@agent-deck/backend 1.6.4 → 1.7.1

package/dist/server/index.js

@@ -28,6 +28,7 @@ const paths_1 = require("../lib/paths");
 const collection_warning_service_1 = require("../services/collection-warning-service");
 const collection_1 = require("../routes/collection");
 const export_import_1 = require("../routes/export-import");
+const trusted_session_1 = require("../routes/trusted-session");
 const playbook_manager_1 = require("../playbooks/playbook-manager");
 const patch_manager_1 = require("../playbooks/patch-manager");
 const playbook_patches_1 = require("../routes/playbook-patches");
@@ -37,6 +38,9 @@ const seed_default_services_1 = require("../data/seed-default-services");
 const live_display_registry_1 = require("../scope/live-display-registry");
 const writer_1 = require("../store/writer");
 const startup_1 = require("../store/startup");
+const store_1 = require("../trusted-session/store");
+const admin_secret_1 = require("../trusted-session/admin-secret");
+const policy_hook_1 = require("../trusted-session/policy-hook");
 async function createServer() {
     const fastify = (0, fastify_1.default)({
         logger: {
@@ -78,6 +82,8 @@ async function createServer() {
     }
     await (0, startup_1.ensureStoreReady)(db);
     const secretStore = (0, vault_1.createSecretStore)();
+    const trustedSessionStore = new store_1.TrustedSessionStore(db.getSqliteDatabase());
+    await (0, admin_secret_1.ensureAdminSecret)();
     const oauthClientSecretVault = new vault_1.OAuthClientSecretVault(secretStore, db);
     const oauthTokenVault = new vault_1.OAuthTokenVault(secretStore, db);
     const serviceHeaderVault = new vault_1.ServiceHeaderVault(secretStore);
@@ -92,6 +98,21 @@ async function createServer() {
     const patchManager = new patch_manager_1.PatchManager(db, playbookManager);
     const collectionWarningService = new collection_warning_service_1.CollectionWarningService(oauthManager);
     const liveDisplayRegistry = new live_display_registry_1.LiveDisplayRegistry();
+    fastify.decorate('db', db);
+    fastify.decorate('trustedSessionStore', trustedSessionStore);
+    (0, policy_hook_1.registerHttpPolicyHook)(fastify);
+    const sweepStaleSessions = () => {
+        try {
+            trustedSessionStore.expireStaleSessions();
+            trustedSessionStore.expireDashboardNonces();
+        }
+        catch (error) {
+            fastify.log.warn({ err: error }, 'trusted-session stale sweep failed');
+        }
+    };
+    sweepStaleSessions();
+    const staleSessionTimer = setInterval(sweepStaleSessions, 60_000);
+    staleSessionTimer.unref?.();
     // Register routes
     await fastify.register(websocket_2.registerWebSocketRoutes, { prefix: '/api/ws' });
     await fastify.register(services_1.registerServiceRoutes, { prefix: '/api/services' });
@@ -106,6 +127,8 @@ async function createServer() {
     await fastify.register(oauth_1.registerOAuthRoutes, { prefix: '/api/oauth' });
     await fastify.register(mcp_1.default, { prefix: '/api/mcp' });
     await fastify.register(local_mcp_1.registerLocalMCPRoutes, { prefix: '/api/local-mcp' });
+    await fastify.register(trusted_session_1.registerTrustedSessionRoutes, { prefix: '/api/trusted-session' });
+    await fastify.register(trusted_session_1.registerDashboardAuthRoutes, { prefix: '/api/dashboard-auth' });
     // Health check endpoint
     fastify.get('/health', async (request, reply) => {
         return {
@@ -137,7 +160,6 @@ async function createServer() {
         }));
     }
     // Add services to request context
-    fastify.decorate('db', db);
     fastify.decorate('serviceManager', serviceManager);
     fastify.decorate('mcpClient', mcpClient);
     fastify.decorate('oauthManager', oauthManager);

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";;;;;AAmCA,oCAmJC;AAtLD,sDAA8B;AAC9B,yDAAiC;AACjC,mEAA2C;AAC3C,6DAA4C;AAC5C,sDAAyB;AACzB,0DAA6B;AAC7B,iDAAqD;AACrD,iEAA6D;AAC7D,uEAAkE;AAClE,6DAAyD;AACzD,iDAA2D;AAC3D,2CAAqD;AACrD,2CAAsD;AACtD,mDAA8D;AAC9D,wDAAsC;AACtC,mDAA6D;AAC7D,uDAAiE;AACjE,2CAAsD;AACtD,mDAA6D;AAE7D,oCAA6H;AAC7H,wCAAmD;AACnD,uFAAkF;AAClF,qDAAgE;AAChE,2DAAqE;AACrE,oEAAgE;AAChE,8DAA0D;AAC1D,iEAAyE;AACzE,iEAA0E;AAC1E,4CAAqD;AACrD,yEAA2E;AAC3E,0EAAqE;AACrE,4CAAkD;AAClD,8CAAoD;AAE7C,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAA,iBAAO,EAAC;QACtB,MAAM,EAAE;YACN,KAAK,EAAE,MAAM;SACd;KACF,CAAC,CAAC;IAEH,mBAAmB;IACnB,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAClE,MAAM,qBAAqB,GAAG;QAC5B,uBAAuB;QACvB,uBAAuB;QACvB,uBAAuB;QACvB,uBAAuB;KACxB,CAAC;IAEF,MAAM,WAAW,GAAG,iBAAiB;QACnC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACrB,CAAC,CAAC,qBAAqB,CAAC;IAE1B,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAI,EAAE;QAC3B,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;YACrB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2CAA2C;gBAC3C,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,EAAE,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,mBAAS,CAAC,CAAC;IAElC,sBAAsB;IACtB,MAAM,YAAY,GAAG,IAAA,2BAAmB,GAAE,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,IAAI,0BAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,IAAA,kDAA0B,EAAC,EAAE,CAAC,CAAC;IACzD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,UAAU,WAAW,4BAA4B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,IAAA,0BAAgB,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAA,yBAAiB,GAAE,CAAC;IACxC,MAAM,sBAAsB,GAAG,IAAI,8BAAsB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,IAAI,uBAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,IAAI,0BAAkB,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAI,4BAAY,CAAC,EAAE,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,IAAI,wBAAe,EAAE,CAAC;IAC1C,MAAM,iBAAiB,GAAG,IAAI,yBAAiB,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,qCAAgB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACnG,MAAM,cAAc,GAAG,IAAI,gCAAc,CACvC,EAAE,EACF,SAAS,EACT,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,CACnB,CAAC;IACF,KAAK,cAAc,CAAC,oBAAoB,EAAE,CAAC;IAC3C,KAAK,cAAc,CAAC,2BAA2B,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,4BAAY,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,wBAAwB,GAAG,IAAI,qDAAwB,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,mBAAmB,GAAG,IAAI,2CAAmB,EAAE,CAAC;IAEtD,kBAAkB;IAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,mCAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,CAAC,QAAQ,CAAC,gCAAqB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3E,MAAM,OAAO,CAAC,QAAQ,CAAC,0BAAkB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,CAAC,QAAQ,CAAC,sCAAwB,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,CAAC,QAAQ,CAAC,2BAAmB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,CAAC,QAAQ,CAAC,kCAAsB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,CAAC,QAAQ,CAAC,8CAA2B,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzF,MAAM,OAAO,CAAC,QAAQ,CAAC,+CAA4B,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,CAAC,QAAQ,CAAC,qCAAwB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,CAAC,QAAQ,CAAC,0CAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,CAAC,QAAQ,CAAC,2BAAmB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAS,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,QAAQ,CAAC,kCAAsB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAE7E,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,oBAAoB;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAA,6BAAmB,GAAE;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,MAAM,IAAI,iBAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,QAAQ,CAAC,gBAAa,EAAE;YACpC,IAAI,EAAE,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QAEH,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAClD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,uDAAuD;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAA,6BAAmB,GAAE;YAC9B,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IACnE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IAC3D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IACzD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;IAE7D,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC,MAA2B,EAAE,EAAE;QACzE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;QACpD,gEAAgE;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,MAAkB,EAAE,EAAE;QAC7D,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;QACjD,gEAAgE;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,OAAyB,EAAE,EAAE;QAC/D,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAC7C,gEAAgE;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";;;;;AAuCA,oCAsKC;AA7MD,sDAA8B;AAC9B,yDAAiC;AACjC,mEAA2C;AAC3C,6DAA4C;AAC5C,sDAAyB;AACzB,0DAA6B;AAC7B,iDAAqD;AACrD,iEAA6D;AAC7D,uEAAkE;AAClE,6DAAyD;AACzD,iDAA2D;AAC3D,2CAAqD;AACrD,2CAAsD;AACtD,mDAA8D;AAC9D,wDAAsC;AACtC,mDAA6D;AAC7D,uDAAiE;AACjE,2CAAsD;AACtD,mDAA6D;AAE7D,oCAA6H;AAC7H,wCAAmD;AACnD,uFAAkF;AAClF,qDAAgE;AAChE,2DAAqE;AACrE,+DAAsG;AACtG,oEAAgE;AAChE,8DAA0D;AAC1D,iEAAyE;AACzE,iEAA0E;AAC1E,4CAAqD;AACrD,yEAA2E;AAC3E,0EAAqE;AACrE,4CAAkD;AAClD,8CAAoD;AACpD,oDAA+D;AAC/D,kEAAoE;AACpE,gEAAwE;AAEjE,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAA,iBAAO,EAAC;QACtB,MAAM,EAAE;YACN,KAAK,EAAE,MAAM;SACd;KACF,CAAC,CAAC;IAEH,mBAAmB;IACnB,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAClE,MAAM,qBAAqB,GAAG;QAC5B,uBAAuB;QACvB,uBAAuB;QACvB,uBAAuB;QACvB,uBAAuB;KACxB,CAAC;IAEF,MAAM,WAAW,GAAG,iBAAiB;QACnC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACrB,CAAC,CAAC,qBAAqB,CAAC;IAE1B,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAI,EAAE;QAC3B,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;YACrB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2CAA2C;gBAC3C,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,EAAE,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,mBAAS,CAAC,CAAC;IAElC,sBAAsB;IACtB,MAAM,YAAY,GAAG,IAAA,2BAAmB,GAAE,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,IAAI,0BAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,IAAA,kDAA0B,EAAC,EAAE,CAAC,CAAC;IACzD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,UAAU,WAAW,4BAA4B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,IAAA,0BAAgB,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAA,yBAAiB,GAAE,CAAC;IACxC,MAAM,mBAAmB,GAAG,IAAI,2BAAmB,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC5E,MAAM,IAAA,gCAAiB,GAAE,CAAC;IAC1B,MAAM,sBAAsB,GAAG,IAAI,8BAAsB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,IAAI,uBAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,IAAI,0BAAkB,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAI,4BAAY,CAAC,EAAE,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,IAAI,wBAAe,EAAE,CAAC;IAC1C,MAAM,iBAAiB,GAAG,IAAI,yBAAiB,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,qCAAgB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACnG,MAAM,cAAc,GAAG,IAAI,gCAAc,CACvC,EAAE,EACF,SAAS,EACT,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,CACnB,CAAC;IACF,KAAK,cAAc,CAAC,oBAAoB,EAAE,CAAC;IAC3C,KAAK,cAAc,CAAC,2BAA2B,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,4BAAY,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,wBAAwB,GAAG,IAAI,qDAAwB,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,mBAAmB,GAAG,IAAI,2CAAmB,EAAE,CAAC;IAEtD,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAA,oCAAsB,EAAC,OAAO,CAAC,CAAC;IAEhC,MAAM,kBAAkB,GAAG,GAAG,EAAE;QAC9B,IAAI,CAAC;YACH,mBAAmB,CAAC,mBAAmB,EAAE,CAAC;YAC1C,mBAAmB,CAAC,qBAAqB,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC;IACF,kBAAkB,EAAE,CAAC;IACrB,MAAM,iBAAiB,GAAG,WAAW,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAClE,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,mCAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,CAAC,QAAQ,CAAC,gCAAqB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3E,MAAM,OAAO,CAAC,QAAQ,CAAC,0BAAkB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,CAAC,QAAQ,CAAC,sCAAwB,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,CAAC,QAAQ,CAAC,2BAAmB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,CAAC,QAAQ,CAAC,kCAAsB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,CAAC,QAAQ,CAAC,8CAA2B,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzF,MAAM,OAAO,CAAC,QAAQ,CAAC,+CAA4B,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,CAAC,QAAQ,CAAC,qCAAwB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,CAAC,QAAQ,CAAC,0CAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,CAAC,QAAQ,CAAC,2BAAmB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAS,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,QAAQ,CAAC,kCAAsB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,CAAC,QAAQ,CAAC,8CAA4B,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACzF,MAAM,OAAO,CAAC,QAAQ,CAAC,6CAA2B,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAEvF,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,oBAAoB;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAA,6BAAmB,GAAE;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,MAAM,IAAI,iBAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,QAAQ,CAAC,gBAAa,EAAE;YACpC,IAAI,EAAE,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QAEH,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAClD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,mBAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,uDAAuD;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAA,6BAAmB,GAAE;YAC9B,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IACnE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IAC3D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IACzD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;IAE7D,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC,MAA2B,EAAE,EAAE;QACzE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;QACpD,gEAAgE;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,MAAkB,EAAE,EAAE;QAC7D,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;QACjD,gEAAgE;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,OAAyB,EAAE,EAAE;QAC/D,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAC7C,gEAAgE;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/test/auth-fixtures.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseManager } from '../models/database';
+export declare function dashboardAuthHeaders(): Record<string, string>;
+export declare function agentSessionHeaders(db: DatabaseManager, deckId: string, workspaceDigest?: string): Record<string, string>;
+//# sourceMappingURL=auth-fixtures.d.ts.map

package/dist/test/auth-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fixtures.d.ts","sourceRoot":"","sources":["../../src/test/auth-fixtures.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAI1D,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK7D;AAED,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,EACd,eAAe,SAA0B,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB"}

package/dist/test/auth-fixtures.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dashboardAuthHeaders = dashboardAuthHeaders;
+exports.agentSessionHeaders = agentSessionHeaders;
+const shared_1 = require("@agent-deck/shared");
+const auth_1 = require("../trusted-session/auth");
+const store_1 = require("../trusted-session/store");
+function dashboardAuthHeaders() {
+    const token = (0, auth_1.createDashboardSessionToken)();
+    return {
+        cookie: `${shared_1.AGENT_DECK_DASHBOARD_COOKIE}=${encodeURIComponent(token)}`,
+    };
+}
+function agentSessionHeaders(db, deckId, workspaceDigest = 'test-workspace-digest') {
+    const store = new store_1.TrustedSessionStore(db.getSqliteDatabase());
+    const workspace = store.getOrCreateWorkspaceKey(workspaceDigest);
+    const secret = (0, store_1.generateGrantSecret)();
+    const pending = store.createPendingGrant(workspace.id, deckId, secret);
+    store.activateGrant(pending.id);
+    const grant = store.findActiveGrantBySecret(secret);
+    const session = store.createRuntimeSession({
+        workspaceKeyId: workspace.id,
+        workspaceGrantId: grant.id,
+        deckId,
+    });
+    return { [shared_1.AGENT_DECK_SESSION_HEADER]: session.sessionId };
+}
+//# sourceMappingURL=auth-fixtures.js.map

package/dist/test/auth-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fixtures.js","sourceRoot":"","sources":["../../src/test/auth-fixtures.ts"],"names":[],"mappings":";;AASA,oDAKC;AAED,kDAiBC;AAjCD,+CAG4B;AAG5B,kDAAsE;AACtE,oDAAoF;AAEpF,SAAgB,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAA,kCAA2B,GAAE,CAAC;IAC5C,OAAO;QACL,MAAM,EAAE,GAAG,oCAA2B,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CACjC,EAAmB,EACnB,MAAc,EACd,eAAe,GAAG,uBAAuB;IAEzC,MAAM,KAAK,GAAG,IAAI,2BAAmB,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAA,2BAAmB,GAAE,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAE,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,oBAAoB,CAAC;QACzC,cAAc,EAAE,SAAS,CAAC,EAAE;QAC5B,gBAAgB,EAAE,KAAK,CAAC,EAAE;QAC1B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,kCAAyB,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;AAC5D,CAAC"}

package/dist/test-local-mcp-e2e.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=test-local-mcp-e2e.d.ts.map

package/dist/test-local-mcp-e2e.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-local-mcp-e2e.d.ts","sourceRoot":"","sources":["../src/test-local-mcp-e2e.ts"],"names":[],"mappings":""}

package/dist/test-local-mcp-e2e.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env tsx
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const local_mcp_server_manager_1 = require("./services/local-mcp-server-manager");
+const config_manager_1 = require("./services/config-manager");
+const service_manager_1 = require("./services/service-manager");
+const mcp_client_manager_1 = require("./services/mcp-client-manager");
+const oauth_manager_1 = require("./services/oauth-manager");
+const database_1 = require("./models/database");
+async function testLocalMCPServerE2E() {
+    console.log('🧪 Testing Local MCP Server End-to-End Flow...\n');
+    // Initialize managers
+    const db = new database_1.DatabaseManager();
+    const configManager = new config_manager_1.ConfigManager();
+    const localManager = new local_mcp_server_manager_1.LocalMCPServerManager();
+    // Create MCP client manager with local server manager
+    const mcpClient = new mcp_client_manager_1.MCPClientManager();
+    mcpClient.localServerManager = localManager;
+    // Create OAuth manager (required by ServiceManager)
+    const oauthManager = new oauth_manager_1.OAuthManager();
+    const serviceManager = new service_manager_1.ServiceManager(db, mcpClient, oauthManager);
+    try {
+        // Test 1: Import local servers from configuration
+        console.log('📋 Test 1: Importing local servers from configuration...');
+        const config = {
+            mcpServers: {
+                memory: {
+                    command: 'npx',
+                    args: ['-y', '@modelcontextprotocol/server-memory']
+                }
+            }
+        };
+        const services = await serviceManager.importLocalServersFromConfig(JSON.stringify(config));
+        console.log('✅ Imported services:', services.length);
+        services.forEach(service => {
+            console.log(`  - ${service.name} (${service.id}): ${service.localCommand} ${service.localArgs?.join(' ')}`);
+        });
+        if (services.length === 0) {
+            throw new Error('No services were imported');
+        }
+        const memoryService = services[0];
+        // Test 2: Start the local MCP server
+        console.log('\n📋 Test 2: Starting local MCP server...');
+        await serviceManager.startLocalServer(memoryService.id);
+        console.log('✅ Local MCP server started');
+        // Test 3: Discover tools (using unified API)
+        console.log('\n📋 Test 3: Discovering tools (unified API)...');
+        const tools = await serviceManager.discoverServiceTools(memoryService.id);
+        console.log('✅ Discovered tools:', tools.length);
+        tools.forEach(tool => {
+            console.log(`  - ${tool.name}: ${tool.description}`);
+        });
+        if (tools.length === 0) {
+            console.log('⚠️ No tools discovered - this might be normal for some servers');
+        }
+        // Test 4: Call a tool (using unified API)
+        console.log('\n📋 Test 4: Calling tool (unified API)...');
+        if (tools.length > 0) {
+            const firstTool = tools[0];
+            console.log(`  Calling tool: ${firstTool.name}`);
+            try {
+                const result = await serviceManager.callServiceTool(memoryService.id, firstTool.name, {});
+                console.log('✅ Tool call result:', result);
+            }
+            catch (error) {
+                console.log('⚠️ Tool call failed (this might be expected):', error.message);
+            }
+        }
+        else {
+            console.log('⚠️ Skipping tool call - no tools available');
+        }
+        // Test 5: Check service health (using unified API)
+        console.log('\n📋 Test 5: Checking service health (unified API)...');
+        const health = await serviceManager.checkServiceHealth(memoryService.id);
+        console.log('✅ Service health:', health);
+        // Test 6: Get local server status
+        console.log('\n📋 Test 6: Getting local server status...');
+        const status = await serviceManager.getLocalServerStatus(memoryService.id);
+        console.log('✅ Local server status:', status);
+        // Test 7: Stop the local MCP server
+        console.log('\n📋 Test 7: Stopping local MCP server...');
+        await serviceManager.stopLocalServer(memoryService.id);
+        console.log('✅ Local MCP server stopped');
+        // Test 8: Verify server is stopped
+        console.log('\n📋 Test 8: Verifying server is stopped...');
+        const finalStatus = await serviceManager.getLocalServerStatus(memoryService.id);
+        console.log('✅ Final status:', finalStatus);
+        console.log('\n🎉 All end-to-end tests passed! Local MCP server integration is working correctly.');
+    }
+    catch (error) {
+        console.error('❌ End-to-end test failed:', error);
+        process.exit(1);
+    }
+    finally {
+        // Cleanup
+        console.log('\n🧹 Cleaning up...');
+        await localManager.cleanup();
+        await db.close();
+        console.log('✅ Cleanup completed');
+    }
+}
+// Run the end-to-end test
+testLocalMCPServerE2E().catch(console.error);
+//# sourceMappingURL=test-local-mcp-e2e.js.map

package/dist/test-local-mcp-e2e.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-local-mcp-e2e.js","sourceRoot":"","sources":["../src/test-local-mcp-e2e.ts"],"names":[],"mappings":";;;AAEA,kFAA4E;AAC5E,8DAA0D;AAC1D,gEAA4D;AAC5D,sEAAiE;AACjE,4DAAwD;AACxD,gDAAoD;AAGpD,KAAK,UAAU,qBAAqB;IAClC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAEhE,sBAAsB;IACtB,MAAM,EAAE,GAAG,IAAI,0BAAe,EAAE,CAAC;IACjC,MAAM,aAAa,GAAG,IAAI,8BAAa,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,gDAAqB,EAAE,CAAC;IAEjD,sDAAsD;IACtD,MAAM,SAAS,GAAG,IAAI,qCAAgB,EAAE,CAAC;IACxC,SAAiB,CAAC,kBAAkB,GAAG,YAAY,CAAC;IAErD,oDAAoD;IACpD,MAAM,YAAY,GAAG,IAAI,4BAAY,EAAE,CAAC;IAExC,MAAM,cAAc,GAAG,IAAI,gCAAc,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,kDAAkD;QAClD,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG;YACb,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,qCAAqC,CAAC;iBACpD;aACF;SACF,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACzB,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAElC,qCAAqC;QACrC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAE1C,6CAA6C;QAC7C,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACnB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,0CAA0C;QAC1C,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YAEjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;QAED,mDAAmD;QACnD,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAEzC,kCAAkC;QAClC,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QAE9C,oCAAoC;QACpC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAE1C,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAE5C,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;IAEtG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,UAAU;QACV,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,0BAA0B;AAC1B,qBAAqB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/trusted-session/admin-secret.d.ts

@@ -0,0 +1,6 @@
+export declare function getAdminSecretPath(): Promise<string>;
+export declare function ensureAdminSecret(): Promise<string>;
+export declare function readAdminSecretFromEnvOrFile(): Promise<string | null>;
+export declare function hashAdminSecret(secret: string): string;
+export declare function verifyAdminSecret(provided: string, expected: string): boolean;
+//# sourceMappingURL=admin-secret.d.ts.map

package/dist/trusted-session/admin-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-secret.d.ts","sourceRoot":"","sources":["../../src/trusted-session/admin-secret.ts"],"names":[],"mappings":"AASA,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAE1D;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBzD;AAED,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAc3E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO7E"}

package/dist/trusted-session/admin-secret.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAdminSecretPath = getAdminSecretPath;
+exports.ensureAdminSecret = ensureAdminSecret;
+exports.readAdminSecretFromEnvOrFile = readAdminSecretFromEnvOrFile;
+exports.hashAdminSecret = hashAdminSecret;
+exports.verifyAdminSecret = verifyAdminSecret;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const shared_1 = require("@agent-deck/shared");
+const ADMIN_SECRET_FILENAME = 'admin-secret';
+const ADMIN_SECRET_ENV = 'AGENT_DECK_ADMIN_SECRET';
+async function getAdminSecretPath() {
+    return node_path_1.default.join((0, shared_1.resolveAgentDeckHome)(), ADMIN_SECRET_FILENAME);
+}
+async function ensureAdminSecret() {
+    const secretPath = await getAdminSecretPath();
+    try {
+        const existing = await promises_1.default.readFile(secretPath, 'utf8');
+        const trimmed = existing.trim();
+        if (trimmed.length >= 32) {
+            return trimmed;
+        }
+    }
+    catch {
+        // create below
+    }
+    const secret = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    await promises_1.default.mkdir(node_path_1.default.dirname(secretPath), { recursive: true, mode: 0o700 });
+    await promises_1.default.writeFile(secretPath, `${secret}\n`, { encoding: 'utf8', mode: 0o600 });
+    return secret;
+}
+async function readAdminSecretFromEnvOrFile() {
+    const fromEnv = process.env[ADMIN_SECRET_ENV]?.trim();
+    if (fromEnv && fromEnv.length >= 32) {
+        return fromEnv;
+    }
+    try {
+        const secretPath = await getAdminSecretPath();
+        const value = await promises_1.default.readFile(secretPath, 'utf8');
+        const trimmed = value.trim();
+        return trimmed.length >= 32 ? trimmed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hashAdminSecret(secret) {
+    return (0, node_crypto_1.createHash)('sha256').update(secret, 'utf8').digest('hex');
+}
+function verifyAdminSecret(provided, expected) {
+    const digest = Buffer.from(hashAdminSecret(provided), 'hex');
+    const expectedDigest = Buffer.from(hashAdminSecret(expected), 'hex');
+    if (digest.length !== expectedDigest.length) {
+        return false;
+    }
+    return (0, node_crypto_1.timingSafeEqual)(digest, expectedDigest);
+}
+//# sourceMappingURL=admin-secret.js.map

package/dist/trusted-session/admin-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-secret.js","sourceRoot":"","sources":["../../src/trusted-session/admin-secret.ts"],"names":[],"mappings":";;;;;AASA,gDAEC;AAED,8CAgBC;AAED,oEAcC;AAED,0CAEC;AAED,8CAOC;AA1DD,6CAAuE;AACvE,gEAAkC;AAClC,0DAA6B;AAE7B,+CAA0D;AAE1D,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAE5C,KAAK,UAAU,kBAAkB;IACtC,OAAO,mBAAI,CAAC,IAAI,CAAC,IAAA,6BAAoB,GAAE,EAAE,qBAAqB,CAAC,CAAC;AAClE,CAAC;AAEM,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,kBAAE,CAAC,KAAK,CAAC,mBAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,MAAM,kBAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,4BAA4B;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC5C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC"}

package/dist/trusted-session/auth.d.ts

@@ -0,0 +1,29 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { type AgentSessionMode, type RuntimeSession, type TrustedSessionErrorCode } from '@agent-deck/shared';
+import type { TrustedSessionStore } from './store';
+export type AuthPolicy = 'allowPublic' | 'requireTrustedWriter' | 'requireAgentResource' | 'requireAgentOrDashboard' | 'requireDeckAdmin' | 'requireDashboard';
+export type RequestPrincipal = {
+    kind: 'public';
+} | {
+    kind: 'dashboard';
+} | {
+    kind: 'agent';
+    session: RuntimeSession;
+    mode: AgentSessionMode;
+    deckId: string;
+    workspaceKey: string;
+};
+export declare class TrustedAuthError extends Error {
+    readonly code: TrustedSessionErrorCode;
+    constructor(code: TrustedSessionErrorCode, message: string);
+}
+export declare function createDashboardSessionToken(): string;
+export declare function validateDashboardSessionToken(token: string): boolean;
+export declare function resolveRequestPrincipal(request: FastifyRequest, store: TrustedSessionStore): Promise<RequestPrincipal>;
+export declare function requireTrustedWriterBearer(request: FastifyRequest): Promise<void>;
+export declare function enforcePolicy(policy: AuthPolicy, principal: RequestPrincipal): void;
+export declare function sendTrustedAuthError(reply: FastifyReply, error: TrustedAuthError): void;
+export declare function getAgentDeckId(principal: RequestPrincipal): string | null;
+export declare function isDashboardPrincipal(principal: RequestPrincipal): boolean;
+export declare function isAgentAdmin(principal: RequestPrincipal): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/trusted-session/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/trusted-session/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5D,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAG7B,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,MAAM,UAAU,GAClB,aAAa,GACb,sBAAsB,GACtB,sBAAsB,GACtB,yBAAyB,GACzB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IACE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM;CAKlB;AAqBD,wBAAgB,2BAA2B,IAAI,MAAM,CAIpD;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUpE;AA+DD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,GAAG,IAAI,CA0BnF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAGvF;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAEzE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAEzE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAEjE"}

package/dist/trusted-session/auth.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedAuthError = void 0;
+exports.createDashboardSessionToken = createDashboardSessionToken;
+exports.validateDashboardSessionToken = validateDashboardSessionToken;
+exports.resolveRequestPrincipal = resolveRequestPrincipal;
+exports.requireTrustedWriterBearer = requireTrustedWriterBearer;
+exports.enforcePolicy = enforcePolicy;
+exports.sendTrustedAuthError = sendTrustedAuthError;
+exports.getAgentDeckId = getAgentDeckId;
+exports.isDashboardPrincipal = isDashboardPrincipal;
+exports.isAgentAdmin = isAgentAdmin;
+const node_crypto_1 = require("node:crypto");
+const shared_1 = require("@agent-deck/shared");
+const http_auth_1 = require("../lib/http-auth");
+const admin_secret_1 = require("./admin-secret");
+class TrustedAuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'TrustedAuthError';
+    }
+}
+exports.TrustedAuthError = TrustedAuthError;
+const dashboardSessions = new Map();
+const DASHBOARD_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+function parseDashboardCookie(request) {
+    const cookieHeader = request.headers.cookie;
+    if (!cookieHeader || typeof cookieHeader !== 'string') {
+        return null;
+    }
+    const prefix = `${shared_1.AGENT_DECK_DASHBOARD_COOKIE}=`;
+    for (const part of cookieHeader.split(';')) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith(prefix)) {
+            return decodeURIComponent(trimmed.slice(prefix.length));
+        }
+    }
+    return null;
+}
+function createDashboardSessionToken() {
+    const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    dashboardSessions.set(token, { expiresAt: Date.now() + DASHBOARD_SESSION_TTL_MS });
+    return token;
+}
+function validateDashboardSessionToken(token) {
+    const entry = dashboardSessions.get(token);
+    if (!entry) {
+        return false;
+    }
+    if (entry.expiresAt <= Date.now()) {
+        dashboardSessions.delete(token);
+        return false;
+    }
+    return true;
+}
+async function resolveDashboardPrincipal(request) {
+    const dashboardToken = parseDashboardCookie(request);
+    if (dashboardToken && validateDashboardSessionToken(dashboardToken)) {
+        return { kind: 'dashboard' };
+    }
+    const bearer = (0, http_auth_1.parseBearerToken)(request);
+    if (bearer) {
+        const expected = await (0, admin_secret_1.readAdminSecretFromEnvOrFile)();
+        if (expected && (0, admin_secret_1.verifyAdminSecret)(bearer, expected)) {
+            return { kind: 'dashboard' };
+        }
+    }
+    return null;
+}
+function resolveAgentFromSessionHeader(request, store) {
+    const sessionHeader = request.headers[shared_1.AGENT_DECK_SESSION_HEADER];
+    const sessionId = typeof sessionHeader === 'string' ? sessionHeader.trim() : '';
+    if (!sessionId) {
+        return null;
+    }
+    const row = store.getRuntimeSessionRow(sessionId);
+    if (!row) {
+        throw new TrustedAuthError('SESSION_INVALID', 'Runtime session absent or expired');
+    }
+    if (row.revoked_at) {
+        throw new TrustedAuthError('SESSION_REVOKED', 'Grant rotation or explicit revocation ended the session');
+    }
+    if (Date.parse(row.expires_at) <= Date.now()) {
+        throw new TrustedAuthError('SESSION_INVALID', 'Runtime session absent or expired');
+    }
+    const session = store.touchRuntimeSession(sessionId);
+    if (!session) {
+        throw new TrustedAuthError('SESSION_INVALID', 'Runtime session absent or expired');
+    }
+    return session;
+}
+function resolveAgentFromGrantSecret(grantSecret, store) {
+    const grant = store.findActiveGrantBySecret(grantSecret);
+    if (!grant) {
+        throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    return store.createRuntimeSession({
+        workspaceKeyId: grant.workspace_key_id,
+        workspaceGrantId: grant.id,
+        deckId: grant.deck_id,
+    });
+}
+async function resolveRequestPrincipal(request, store) {
+    const dashboard = await resolveDashboardPrincipal(request);
+    if (dashboard) {
+        return dashboard;
+    }
+    const sessionFromHeader = resolveAgentFromSessionHeader(request, store);
+    if (sessionFromHeader) {
+        return {
+            kind: 'agent',
+            session: sessionFromHeader,
+            mode: sessionFromHeader.mode,
+            deckId: sessionFromHeader.deckId,
+            workspaceKey: sessionFromHeader.workspaceKey,
+        };
+    }
+    const grantSecret = (0, http_auth_1.parseBearerToken)(request);
+    if (grantSecret) {
+        const session = resolveAgentFromGrantSecret(grantSecret, store);
+        return {
+            kind: 'agent',
+            session,
+            mode: session.mode,
+            deckId: session.deckId,
+            workspaceKey: session.workspaceKey,
+        };
+    }
+    throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+}
+async function requireTrustedWriterBearer(request) {
+    const bearer = (0, http_auth_1.parseBearerToken)(request);
+    const expected = await (0, admin_secret_1.readAdminSecretFromEnvOrFile)();
+    if (!bearer || !expected || !(0, admin_secret_1.verifyAdminSecret)(bearer, expected)) {
+        throw new TrustedAuthError('DASHBOARD_REQUIRED', 'Trusted writer authentication required');
+    }
+}
+function enforcePolicy(policy, principal) {
+    if (policy === 'allowPublic') {
+        return;
+    }
+    if (policy === 'requireDashboard') {
+        if (principal.kind !== 'dashboard') {
+            throw new TrustedAuthError('DASHBOARD_REQUIRED', 'Dashboard authentication required');
+        }
+        return;
+    }
+    if (policy === 'requireAgentOrDashboard') {
+        if (principal.kind === 'dashboard' || principal.kind === 'agent') {
+            return;
+        }
+        throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    if (principal.kind !== 'agent') {
+        throw new TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+    }
+    if (policy === 'requireDeckAdmin' && principal.mode !== 'agent-admin') {
+        throw new TrustedAuthError('ADMIN_REQUIRED', 'Deck-admin elevation is required');
+    }
+}
+function sendTrustedAuthError(reply, error) {
+    const body = (0, shared_1.trustedSessionError)(error.code, error.message);
+    reply.status((0, shared_1.httpStatusForTrustedError)(error.code)).send(body);
+}
+function getAgentDeckId(principal) {
+    return principal.kind === 'agent' ? principal.deckId : null;
+}
+function isDashboardPrincipal(principal) {
+    return principal.kind === 'dashboard';
+}
+function isAgentAdmin(principal) {
+    return principal.kind === 'agent' && principal.mode === 'agent-admin';
+}
+//# sourceMappingURL=auth.js.map

package/dist/trusted-session/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/trusted-session/auth.ts"],"names":[],"mappings":";;;AAkEA,kEAIC;AAED,sEAUC;AA+DD,0DAiCC;AAED,gEAMC;AAED,sCA0BC;AAED,oDAGC;AAED,wCAEC;AAED,oDAEC;AAED,oCAEC;AAvOD,6CAA0C;AAI1C,+CAQ4B;AAE5B,gDAAoD;AACpD,iDAAiF;AAsBjF,MAAa,gBAAiB,SAAQ,KAAK;IAEvB;IADlB,YACkB,IAA6B,EAC7C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAyB;QAI7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAiC,CAAC;AACnE,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGrD,SAAS,oBAAoB,CAAC,OAAuB;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,oCAA2B,GAAG,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAa;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,OAAuB;IAC9D,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,cAAc,IAAI,6BAA6B,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,IAAA,2CAA4B,GAAE,CAAC;QACtD,IAAI,QAAQ,IAAI,IAAA,gCAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAuB,EACvB,KAA0B;IAE1B,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,kCAAyB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAClC,WAAmB,EACnB,KAA0B;IAE1B,MAAM,KAAK,GAAG,KAAK,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,KAAK,CAAC,oBAAoB,CAAC;QAChC,cAAc,EAAE,KAAK,CAAC,gBAAgB;QACtC,gBAAgB,EAAE,KAAK,CAAC,EAAE;QAC1B,MAAM,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAC3C,OAAuB,EACvB,KAA0B;IAE1B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,iBAAiB;YAC1B,IAAI,EAAE,iBAAiB,CAAC,IAAI;YAC5B,MAAM,EAAE,iBAAiB,CAAC,MAAM;YAChC,YAAY,EAAE,iBAAiB,CAAC,YAAY;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,2BAA2B,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;AAC3E,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAAC,OAAuB;IACtE,MAAM,MAAM,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,IAAA,2CAA4B,GAAE,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,gCAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,wCAAwC,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,MAAkB,EAAE,SAA2B;IAC3E,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAmB,EAAE,KAAuB;IAC/E,MAAM,IAAI,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,KAAK,CAAC,MAAM,CAAC,IAAA,kCAAyB,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAgB,cAAc,CAAC,SAA2B;IACxD,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAgB,oBAAoB,CAAC,SAA2B;IAC9D,OAAO,SAAS,CAAC,IAAI,KAAK,WAAW,CAAC;AACxC,CAAC;AAED,SAAgB,YAAY,CAAC,SAA2B;IACtD,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,CAAC;AACxE,CAAC"}

package/dist/trusted-session/policy-hook.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyInstance } from 'fastify';
+import { type RequestPrincipal } from './auth';
+import { type RegisteredRoute } from './route-policy-registry';
+declare module 'fastify' {
+    interface FastifyRequest {
+        requestPrincipal?: RequestPrincipal;
+    }
+}
+export declare const registeredHttpRoutes: RegisteredRoute[];
+export declare function registerHttpPolicyHook(fastify: FastifyInstance): void;
+export declare function assertAllRoutesHavePolicies(routes?: RegisteredRoute[]): void;
+//# sourceMappingURL=policy-hook.d.ts.map

package/dist/trusted-session/policy-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-hook.d.ts","sourceRoot":"","sources":["../../src/trusted-session/policy-hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;CACF;AAED,eAAO,MAAM,oBAAoB,EAAE,eAAe,EAAO,CAAC;AAE1D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CA6DrE;AAED,wBAAgB,2BAA2B,CAAC,MAAM,GAAE,eAAe,EAAyB,GAAG,IAAI,CAMlG"}