routes — handler branches on principal kind)
+    { methods: ['GET'], pattern: /^\/api\/decks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/decks\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/decks\/[^/]+\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['PUT'], pattern: /^\/api\/decks\/[^/]+\/services\/reorder$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/services\/clear$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/credentials$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/credentials$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/decks\/[^/]+\/playbooks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['DELETE'], pattern: /^\/api\/decks\/[^/]+\/playbooks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/services\/[^/]+\/tools$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/services\/[^/]+\/call$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/credentials\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/summaries$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['GET'], pattern: /^\/api\/playbooks\/[^/]+$/, policy: 'requireAgentOrDashboard' },
+    { methods: ['POST'], pattern: /^\/api\/playbook-patches$/, policy: 'requireAgentOrDashboard' },
+];
+function shouldApplyHttpPolicy(pathname) {
+    if (pathname.startsWith('/api/ws/')) {
+        return false;
+    }
+    return pathname === '/health' || pathname === '/' || pathname.startsWith('/api/');
+}
+function resolveRoutePolicy(method, pathname) {
+    const upper = method.toUpperCase();
+    for (const rule of exports.HTTP_ROUTE_POLICIES) {
+        if (rule.methods.includes(upper) && rule.pattern.test(pathname)) {
+            return rule.policy;
+        }
+    }
+    return null;
+}
+function findUnmatchedRoutes(routes) {
+    const unmatched = [];
+    for (const route of routes) {
+        const methods = route.method.split(',').map((m) => m.trim().toUpperCase());
+        if (methods.every((method) => method === 'HEAD')) {
+            continue;
+        }
+        const pathname = route.url.split('?')[0];
+        if (!shouldApplyHttpPolicy(pathname)) {
+            continue;
+        }
+        const matched = methods
+            .filter((method) => method !== 'HEAD')
+            .some((method) => resolveRoutePolicy(method, pathname) !== null);
+        if (!matched) {
+            unmatched.push(route);
+        }
+    }
+    return unmatched;
+}
+//# sourceMappingURL=route-policy-registry.js.map

package/dist/trusted-session/route-policy-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-policy-registry.js","sourceRoot":"","sources":["../../src/trusted-session/route-policy-registry.ts"],"names":[],"mappings":";;;AA0IA,sDAKC;AAED,gDAQC;AAID,kDAmBC;AAvKD;;;GAGG;AACU,QAAA,mBAAmB,GAAsB;IACpD,SAAS;IACT,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE;IAClE,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE;IAC5D,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,aAAa,EAAE;IAChF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,aAAa,EAAE;IACvF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,aAAa,EAAE;IACtF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,aAAa,EAAE;IACzF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,aAAa,EAAE;IAC/E,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,aAAa,EAAE;IAChF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,aAAa,EAAE;IACnG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,aAAa,EAAE;IAC/F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,MAAM,EAAE,aAAa,EAAE;IAEpG,sEAAsE;IACtE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACnH;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,mEAAmE;QAC5E,MAAM,EAAE,sBAAsB;KAC/B;IACD;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,6DAA6D;QACtE,MAAM,EAAE,sBAAsB;KAC/B;IACD,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAE3G,mDAAmD;IACnD,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC1G;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,oDAAoD;QAC7D,MAAM,EAAE,sBAAsB;KAC/B;IACD,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACvG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC1G,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACrF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC9F,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACvG;QACE,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,4CAA4C;QACrD,MAAM,EAAE,sBAAsB;KAC/B;IACD,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAEhG,gCAAgC;IAChC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAE5E,iBAAiB;IACjB,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACnF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAClF,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACrF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC/E,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACrF,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACxF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACpG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACxF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAClF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACxF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACjG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC3F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC3F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAClG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACrG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAChF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtF,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACzF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACpG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAChG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC/F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC1F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7E,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7E,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC5F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACzF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC5F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC/F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC5F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC1F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACpF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACxF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC9F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC9F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC7F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAC9F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACrF,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAEtG,6EAA6E;IAC7E,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAClF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACzF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACnG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACpG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACtG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC5G,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC7G,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACvG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACzG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACrG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACvG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACrF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC5F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACnG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACnG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACxF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC/F,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACjG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACtF,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC7F,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,yBAAyB,EAAE;CAC/F,CAAC;AAEF,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAc,EAAE,QAAgB;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,2BAAmB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAID,SAAgB,mBAAmB,CAAC,MAAyB;IAC3D,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YACjD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,OAAO;aACpB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC;aACrC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/trusted-session/store.d.ts

@@ -0,0 +1,93 @@
+import { type AgentSessionMode, type RuntimeSession, type WorkspaceGrantStatus } from '@agent-deck/shared';
+import type Database from 'better-sqlite3';
+export type WorkspaceKeyRow = {
+    id: string;
+    path_digest: string;
+    created_at: string;
+};
+export type WorkspaceGrantRow = {
+    id: string;
+    workspace_key_id: string;
+    deck_id: string;
+    secret_hash: string;
+    status: WorkspaceGrantStatus;
+    created_at: string;
+    activated_at: string | null;
+    revoked_at: string | null;
+};
+export type RuntimeSessionRow = {
+    id: string;
+    mcp_session_id: string | null;
+    workspace_key_id: string;
+    workspace_grant_id: string;
+    deck_id: string;
+    mode: AgentSessionMode;
+    last_seen_at: string;
+    expires_at: string;
+    admin_expires_at: string | null;
+    revoked_at: string | null;
+};
+export type AdminChallengeRow = {
+    id: string;
+    runtime_session_id: string;
+    consumed_at: string | null;
+    expires_at: string;
+    created_at: string;
+};
+export declare function hashGrantSecret(secret: string): string;
+export declare function generateGrantSecret(): string;
+export declare function verifyGrantSecret(secret: string, secretHash: string): boolean;
+export declare class TrustedSessionStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    private ensureTables;
+    getOrCreateWorkspaceKey(pathDigest: string): WorkspaceKeyRow;
+    getWorkspaceKeyById(id: string): WorkspaceKeyRow | null;
+    getActiveGrantForWorkspace(workspaceKeyId: string): WorkspaceGrantRow | null;
+    getGrantById(grantId: string): WorkspaceGrantRow | null;
+    findActiveGrantBySecret(secret: string): WorkspaceGrantRow | null;
+    createPendingGrant(workspaceKeyId: string, deckId: string, secret: string): WorkspaceGrantRow;
+    activateGrant(grantId: string): WorkspaceGrantRow | null;
+    revokeGrant(grantId: string): void;
+    revokeSessionsForGrant(grantId: string, revokedAt?: string): number;
+    createRuntimeSession(input: {
+        workspaceKeyId: string;
+        workspaceGrantId: string;
+        deckId: string;
+        mcpSessionId?: string;
+    }): RuntimeSession;
+    findActiveRuntimeSessionForMcp(mcpSessionId: string, grantId: string): RuntimeSession | null;
+    getRuntimeSessionModeByMcpSessionId(mcpSessionId: string): AgentSessionMode | null;
+    getRuntimeSessionModesByMcpSessionIds(mcpSessionIds: string[]): Map<string, AgentSessionMode>;
+    revokePendingGrant(grantId: string): void;
+    createDashboardNonce(nonce: string, expiresAtIso: string): void;
+    consumeDashboardNonce(nonce: string): boolean;
+    expireDashboardNonces(): number;
+    getRuntimeSessionRow(sessionId: string): RuntimeSessionRow | null;
+    touchRuntimeSession(sessionId: string): RuntimeSession | null;
+    elevateSessionToAdmin(sessionId: string): RuntimeSession | null;
+    downgradeSessionToNormal(sessionId: string): RuntimeSession | null;
+    revokeRuntimeSession(sessionId: string): void;
+    createAdminChallenge(runtimeSessionId: string): AdminChallengeRow;
+    consumeAdminChallenge(challengeId: string, runtimeSessionId: string): boolean;
+    listPendingAdminChallenges(): Array<{
+        challengeId: string;
+        runtimeSessionId: string;
+        deckId: string;
+        expiresAt: string;
+        createdAt: string;
+    }>;
+    countWorkspacesForDeck(deckId: string): number;
+    /**
+     * C8: elevated-agent deck change — rotate grant, rebind approving session, revoke peers.
+     * Plaintext grant secret is stored hashed only; caller must run `agent-deck use` to refresh local grant file.
+     */
+    rotateGrantForElevatedSession(runtimeSessionId: string, newDeckId: string): {
+        session: RuntimeSession;
+        peersRevoked: number;
+        grantId: string;
+    } | null;
+    expireStaleSessions(): number;
+    private toRuntimeSession;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/trusted-session/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/trusted-session/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO7E;AAUD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAIlD,OAAO,CAAC,YAAY;IA4DpB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe;IAkB5D,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAQvD,0BAA0B,CAAC,cAAc,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAY5E,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAWvD,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAYjE,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAyB7F,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IA2BxD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAUlC,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAiB,GAAG,MAAM;IAS7E,oBAAoB,CAAC,KAAK,EAAE;QAC1B,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,cAAc;IAyBlB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAoB5F,mCAAmC,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAIlF,qCAAqC,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAkB7F,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAUzC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAQ/D,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAiB7C,qBAAqB,IAAI,MAAM;IAQ/B,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAYjE,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkC7D,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkB/D,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkBlE,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAM7C,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,iBAAiB;IAqBjE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAqB7E,0BAA0B,IAAI,KAAK,CAAC;QAClC,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IA4BF,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAW9C;;;OAGG;IACH,6BAA6B,CAC3B,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,GAChB;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAoD5E,mBAAmB,IAAI,MAAM;IAuB7B,OAAO,CAAC,gBAAgB;CAazB"}