@agent-deck/backend 1.6.4 → 1.7.1

package/dist/lib/agent-deck-context.d.ts

@@ -1,8 +1,10 @@
 import { FastifyRequest } from 'fastify';
 import { DatabaseManager } from '../models/database';
 export declare class AgentDeckContextError extends Error {
-    constructor(message: string);
+    readonly errorCode?: string | undefined;
+    constructor(message: string, errorCode?: string | undefined);
 }
-/** Resolve which deck an agent request is scoped to (session deck id header only). */
+/** Resolve bound deck from authenticated runtime session (PRD C3). */
 export declare function resolveAgentDeckId(request: FastifyRequest, db: DatabaseManager): Promise<string>;
+export declare function resolveAgentMode(request: FastifyRequest): Promise<'normal' | 'agent-admin'>;
 //# sourceMappingURL=agent-deck-context.d.ts.map

package/dist/lib/agent-deck-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-deck-context.d.ts","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAOD,sFAAsF;AACtF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB"}
+{"version":3,"file":"agent-deck-context.d.ts","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,qBAAa,qBAAsB,SAAQ,KAAK;aAG5B,SAAS,CAAC,EAAE,MAAM;gBADlC,OAAO,EAAE,MAAM,EACC,SAAS,CAAC,EAAE,MAAM,YAAA;CAKrC;AAOD,sEAAsE;AACtE,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,GAAG,aAAa,CAAC,CAOnC"}

package/dist/lib/agent-deck-context.js

@@ -2,10 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgentDeckContextError = void 0;
 exports.resolveAgentDeckId = resolveAgentDeckId;
+exports.resolveAgentMode = resolveAgentMode;
 const shared_1 = require("@agent-deck/shared");
+const auth_1 = require("../trusted-session/auth");
 class AgentDeckContextError extends Error {
-    constructor(message) {
+    errorCode;
+    constructor(message, errorCode) {
         super(message);
+        this.errorCode = errorCode;
         this.name = 'AgentDeckContextError';
     }
 }
@@ -14,16 +18,39 @@ function headerValue(request, name) {
     const value = request.headers[name];
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
-/** Resolve which deck an agent request is scoped to (session deck id header only). */
+/** Resolve bound deck from authenticated runtime session (PRD C3). */
 async function resolveAgentDeckId(request, db) {
-    const deckIdHeader = headerValue(request, shared_1.AGENT_DECK_DECK_ID_HEADER);
-    if (!deckIdHeader) {
-        throw new AgentDeckContextError('No bound deck — call bind_workspace with deckId (use get_decks to list decks) or switch_bound_deck');
+    const sessionId = headerValue(request, shared_1.AGENT_DECK_SESSION_HEADER);
+    if (!sessionId) {
+        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('GRANT_REQUIRED', 'No valid workspace grant').error, 'GRANT_REQUIRED');
     }
-    const deck = await db.getDeck(deckIdHeader);
+    const store = request.server.trustedSessionStore;
+    const row = store.getRuntimeSessionRow(sessionId);
+    if (!row) {
+        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_INVALID', 'Runtime session absent or expired').error, 'SESSION_INVALID');
+    }
+    if (row.revoked_at) {
+        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_REVOKED', 'Grant rotation or explicit revocation ended the session').error, 'SESSION_REVOKED');
+    }
+    if (Date.parse(row.expires_at) <= Date.now()) {
+        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_INVALID', 'Runtime session absent or expired').error, 'SESSION_INVALID');
+    }
+    const session = store.touchRuntimeSession(sessionId);
+    if (!session) {
+        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_INVALID', 'Runtime session absent or expired').error, 'SESSION_INVALID');
+    }
+    const deck = await db.getDeck(session.deckId);
     if (!deck) {
-        throw new AgentDeckContextError(`Deck not found: ${deckIdHeader}`);
+        throw new auth_1.TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    return session.deckId;
+}
+async function resolveAgentMode(request) {
+    const sessionId = headerValue(request, shared_1.AGENT_DECK_SESSION_HEADER);
+    if (!sessionId) {
+        return 'normal';
     }
-    return deckIdHeader;
+    const row = request.server.trustedSessionStore.getRuntimeSessionRow(sessionId);
+    return row?.mode ?? 'normal';
 }
 //# sourceMappingURL=agent-deck-context.js.map

package/dist/lib/agent-deck-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-deck-context.js","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":";;;AAiBA,gDAgBC;AAhCD,+CAA+D;AAG/D,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAED,SAAS,WAAW,CAAC,OAAuB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,sFAAsF;AAC/E,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,EAAmB;IAEnB,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,kCAAyB,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,qBAAqB,CAC7B,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}
+{"version":3,"file":"agent-deck-context.js","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":";;;AAqBA,gDA+CC;AAED,4CASC;AA9ED,+CAAoF;AAEpF,kDAA2D;AAE3D,MAAa,qBAAsB,SAAQ,KAAK;IAG5B;IAFlB,YACE,OAAe,EACC,SAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAS;QAGlC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AARD,sDAQC;AAED,SAAS,WAAW,CAAC,OAAuB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,sEAAsE;AAC/D,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,EAAmB;IAEnB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,kCAAyB,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC,KAAK,EACvE,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC,KAAK,EACvG,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,uBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,OAAuB;IAEvB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,kCAAyB,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/E,OAAO,GAAG,EAAE,IAAI,IAAI,QAAQ,CAAC;AAC/B,CAAC"}

package/dist/lib/backend-api-error.d.ts

@@ -0,0 +1,8 @@
+import type { TrustedSessionErrorCode } from '@agent-deck/shared';
+export declare class BackendApiError extends Error {
+    readonly status: number;
+    readonly errorCode?: TrustedSessionErrorCode | undefined;
+    constructor(message: string, status: number, errorCode?: TrustedSessionErrorCode | undefined);
+}
+export declare function parseBackendErrorBody(text: string, status: number): BackendApiError;
+//# sourceMappingURL=backend-api-error.d.ts.map

package/dist/lib/backend-api-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-api-error.d.ts","sourceRoot":"","sources":["../../src/lib/backend-api-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,SAAS,CAAC,EAAE,uBAAuB;gBAFnD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,uBAAuB,YAAA;CAKtD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAmBnF"}

package/dist/lib/backend-api-error.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackendApiError = void 0;
+exports.parseBackendErrorBody = parseBackendErrorBody;
+class BackendApiError extends Error {
+    status;
+    errorCode;
+    constructor(message, status, errorCode) {
+        super(message);
+        this.status = status;
+        this.errorCode = errorCode;
+        this.name = 'BackendApiError';
+    }
+}
+exports.BackendApiError = BackendApiError;
+function parseBackendErrorBody(text, status) {
+    let message = `Backend API error: ${status}`;
+    let errorCode;
+    try {
+        const body = JSON.parse(text);
+        if (body.error) {
+            message = String(body.error);
+        }
+        if (body.error_code) {
+            errorCode = body.error_code;
+        }
+    }
+    catch {
+        if (text.trim()) {
+            message = text.trim();
+        }
+    }
+    return new BackendApiError(message, status, errorCode);
+}
+//# sourceMappingURL=backend-api-error.js.map

package/dist/lib/backend-api-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-api-error.js","sourceRoot":"","sources":["../../src/lib/backend-api-error.ts"],"names":[],"mappings":";;;AAaA,sDAmBC;AA9BD,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,SAAmC;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAA0B;QAGnD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AATD,0CASC;AAED,SAAgB,qBAAqB,CAAC,IAAY,EAAE,MAAc;IAChE,IAAI,OAAO,GAAG,sBAAsB,MAAM,EAAE,CAAC;IAC7C,IAAI,SAA8C,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6D,CAAC;QAC1F,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC"}

package/dist/lib/bound-deck-scope.d.ts

@@ -1,15 +1,20 @@
 import { FastifyRequest } from 'fastify';
 import { DatabaseManager } from '../models/database';
+import { trustedSessionError, type TrustedSessionErrorCode } from '@agent-deck/shared';
 export declare class BoundDeckScopeError extends Error {
-    constructor(message?: string);
+    readonly errorCode: TrustedSessionErrorCode;
+    constructor(message?: string, errorCode?: TrustedSessionErrorCode);
 }
 /** Agent clients may only mutate the workspace-bound deck; dashboard may use any deck id. */
 export declare function requireBoundDeckScope(request: FastifyRequest, db: DatabaseManager, deckId: string): Promise<string>;
 export declare function requireServiceOnBoundDeck(request: FastifyRequest, db: DatabaseManager, serviceId: string): Promise<void>;
+export declare function requireCredentialOnBoundDeck(request: FastifyRequest, db: DatabaseManager, credentialId: string): Promise<void>;
 export declare function requirePlaybookOnBoundDeck(request: FastifyRequest, db: DatabaseManager, playbookId: string): Promise<void>;
 declare function boundDeckScopeResponse(error: unknown): {
     status: number;
     message: string;
+    error_code?: TrustedSessionErrorCode;
+    body?: ReturnType<typeof trustedSessionError>;
 };
 export { boundDeckScopeResponse };
 //# sourceMappingURL=bound-deck-scope.d.ts.map

package/dist/lib/bound-deck-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bound-deck-scope.d.ts","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIrD,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAqD;CAIzE;AAED,6FAA6F;AAC7F,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,iBAAS,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAWnF;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"bound-deck-scope.d.ts","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,qBAAa,mBAAoB,SAAQ,KAAK;aAG1B,SAAS,EAAE,uBAAuB;gBADlD,OAAO,SAAuC,EAC9B,SAAS,GAAE,uBAAiD;CAK/E;AAED,6FAA6F;AAC7F,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,iBAAS,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;CAC/C,CAgBA;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/lib/bound-deck-scope.js

@@ -3,13 +3,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BoundDeckScopeError = void 0;
 exports.requireBoundDeckScope = requireBoundDeckScope;
 exports.requireServiceOnBoundDeck = requireServiceOnBoundDeck;
+exports.requireCredentialOnBoundDeck = requireCredentialOnBoundDeck;
 exports.requirePlaybookOnBoundDeck = requirePlaybookOnBoundDeck;
 exports.boundDeckScopeResponse = boundDeckScopeResponse;
 const agent_deck_context_1 = require("./agent-deck-context");
 const client_scope_1 = require("./client-scope");
+const shared_1 = require("@agent-deck/shared");
 class BoundDeckScopeError extends Error {
-    constructor(message = 'This operation is only allowed on the bound deck') {
+    errorCode;
+    constructor(message = 'Resource is outside the bound deck', errorCode = 'RESOURCE_OUT_OF_SCOPE') {
         super(message);
+        this.errorCode = errorCode;
         this.name = 'BoundDeckScopeError';
     }
 }
@@ -39,6 +43,16 @@ async function requireServiceOnBoundDeck(request, db, serviceId) {
         throw new BoundDeckScopeError('Service is not on the bound deck');
     }
 }
+async function requireCredentialOnBoundDeck(request, db, credentialId) {
+    if ((0, client_scope_1.isDashboardClient)(request)) {
+        return;
+    }
+    const deckId = await (0, agent_deck_context_1.resolveAgentDeckId)(request, db);
+    const onDeck = await db.getDeck(deckId).then((deck) => deck?.credentials?.some((credential) => credential.id === credentialId) ?? false);
+    if (!onDeck) {
+        throw new BoundDeckScopeError('Credential is not on the bound deck');
+    }
+}
 async function requirePlaybookOnBoundDeck(request, db, playbookId) {
     if ((0, client_scope_1.isDashboardClient)(request)) {
         return;
@@ -55,7 +69,12 @@ async function requirePlaybookOnBoundDeck(request, db, playbookId) {
 }
 function boundDeckScopeResponse(error) {
     if (error instanceof BoundDeckScopeError) {
-        return { status: 403, message: error.message };
+        return {
+            status: 403,
+            message: error.message,
+            error_code: error.errorCode,
+            body: (0, shared_1.trustedSessionError)(error.errorCode, error.message),
+        };
     }
     if (error instanceof agent_deck_context_1.AgentDeckContextError) {
         return { status: 400, message: error.message };

package/dist/lib/bound-deck-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"bound-deck-scope.js","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":";;;AAaA,sDAiBC;AAED,8DAmBC;AAED,gEAmBC;AAeQ,wDAAsB;AArF/B,6DAAiF;AACjF,iDAAmD;AAEnD,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,GAAG,kDAAkD;QACtE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AAED,6FAA6F;AACtF,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,EAAmB,EACnB,MAAc;IAEd,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,WAAW,SAAS,MAAM,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,EAAmB,EACnB,SAAiB;IAEjB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC;IACnF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC9C,OAAuB,EACvB,EAAmB,EACnB,UAAkB;IAElB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,KAAK,CAAC;IACvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,YAAY,0CAAqB,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KAClE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bound-deck-scope.js","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":";;;AAiBA,sDAiBC;AAED,8DAmBC;AAED,oEAgBC;AAED,gEAmBC;AAyBQ,wDAAsB;AArH/B,6DAAiF;AACjF,iDAAmD;AACnD,+CAAuF;AAEvF,MAAa,mBAAoB,SAAQ,KAAK;IAG1B;IAFlB,YACE,OAAO,GAAG,oCAAoC,EAC9B,YAAqC,uBAAuB;QAE5E,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAmD;QAG5E,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AARD,kDAQC;AAED,6FAA6F;AACtF,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,EAAmB,EACnB,MAAc;IAEd,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,WAAW,SAAS,MAAM,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,EAAmB,EACnB,SAAiB;IAEjB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC;IACnF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,OAAuB,EACvB,EAAmB,EACnB,YAAoB;IAEpB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,KAAK,CAC3F,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC9C,OAAuB,EACvB,EAAmB,EACnB,UAAkB;IAElB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,KAAK,CAAC;IACvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAM5C,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,IAAI,EAAE,IAAA,4BAAmB,EAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,0CAAqB,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KAClE,CAAC;AACJ,CAAC"}

package/dist/lib/client-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-scope.d.ts","sourceRoot":"","sources":["../../src/lib/client-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAIL,IAAI,EACJ,OAAO,EACR,MAAM,oBAAoB,CAAC;AAG5B,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEhD,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAWjE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAKrD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW,CAMnE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAElE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAIpE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAKhE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAuD;CAI3E;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAA4D;CAIhF;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI,CASN;AAED,qCAAqC;AACrC,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI,CAEN"}
+{"version":3,"file":"client-scope.d.ts","sourceRoot":"","sources":["../../src/lib/client-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAGL,IAAI,EACJ,OAAO,EACR,MAAM,oBAAoB,CAAC;AAI5B,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAEhD,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAWjE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAKrD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW,CAKnE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAElE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAIpE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAKhE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAuD;CAI3E;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAA4D;CAIhF;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI,CASN;AAED,qCAAqC;AACrC,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI,CAEN"}

package/dist/lib/client-scope.js

@@ -11,6 +11,7 @@ exports.applyDeckScope = applyDeckScope;
 exports.applyDeckCredentialScope = applyDeckCredentialScope;
 const shared_1 = require("@agent-deck/shared");
 const sanitize_for_export_1 = require("../export-import/sanitize-for-export");
+const dashboard_auth_1 = require("./dashboard-auth");
 /** Remove secrets from service payloads returned to agent clients. */
 function sanitizeServiceForAgent(service) {
     return {
@@ -31,14 +32,13 @@ function sanitizeDeckForAgent(deck) {
     };
 }
 function getClientScope(request) {
-    const value = request.headers[shared_1.AGENT_DECK_CLIENT_HEADER];
-    if (typeof value === 'string' && value.toLowerCase() === shared_1.AGENT_DECK_DASHBOARD_CLIENT) {
+    if ((0, dashboard_auth_1.isDashboardAuthenticated)(request)) {
         return 'dashboard';
     }
     return 'agent';
 }
 function isDashboardClient(request) {
-    return getClientScope(request) === 'dashboard';
+    return (0, dashboard_auth_1.isDashboardAuthenticated)(request);
 }
 function requireDashboardClient(request) {
     if (!isDashboardClient(request)) {

package/dist/lib/client-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-scope.js","sourceRoot":"","sources":["../../src/lib/client-scope.ts"],"names":[],"mappings":";;;AAaA,0DAWC;AAED,oDAKC;AAED,wCAMC;AAED,8CAEC;AAED,wDAIC;AAED,gDAKC;AAiBD,wCAaC;AAGD,4DAMC;AA9FD,+CAM4B;AAC5B,8EAAgF;AAIhF,sEAAsE;AACtE,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,OAAO;QACL,GAAG,OAAO;QACV,iBAAiB,EAAE,SAAS;QAC5B,gBAAgB,EAAE,SAAS;QAC3B,iBAAiB,EAAE,SAAS;QAC5B,UAAU,EAAE,SAAS;QACrB,sFAAsF;QACtF,OAAO,EAAE,IAAA,8CAAwB,EAAC,OAAO,CAAC,OAAO,CAAC;QAClD,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,IAAU;IAC7C,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAAC,OAAuB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAwB,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,oCAA2B,EAAE,CAAC;QACrF,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,OAAO,cAAc,CAAC,OAAO,CAAC,KAAK,WAAW,CAAC;AACjD,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAAuB;IAC5D,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAuB;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAwB,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,gCAAuB,EAAE,CAAC;QACjF,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,GAAG,oDAAoD;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAED,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,GAAG,yDAAyD;QAC7E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED,oFAAoF;AACpF,SAAgB,cAAc,CAC5B,IAAU,EACV,KAAkB,EAClB,aAAsB;IAEtB,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,qCAAqC;AACrC,SAAgB,wBAAwB,CACtC,IAAU,EACV,KAAkB,EAClB,aAAsB;IAEtB,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"client-scope.js","sourceRoot":"","sources":["../../src/lib/client-scope.ts"],"names":[],"mappings":";;;AAaA,0DAWC;AAED,oDAKC;AAED,wCAKC;AAED,8CAEC;AAED,wDAIC;AAED,gDAKC;AAiBD,wCAaC;AAGD,4DAMC;AA7FD,+CAK4B;AAC5B,8EAAgF;AAChF,qDAA4D;AAI5D,sEAAsE;AACtE,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,OAAO;QACL,GAAG,OAAO;QACV,iBAAiB,EAAE,SAAS;QAC5B,gBAAgB,EAAE,SAAS;QAC3B,iBAAiB,EAAE,SAAS;QAC5B,UAAU,EAAE,SAAS;QACrB,sFAAsF;QACtF,OAAO,EAAE,IAAA,8CAAwB,EAAC,OAAO,CAAC,OAAO,CAAC;QAClD,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,IAAU;IAC7C,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAAC,OAAuB;IACpD,IAAI,IAAA,yCAAwB,EAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,OAAO,IAAA,yCAAwB,EAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAAuB;IAC5D,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAuB;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAwB,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,gCAAuB,EAAE,CAAC;QACjF,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,GAAG,oDAAoD;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAED,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,GAAG,yDAAyD;QAC7E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED,oFAAoF;AACpF,SAAgB,cAAc,CAC5B,IAAU,EACV,KAAkB,EAClB,aAAsB;IAEtB,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,qCAAqC;AACrC,SAAgB,wBAAwB,CACtC,IAAU,EACV,KAAkB,EAClB,aAAsB;IAEtB,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC"}

package/dist/lib/dashboard-auth.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyRequest } from 'fastify';
+import { validateDashboardSessionToken } from '../trusted-session/auth';
+export { validateDashboardSessionToken };
+export declare function parseDashboardCookie(request: FastifyRequest): string | null;
+export declare function isDashboardAuthenticated(request: FastifyRequest): boolean;
+export declare function isTrustedWriterBearer(request: FastifyRequest): Promise<boolean>;
+//# sourceMappingURL=dashboard-auth.d.ts.map

package/dist/lib/dashboard-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-auth.d.ts","sourceRoot":"","sources":["../../src/lib/dashboard-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAK9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAGxE,OAAO,EAAE,6BAA6B,EAAE,CAAC;AAEzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAa3E;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAGzE;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAOrF"}

package/dist/lib/dashboard-auth.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateDashboardSessionToken = void 0;
+exports.parseDashboardCookie = parseDashboardCookie;
+exports.isDashboardAuthenticated = isDashboardAuthenticated;
+exports.isTrustedWriterBearer = isTrustedWriterBearer;
+const shared_1 = require("@agent-deck/shared");
+const http_auth_1 = require("../lib/http-auth");
+const auth_1 = require("../trusted-session/auth");
+Object.defineProperty(exports, "validateDashboardSessionToken", { enumerable: true, get: function () { return auth_1.validateDashboardSessionToken; } });
+const admin_secret_1 = require("../trusted-session/admin-secret");
+function parseDashboardCookie(request) {
+    const cookieHeader = request.headers.cookie;
+    if (!cookieHeader || typeof cookieHeader !== 'string') {
+        return null;
+    }
+    const prefix = `${shared_1.AGENT_DECK_DASHBOARD_COOKIE}=`;
+    for (const part of cookieHeader.split(';')) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith(prefix)) {
+            return decodeURIComponent(trimmed.slice(prefix.length));
+        }
+    }
+    return null;
+}
+function isDashboardAuthenticated(request) {
+    const token = parseDashboardCookie(request);
+    return token !== null && (0, auth_1.validateDashboardSessionToken)(token);
+}
+async function isTrustedWriterBearer(request) {
+    const bearer = (0, http_auth_1.parseBearerToken)(request);
+    if (!bearer) {
+        return false;
+    }
+    const expected = await (0, admin_secret_1.readAdminSecretFromEnvOrFile)();
+    return Boolean(expected && (0, admin_secret_1.verifyAdminSecret)(bearer, expected));
+}
+//# sourceMappingURL=dashboard-auth.js.map

package/dist/lib/dashboard-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-auth.js","sourceRoot":"","sources":["../../src/lib/dashboard-auth.ts"],"names":[],"mappings":";;;AAUA,oDAaC;AAED,4DAGC;AAED,sDAOC;AAnCD,+CAAiE;AAEjE,gDAAoD;AACpD,kDAAwE;AAG/D,8GAHA,oCAA6B,OAGA;AAFtC,kEAAkG;AAIlG,SAAgB,oBAAoB,CAAC,OAAuB;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,oCAA2B,GAAG,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAAuB;IAC9D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,KAAK,KAAK,IAAI,IAAI,IAAA,oCAA6B,EAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAC,OAAuB;IACjE,MAAM,MAAM,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,2CAA4B,GAAE,CAAC;IACtD,OAAO,OAAO,CAAC,QAAQ,IAAI,IAAA,gCAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/lib/http-auth.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyRequest } from 'fastify';
+export declare function parseBearerToken(request: FastifyRequest | {
+    headers: Record<string, unknown>;
+}): string | null;
+//# sourceMappingURL=http-auth.d.ts.map

package/dist/lib/http-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../../src/lib/http-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAM9G"}

package/dist/lib/http-auth.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseBearerToken = parseBearerToken;
+function parseBearerToken(request) {
+    const header = request.headers.authorization;
+    if (!header || typeof header !== 'string' || !header.startsWith('Bearer ')) {
+        return null;
+    }
+    return header.slice('Bearer '.length).trim() || null;
+}
+//# sourceMappingURL=http-auth.js.map

package/dist/lib/http-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../../src/lib/http-auth.ts"],"names":[],"mappings":";;AAEA,4CAMC;AAND,SAAgB,gBAAgB,CAAC,OAA8D;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACvD,CAAC"}

package/dist/lib/route-policy.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { type TrustedSessionErrorCode } from '@agent-deck/shared';
+import type { DatabaseManager } from '../models/database';
+export declare class RoutePolicyError extends Error {
+    readonly code: TrustedSessionErrorCode;
+    constructor(code: TrustedSessionErrorCode, message: string);
+}
+export declare function sendRoutePolicyError(reply: FastifyReply, error: RoutePolicyError): void;
+export declare function requireDashboard(request: FastifyRequest): void;
+export declare function requireAgentBoundDeck(request: FastifyRequest, db: DatabaseManager): Promise<string>;
+export declare function requireAgentAdmin(request: FastifyRequest): void;
+export declare function getBoundDeckServices(request: FastifyRequest, db: DatabaseManager): Promise<any[]>;
+//# sourceMappingURL=route-policy.d.ts.map

package/dist/lib/route-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-policy.d.ts","sourceRoot":"","sources":["../../src/lib/route-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAEvF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAI9D;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAU/D;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,kBAQpB"}

package/dist/lib/route-policy.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoutePolicyError = void 0;
+exports.sendRoutePolicyError = sendRoutePolicyError;
+exports.requireDashboard = requireDashboard;
+exports.requireAgentBoundDeck = requireAgentBoundDeck;
+exports.requireAgentAdmin = requireAgentAdmin;
+exports.getBoundDeckServices = getBoundDeckServices;
+const shared_1 = require("@agent-deck/shared");
+const agent_deck_context_1 = require("./agent-deck-context");
+const client_scope_1 = require("./client-scope");
+class RoutePolicyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'RoutePolicyError';
+    }
+}
+exports.RoutePolicyError = RoutePolicyError;
+function sendRoutePolicyError(reply, error) {
+    reply.status((0, shared_1.httpStatusForTrustedError)(error.code)).send((0, shared_1.trustedSessionError)(error.code, error.message));
+}
+function requireDashboard(request) {
+    if (!(0, client_scope_1.isDashboardClient)(request)) {
+        throw new RoutePolicyError('DASHBOARD_REQUIRED', 'Dashboard authentication required');
+    }
+}
+async function requireAgentBoundDeck(request, db) {
+    return (0, agent_deck_context_1.resolveAgentDeckId)(request, db);
+}
+function requireAgentAdmin(request) {
+    const sessionId = request.headers['x-agent-deck-session-id'];
+    if (typeof sessionId !== 'string' || !sessionId.trim()) {
+        throw new RoutePolicyError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    const session = request.server.trustedSessionStore.touchRuntimeSession(sessionId.trim());
+    if (!session || session.mode !== 'agent-admin') {
+        throw new RoutePolicyError('ADMIN_REQUIRED', 'Deck-admin elevation is required');
+    }
+}
+async function getBoundDeckServices(request, db) {
+    const deckId = await requireAgentBoundDeck(request, db);
+    const deck = await db.getDeck(deckId);
+    if (!deck) {
+        throw new RoutePolicyError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    return deck.services ?? [];
+}
+//# sourceMappingURL=route-policy.js.map

package/dist/lib/route-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-policy.js","sourceRoot":"","sources":["../../src/lib/route-policy.ts"],"names":[],"mappings":";;;AAsBA,oDAEC;AAED,4CAIC;AAED,sDAKC;AAED,8CAUC;AAED,oDAUC;AA3DD,+CAI4B;AAE5B,6DAA0D;AAC1D,iDAAmD;AAGnD,MAAa,gBAAiB,SAAQ,KAAK;IAEvB;IADlB,YACkB,IAA6B,EAC7C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAyB;QAI7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAED,SAAgB,oBAAoB,CAAC,KAAmB,EAAE,KAAuB;IAC/E,KAAK,CAAC,MAAM,CAAC,IAAA,kCAAyB,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAuB;IACtD,IAAI,CAAC,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,EAAmB;IAEnB,OAAO,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,EAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC"}

package/dist/mcp-server.d.ts

@@ -38,11 +38,11 @@ export declare class AgentDeckMCPServer {
     private setupResources;
     private setupRoutes;
     private getSessionIdHeader;
+    private refreshRuntimeSession;
+    private parseGrantBearer;
+    private authenticateTrustedSession;
     /**
-     * Pre-bind a newly-initialized session to the deck the client advertised via the
-     * `x-agent-deck-deck-id` header (written into the workspace's MCP config by
-     * `agent-deck use`). Removes the "agent forgot to call bind_workspace" gap; an
-     * explicit bind_workspace / switch_bound_deck later still overrides it.
+     * @deprecated Legacy pre-bind from deck header — replaced by grant authentication.
      */
     private preBindSessionDeck;
     private handleMcpPost;

package/dist/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAUA,OAAO,OAA8B,MAAM,SAAS,CAAC;AASrD,OAAO,EAAE,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AAoB5E,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAiC;IACjD,mFAAmF;IACnF,OAAO,CAAC,wBAAwB,CAAwB;IACxD,mFAAmF;IACnF,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,eAAe,CAAqB;IAC5C,uFAAuF;IACvF,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,aAAa,CAA6B;IAElD,OAAO,KAAK,MAAM,GAKjB;gBAGC,IAAI,GAAE,MAAa,EACnB,UAAU,GAAE,MAAgC,EAC5C,WAAW,CAAC,EAAE,cAAc,EAC5B,IAAI,GAAE,MAAoB;IAiB5B,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,eAAe;YAIT,SAAS;YAkBT,mBAAmB;YAgBnB,mBAAmB;IAiCjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAElD,iFAAiF;IACjF,OAAO,CAAC,gBAAgB;YAmBV,qBAAqB;YAUrB,cAAc;YAgDd,cAAc;IAQ5B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,SAAS;IAIjB,6EAA6E;IAC7E,OAAO,CAAC,YAAY;YAYN,mBAAmB;IAyBjC,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,cAAc;IA8MtB,OAAO,CAAC,WAAW;IA4CnB,OAAO,CAAC,kBAAkB;IAK1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YAQZ,aAAa;YAsEb,uBAAuB;IAkB/B,KAAK;IAiCL,IAAI;CAeX"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AASA,OAAO,OAA8B,MAAM,SAAS,CAAC;AAYrD,OAAO,EAAE,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AAoB5E,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAiC;IACjD,mFAAmF;IACnF,OAAO,CAAC,wBAAwB,CAAwB;IACxD,mFAAmF;IACnF,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,eAAe,CAAqB;IAC5C,uFAAuF;IACvF,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,aAAa,CAA6B;IAElD,OAAO,KAAK,MAAM,GAKjB;gBAGC,IAAI,GAAE,MAAa,EACnB,UAAU,GAAE,MAAgC,EAC5C,WAAW,CAAC,EAAE,cAAc,EAC5B,IAAI,GAAE,MAAoB;IAiB5B,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,eAAe;YAIT,SAAS;YAkBT,mBAAmB;YAoBnB,mBAAmB;IAiCjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAElD,iFAAiF;IACjF,OAAO,CAAC,gBAAgB;YAmBV,qBAAqB;YAUrB,cAAc;YA+Cd,cAAc;IAQ5B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,SAAS;IAIjB,6EAA6E;IAC7E,OAAO,CAAC,YAAY;YAYN,mBAAmB;IAyBjC,OAAO,CAAC,UAAU;IAuBlB,OAAO,CAAC,cAAc;IA8MtB,OAAO,CAAC,WAAW;IA4CnB,OAAO,CAAC,kBAAkB;YAKZ,qBAAqB;IAqBnC,OAAO,CAAC,gBAAgB;YAIV,0BAA0B;IAmCxC;;OAEG;IACH,OAAO,CAAC,kBAAkB;YAIZ,aAAa;YA0Fb,uBAAuB;IAkB/B,KAAK;IAiCL,IAAI;CAeX"}