@agent-deck/backend 1.8.0 → 1.8.2

package/dist/execution-authority/types.d.ts

@@ -9,7 +9,7 @@ export type AuthorityStatus = 'live' | 'expired' | 'revoked';
 export type AuthorityAudience = 'dealer-worker';
 export type ContractErrorCode = 'GRANT_REQUIRED' | 'AUTHORITY_EXPIRED' | 'AUTHORITY_REVOKED' | 'AUTHORITY_UNKNOWN' | 'AUTHORITY_SECRET_INVALID' | 'RESOURCE_OUT_OF_SCOPE' | 'INTERACTION_REQUIRED' | 'ENROLLMENT_REVOKED' | 'COORDINATOR_NOT_ENROLLED' | 'IDEMPOTENCY_KEY_CONFLICT' | 'INVALID_MINT_REQUEST' | 'AUDIENCE_MISMATCH';
 /** Fine-grained cause when one error_code covers multiple recovery paths. */
-export type ContractErrorReason = 'deck_not_permitted' | 'tool_not_in_snapshot' | 'enrollment_revoked' | 'explicit_revoke' | 'params_mismatch' | 'ttl_non_positive';
+export type ContractErrorReason = 'deck_not_permitted' | 'deck_not_found' | 'tool_not_in_snapshot' | 'enrollment_revoked' | 'explicit_revoke' | 'params_mismatch' | 'ttl_non_positive';
 export type AuditEventKind = 'enrollment_created' | 'enrollment_revoked' | 'authority_minted' | 'authority_inspected' | 'authority_revoked' | 'authority_expired' | 'call_allowed' | 'call_denied';
 export interface AllowedTool {
     serviceId: string;

package/dist/execution-authority/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/execution-authority/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAC7D,MAAM,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEhD,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,0BAA0B,GAC1B,uBAAuB,GACvB,sBAAsB,GACtB,oBAAoB,GACpB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,qBAAqB,GACrB,mBAAmB,GACnB,mBAAmB,GACnB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,UAAU,EAAE,iBAAiB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,CAAC,CAAC;CACT;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;AAEnE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,qBAAqB,CAAC;IAClC,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,kBAAkB,CAAC;IAC9B;;;OAGG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/execution-authority/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAC7D,MAAM,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEhD,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,0BAA0B,GAC1B,uBAAuB,GACvB,sBAAsB,GACtB,oBAAoB,GACpB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,qBAAqB,GACrB,mBAAmB,GACnB,mBAAmB,GACnB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,UAAU,EAAE,iBAAiB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,CAAC,CAAC;CACT;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;AAEnE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,qBAAqB,CAAC;IAClC,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,kBAAkB,CAAC;IAC9B;;;OAGG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}

package/dist/lib/agent-deck-context.d.ts

@@ -4,7 +4,7 @@ export declare class AgentDeckContextError extends Error {
     readonly errorCode?: string | undefined;
     constructor(message: string, errorCode?: string | undefined);
 }
-/** Resolve bound deck from authenticated runtime session or execution authority (PRD C3 / NOT-86). */
+/** Resolve bound deck from authenticated runtime session. */
 export declare function resolveAgentDeckId(request: FastifyRequest, db: DatabaseManager): Promise<string>;
 export declare function resolveAgentMode(request: FastifyRequest): Promise<'normal' | 'agent-admin'>;
 //# sourceMappingURL=agent-deck-context.d.ts.map

package/dist/lib/agent-deck-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-deck-context.d.ts","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,qBAAa,qBAAsB,SAAQ,KAAK;aAG5B,SAAS,CAAC,EAAE,MAAM;gBADlC,OAAO,EAAE,MAAM,EACC,SAAS,CAAC,EAAE,MAAM,YAAA;CAKrC;AAOD,sGAAsG;AACtG,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,GAAG,aAAa,CAAC,CAWnC"}
+{"version":3,"file":"agent-deck-context.d.ts","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,qBAAa,qBAAsB,SAAQ,KAAK;aAG5B,SAAS,CAAC,EAAE,MAAM;gBADlC,OAAO,EAAE,MAAM,EACC,SAAS,CAAC,EAAE,MAAM,YAAA;CAKrC;AAOD,6DAA6D;AAC7D,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,GAAG,aAAa,CAAC,CAOnC"}

package/dist/lib/agent-deck-context.js

@@ -18,20 +18,11 @@ function headerValue(request, name) {
     const value = request.headers[name];
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
-/** Resolve bound deck from authenticated runtime session or execution authority (PRD C3 / NOT-86). */
+/** Resolve bound deck from authenticated runtime session. */
 async function resolveAgentDeckId(request, db) {
-    const principal = request.requestPrincipal;
-    if (principal?.kind === 'execution-authority') {
-        const deckId = principal.authority.deckId;
-        const deck = await db.getDeck(deckId);
-        if (!deck) {
-            throw new AgentDeckContextError((0, shared_1.trustedSessionError)('RESOURCE_OUT_OF_SCOPE', 'Authority deck not found').error, 'RESOURCE_OUT_OF_SCOPE');
-        }
-        return deckId;
-    }
     const sessionId = headerValue(request, shared_1.AGENT_DECK_SESSION_HEADER);
     if (!sessionId) {
-        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('GRANT_REQUIRED', 'No valid workspace grant').error, 'GRANT_REQUIRED');
+        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('GRANT_REQUIRED', 'No deck selected for this connection').error, 'GRANT_REQUIRED');
     }
     const store = request.server.trustedSessionStore;
     const row = store.getRuntimeSessionRow(sessionId);
@@ -39,7 +30,7 @@ async function resolveAgentDeckId(request, db) {
         throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_INVALID', 'Runtime session absent or expired').error, 'SESSION_INVALID');
     }
     if (row.revoked_at) {
-        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_REVOKED', 'Grant rotation or explicit revocation ended the session').error, 'SESSION_REVOKED');
+        throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_REVOKED', 'Session was revoked').error, 'SESSION_REVOKED');
     }
     if (Date.parse(row.expires_at) <= Date.now()) {
         throw new AgentDeckContextError((0, shared_1.trustedSessionError)('SESSION_INVALID', 'Runtime session absent or expired').error, 'SESSION_INVALID');
@@ -50,15 +41,11 @@ async function resolveAgentDeckId(request, db) {
     }
     const deck = await db.getDeck(session.deckId);
     if (!deck) {
-        throw new auth_1.TrustedAuthError('GRANT_REQUIRED', 'No valid workspace grant');
+        throw new auth_1.TrustedAuthError('GRANT_REQUIRED', 'No deck selected for this connection');
     }
     return session.deckId;
 }
 async function resolveAgentMode(request) {
-    const principal = request.requestPrincipal;
-    if (principal?.kind === 'execution-authority') {
-        return 'normal';
-    }
     const sessionId = headerValue(request, shared_1.AGENT_DECK_SESSION_HEADER);
     if (!sessionId) {
         return 'normal';

package/dist/lib/agent-deck-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-deck-context.js","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":";;;AAqBA,gDA4DC;AAED,4CAaC;AA/FD,+CAAoF;AAEpF,kDAA2D;AAE3D,MAAa,qBAAsB,SAAQ,KAAK;IAG5B;IAFlB,YACE,OAAe,EACC,SAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAS;QAGlC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AARD,sDAQC;AAED,SAAS,WAAW,CAAC,OAAuB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,sGAAsG;AAC/F,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,EAAmB;IAEnB,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC3C,IAAI,SAAS,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,uBAAuB,EAAE,0BAA0B,CAAC,CAAC,KAAK,EAC9E,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,kCAAyB,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC,KAAK,EACvE,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC,KAAK,EACvG,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,uBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,OAAuB;IAEvB,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC3C,IAAI,SAAS,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,kCAAyB,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/E,OAAO,GAAG,EAAE,IAAI,IAAI,QAAQ,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"agent-deck-context.js","sourceRoot":"","sources":["../../src/lib/agent-deck-context.ts"],"names":[],"mappings":";;;AAqBA,gDA+CC;AAED,4CASC;AA9ED,+CAAoF;AAEpF,kDAA2D;AAE3D,MAAa,qBAAsB,SAAQ,KAAK;IAG5B;IAFlB,YACE,OAAe,EACC,SAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAS;QAGlC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AARD,sDAQC;AAED,SAAS,WAAW,CAAC,OAAuB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,6DAA6D;AACtD,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,EAAmB;IAEnB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,kCAAyB,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC,KAAK,EACnF,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC,KAAK,EACnE,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAC7B,IAAA,4BAAmB,EAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,KAAK,EACjF,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,uBAAgB,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,OAAuB;IAEvB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,kCAAyB,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/E,OAAO,GAAG,EAAE,IAAI,IAAI,QAAQ,CAAC;AAC/B,CAAC"}

package/dist/lib/backend-api-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-api-error.d.ts","sourceRoot":"","sources":["../../src/lib/backend-api-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,SAAS,CAAC,EAAE,uBAAuB;gBAFnD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,uBAAuB,YAAA;CAKtD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CA0BnF"}
+{"version":3,"file":"backend-api-error.d.ts","sourceRoot":"","sources":["../../src/lib/backend-api-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,MAAM,EAAE,MAAM;aACd,SAAS,CAAC,EAAE,uBAAuB;gBAFnD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,uBAAuB,YAAA;CAKtD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAyBnF"}

package/dist/lib/backend-api-error.js

@@ -25,7 +25,6 @@ function parseBackendErrorBody(text, status) {
             message = String(body.message);
         }
         if (body.error_code) {
-            // May be a trusted-session code or an execution-authority contract code.
             errorCode = body.error_code;
         }
     }

package/dist/lib/backend-api-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-api-error.js","sourceRoot":"","sources":["../../src/lib/backend-api-error.ts"],"names":[],"mappings":";;;AAaA,sDA0BC;AArCD,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,SAAmC;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAA0B;QAGnD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AATD,0CASC;AAED,SAAgB,qBAAqB,CAAC,IAAY,EAAE,MAAc;IAChE,IAAI,OAAO,GAAG,sBAAsB,MAAM,EAAE,CAAC;IAC7C,IAAI,SAA8C,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI3B,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,yEAAyE;YACzE,SAAS,GAAG,IAAI,CAAC,UAAqC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"backend-api-error.js","sourceRoot":"","sources":["../../src/lib/backend-api-error.ts"],"names":[],"mappings":";;;AAaA,sDAyBC;AApCD,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,SAAmC;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAA0B;QAGnD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AATD,0CASC;AAED,SAAgB,qBAAqB,CAAC,IAAY,EAAE,MAAc;IAChE,IAAI,OAAO,GAAG,sBAAsB,MAAM,EAAE,CAAC;IAC7C,IAAI,SAA8C,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI3B,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,SAAS,GAAG,IAAI,CAAC,UAAqC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC"}

package/dist/lib/bound-deck-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bound-deck-scope.d.ts","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,qBAAa,mBAAoB,SAAQ,KAAK;aAG1B,SAAS,EAAE,uBAAuB;gBADlD,OAAO,SAAuC,EAC9B,SAAS,GAAE,uBAAiD;CAK/E;AAED,6FAA6F;AAC7F,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,iBAAS,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;CAC/C,CAgBA;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"bound-deck-scope.d.ts","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,qBAAa,mBAAoB,SAAQ,KAAK;aAG1B,SAAS,EAAE,uBAAuB;gBADlD,OAAO,SAAuC,EAC9B,SAAS,GAAE,uBAAiD;CAK/E;AAED,6FAA6F;AAC7F,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,eAAe,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,iBAAS,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;CAC/C,CAgBA;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/lib/bound-deck-scope.js

@@ -23,10 +23,6 @@ async function requireBoundDeckScope(request, db, deckId) {
     if ((0, client_scope_1.isDashboardClient)(request)) {
         return deckId;
     }
-    // Defense in depth: execution authority never mutates deck composition (NOT-86).
-    if (request.requestPrincipal?.kind === 'execution-authority') {
-        throw new BoundDeckScopeError('Control-plane decision required; do not hold the worker', 'INTERACTION_REQUIRED');
-    }
     const boundDeckId = await (0, agent_deck_context_1.resolveAgentDeckId)(request, db);
     if (deckId !== boundDeckId) {
         throw new BoundDeckScopeError(`Agent may only modify bound deck ${boundDeckId}, not ${deckId}`);

package/dist/lib/bound-deck-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"bound-deck-scope.js","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":";;;AAiBA,sDAyBC;AAED,8DAmBC;AAED,oEAgBC;AAED,gEAmBC;AAyBQ,wDAAsB;AA7H/B,6DAAiF;AACjF,iDAAmD;AACnD,+CAAuF;AAEvF,MAAa,mBAAoB,SAAQ,KAAK;IAG1B;IAFlB,YACE,OAAO,GAAG,oCAAoC,EAC9B,YAAqC,uBAAuB;QAE5E,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAmD;QAG5E,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AARD,kDAQC;AAED,6FAA6F;AACtF,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,EAAmB,EACnB,MAAc;IAEd,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iFAAiF;IACjF,IAAI,OAAO,CAAC,gBAAgB,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAC3B,yDAAyD,EACzD,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,WAAW,SAAS,MAAM,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,EAAmB,EACnB,SAAiB;IAEjB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC;IACnF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,OAAuB,EACvB,EAAmB,EACnB,YAAoB;IAEpB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,KAAK,CAC3F,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC9C,OAAuB,EACvB,EAAmB,EACnB,UAAkB;IAElB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,KAAK,CAAC;IACvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAM5C,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,IAAI,EAAE,IAAA,4BAAmB,EAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,0CAAqB,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KAClE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bound-deck-scope.js","sourceRoot":"","sources":["../../src/lib/bound-deck-scope.ts"],"names":[],"mappings":";;;AAiBA,sDAiBC;AAED,8DAmBC;AAED,oEAgBC;AAED,gEAmBC;AAyBQ,wDAAsB;AArH/B,6DAAiF;AACjF,iDAAmD;AACnD,+CAAuF;AAEvF,MAAa,mBAAoB,SAAQ,KAAK;IAG1B;IAFlB,YACE,OAAO,GAAG,oCAAoC,EAC9B,YAAqC,uBAAuB;QAE5E,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAmD;QAG5E,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AARD,kDAQC;AAED,6FAA6F;AACtF,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,EAAmB,EACnB,MAAc;IAEd,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,WAAW,SAAS,MAAM,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,EAAmB,EACnB,SAAiB;IAEjB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC;IACnF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,OAAuB,EACvB,EAAmB,EACnB,YAAoB;IAEpB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,KAAK,CAC3F,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC9C,OAAuB,EACvB,EAAmB,EACnB,UAAkB;IAElB,IAAI,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,0CAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,KAAK,CAAC;IACvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAM5C,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,IAAI,EAAE,IAAA,4BAAmB,EAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,0CAAqB,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KAClE,CAAC;AACJ,CAAC"}

package/dist/lib/http-auth.d.ts

@@ -2,18 +2,4 @@ import type { FastifyRequest } from 'fastify';
 export declare function parseBearerToken(request: FastifyRequest | {
     headers: Record<string, unknown>;
 }): string | null;
-export type WorkspaceGrantBearer = {
-    /** Raw secret used for hash lookup (`mcp-launch` canonical form). */
-    secret: string;
-    /** Present when the client sent `wgr_…:secret`. */
-    claimedGrantId: string | null;
-};
-/**
- * Workspace grants authenticate with the raw secret (`mcp-launch`).
- * Some manual clients send `grantId:secret` (`wgr_…:…`) — accept both and
- * surface the claimed grant id so callers can verify it matches the lookup.
- */
-export declare function parseWorkspaceGrantBearer(token: string): WorkspaceGrantBearer;
-/** @deprecated Prefer parseWorkspaceGrantBearer — kept for call sites that only need the secret. */
-export declare function normalizeWorkspaceGrantSecret(token: string): string;
 //# sourceMappingURL=http-auth.d.ts.map

package/dist/lib/http-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../../src/lib/http-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAM9G;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CAa7E;AAED,oGAAoG;AACpG,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../../src/lib/http-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAM9G"}

package/dist/lib/http-auth.js

@@ -1,8 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseBearerToken = parseBearerToken;
-exports.parseWorkspaceGrantBearer = parseWorkspaceGrantBearer;
-exports.normalizeWorkspaceGrantSecret = normalizeWorkspaceGrantSecret;
 function parseBearerToken(request) {
     const header = request.headers.authorization;
     if (!header || typeof header !== 'string' || !header.startsWith('Bearer ')) {
@@ -10,27 +8,4 @@ function parseBearerToken(request) {
     }
     return header.slice('Bearer '.length).trim() || null;
 }
-/**
- * Workspace grants authenticate with the raw secret (`mcp-launch`).
- * Some manual clients send `grantId:secret` (`wgr_…:…`) — accept both and
- * surface the claimed grant id so callers can verify it matches the lookup.
- */
-function parseWorkspaceGrantBearer(token) {
-    const trimmed = token.trim();
-    const colon = trimmed.indexOf(':');
-    if (colon > 0) {
-        const maybeGrantId = trimmed.slice(0, colon);
-        if (/^wgr_[A-Za-z0-9]+$/.test(maybeGrantId)) {
-            return {
-                secret: trimmed.slice(colon + 1),
-                claimedGrantId: maybeGrantId,
-            };
-        }
-    }
-    return { secret: trimmed, claimedGrantId: null };
-}
-/** @deprecated Prefer parseWorkspaceGrantBearer — kept for call sites that only need the secret. */
-function normalizeWorkspaceGrantSecret(token) {
-    return parseWorkspaceGrantBearer(token).secret;
-}
 //# sourceMappingURL=http-auth.js.map

package/dist/lib/http-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../../src/lib/http-auth.ts"],"names":[],"mappings":";;AAEA,4CAMC;AAcD,8DAaC;AAGD,sEAEC;AAtCD,SAAgB,gBAAgB,CAAC,OAA8D;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACvD,CAAC;AASD;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;gBAChC,cAAc,EAAE,YAAY;aAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,oGAAoG;AACpG,SAAgB,6BAA6B,CAAC,KAAa;IACzD,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACjD,CAAC"}
+{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../../src/lib/http-auth.ts"],"names":[],"mappings":";;AAEA,4CAMC;AAND,SAAgB,gBAAgB,CAAC,OAA8D;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACvD,CAAC"}

package/dist/lib/invalid-deck-id-path-segment.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Fastify decodes path params, so `/decks/x%2Fy/playbooks` yields `deckId === "x/y"`
+ * while the route-policy `[^/]+` still matched one encoded segment. Reject before scope checks.
+ */
+export declare function invalidDeckIdPathSegment(deckId: string): boolean;
+//# sourceMappingURL=invalid-deck-id-path-segment.d.ts.map

package/dist/lib/invalid-deck-id-path-segment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-deck-id-path-segment.d.ts","sourceRoot":"","sources":["../../src/lib/invalid-deck-id-path-segment.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEhE"}

package/dist/lib/invalid-deck-id-path-segment.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invalidDeckIdPathSegment = invalidDeckIdPathSegment;
+/**
+ * Fastify decodes path params, so `/decks/x%2Fy/playbooks` yields `deckId === "x/y"`
+ * while the route-policy `[^/]+` still matched one encoded segment. Reject before scope checks.
+ */
+function invalidDeckIdPathSegment(deckId) {
+    return deckId.includes('/');
+}
+//# sourceMappingURL=invalid-deck-id-path-segment.js.map

package/dist/lib/invalid-deck-id-path-segment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-deck-id-path-segment.js","sourceRoot":"","sources":["../../src/lib/invalid-deck-id-path-segment.ts"],"names":[],"mappings":";;AAIA,4DAEC;AAND;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,MAAc;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/lib/route-policy.js

@@ -32,7 +32,7 @@ async function requireAgentBoundDeck(request, db) {
 function requireAgentAdmin(request) {
     const sessionId = request.headers['x-agent-deck-session-id'];
     if (typeof sessionId !== 'string' || !sessionId.trim()) {
-        throw new RoutePolicyError('GRANT_REQUIRED', 'No valid workspace grant');
+        throw new RoutePolicyError('GRANT_REQUIRED', 'No deck selected for this connection');
     }
     const session = request.server.trustedSessionStore.touchRuntimeSession(sessionId.trim());
     if (!session || session.mode !== 'agent-admin') {
@@ -43,7 +43,7 @@ async function getBoundDeckServices(request, db) {
     const deckId = await requireAgentBoundDeck(request, db);
     const deck = await db.getDeck(deckId);
     if (!deck) {
-        throw new RoutePolicyError('GRANT_REQUIRED', 'No valid workspace grant');
+        throw new RoutePolicyError('GRANT_REQUIRED', 'No deck selected for this connection');
     }
     return deck.services ?? [];
 }

package/dist/lib/route-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-policy.js","sourceRoot":"","sources":["../../src/lib/route-policy.ts"],"names":[],"mappings":";;;AAsBA,oDAEC;AAED,4CAIC;AAED,sDAKC;AAED,8CAUC;AAED,oDAUC;AA3DD,+CAI4B;AAE5B,6DAA0D;AAC1D,iDAAmD;AAGnD,MAAa,gBAAiB,SAAQ,KAAK;IAEvB;IADlB,YACkB,IAA6B,EAC7C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAyB;QAI7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAED,SAAgB,oBAAoB,CAAC,KAAmB,EAAE,KAAuB;IAC/E,KAAK,CAAC,MAAM,CAAC,IAAA,kCAAyB,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAuB;IACtD,IAAI,CAAC,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,EAAmB;IAEnB,OAAO,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,EAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"route-policy.js","sourceRoot":"","sources":["../../src/lib/route-policy.ts"],"names":[],"mappings":";;;AAsBA,oDAEC;AAED,4CAIC;AAED,sDAKC;AAED,8CAUC;AAED,oDAUC;AA3DD,+CAI4B;AAE5B,6DAA0D;AAC1D,iDAAmD;AAGnD,MAAa,gBAAiB,SAAQ,KAAK;IAEvB;IADlB,YACkB,IAA6B,EAC7C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAyB;QAI7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAED,SAAgB,oBAAoB,CAAC,KAAmB,EAAE,KAAuB;IAC/E,KAAK,CAAC,MAAM,CAAC,IAAA,kCAAyB,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAuB;IACtD,IAAI,CAAC,IAAA,gCAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,EAAmB;IAEnB,OAAO,IAAA,uCAAkB,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,EAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC7B,CAAC"}

package/dist/mcp-server.d.ts

@@ -43,24 +43,17 @@ export declare class AgentDeckMCPServer {
     private setupRoutes;
     private getSessionIdHeader;
     private refreshRuntimeSession;
-    private parseGrantBearer;
-    private parseAuthorityBearerCreds;
     private sendGrantRequired;
-    private sendAuthorityError;
-    private authenticateExecutionAuthority;
-    private authenticateTrustedSession;
+    private authenticateLaunchDeck;
     private disconnectTrustedSession;
     /**
-     * Re-validate workspace grant or execution authority on every follow-up MCP HTTP request.
-     * Fail closed with 401 — do not destroy the transport session so a correct
-     * Bearer on the next attempt can succeed.
-     * AGENT_DECK_MCP_SKIP_GRANT_AUTH=1 only relaxes *missing* Bearer (unit tests).
+     * Re-validate launch deck on every follow-up MCP HTTP request.
+     * Fail closed with 401 — do not destroy the transport session so a
+     * correct credential on the next attempt can succeed.
+     * AGENT_DECK_MCP_SKIP_GRANT_AUTH=1 only relaxes *missing* deck header (unit tests).
      */
     private requireFollowUpGrant;
-    /**
-     * @deprecated Legacy pre-bind from deck header — replaced by grant authentication.
-     */
-    private preBindSessionDeck;
+    private sendLaunchDeckInvalid;
     private handleMcpPost;
     private handleMcpSessionRequest;
     start(): Promise<express.Application>;

package/dist/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAQA,OAAO,OAA8B,MAAM,SAAS,CAAC;AAarD,OAAO,EAAE,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AAqB5E,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAiC;IACjD,mFAAmF;IACnF,OAAO,CAAC,wBAAwB,CAAwB;IACxD,mFAAmF;IACnF,OAAO,CAAC,cAAc,CAAyB;IAC/C,uFAAuF;IACvF,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,aAAa,CAA6B;IAElD,OAAO,KAAK,MAAM,GAKjB;gBAGC,IAAI,GAAE,MAAa,EACnB,UAAU,GAAE,MAAgC,EAC5C,WAAW,CAAC,EAAE,cAAc,EAC5B,IAAI,GAAE,MAAoB;IAiB5B;;;OAGG;IACH,OAAO,CAAC,eAAe;YAYT,SAAS;YAsBT,mBAAmB;YAoBnB,mBAAmB;IAqCjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAElD,iFAAiF;IACjF,OAAO,CAAC,gBAAgB;IAuBxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAEtD,mFAAmF;IACnF,OAAO,CAAC,MAAM,CAAC,mBAAmB;YAWpB,qBAAqB;YAsBrB,cAAc;YA4Cd,cAAc;IAQ5B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,SAAS;IAIjB,6EAA6E;IAC7E,OAAO,CAAC,YAAY;YAYN,mBAAmB;IAkCjC,OAAO,CAAC,UAAU;IAwBlB,OAAO,CAAC,cAAc;IA8MtB,OAAO,CAAC,WAAW;IA4CnB,OAAO,CAAC,kBAAkB;YAKZ,qBAAqB;IAuBnC,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,yBAAyB;IAOjC,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,kBAAkB;YAQZ,8BAA8B;YAiD9B,0BAA0B;YA8C1B,wBAAwB;IAgBtC;;;;;OAKG;YACW,oBAAoB;IAyClC;;OAEG;IACH,OAAO,CAAC,kBAAkB;YAIZ,aAAa;YA8Hb,uBAAuB;IAqB/B,KAAK;IAiCL,IAAI;CAeX"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAUA,OAAO,OAA8B,MAAM,SAAS,CAAC;AAWrD,OAAO,EAAE,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AA2B5E,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAiC;IACjD,mFAAmF;IACnF,OAAO,CAAC,wBAAwB,CAAwB;IACxD,mFAAmF;IACnF,OAAO,CAAC,cAAc,CAAyB;IAC/C,uFAAuF;IACvF,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,aAAa,CAA6B;IAElD,OAAO,KAAK,MAAM,GAKjB;gBAGC,IAAI,GAAE,MAAa,EACnB,UAAU,GAAE,MAAgC,EAC5C,WAAW,CAAC,EAAE,cAAc,EAC5B,IAAI,GAAE,MAAoB;IAiB5B;;;OAGG;IACH,OAAO,CAAC,eAAe;YAYT,SAAS;YAsBT,mBAAmB;YAoBnB,mBAAmB;IAiCjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAElD,iFAAiF;IACjF,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAEtD,mFAAmF;IACnF,OAAO,CAAC,MAAM,CAAC,mBAAmB;YAWpB,qBAAqB;YAmBrB,cAAc;YA4Cd,cAAc;IAQ5B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,SAAS;IAIjB,6EAA6E;IAC7E,OAAO,CAAC,YAAY;YAYN,mBAAmB;IAmCjC,OAAO,CAAC,UAAU;IAwBlB,OAAO,CAAC,cAAc;IA8MtB,OAAO,CAAC,WAAW;IA4CnB,OAAO,CAAC,kBAAkB;YAKZ,qBAAqB;IAoBnC,OAAO,CAAC,iBAAiB;YAQX,sBAAsB;YA0DtB,wBAAwB;IActC;;;;;OAKG;YACW,oBAAoB;IAiClC,OAAO,CAAC,qBAAqB;YAQf,aAAa;YA8Gb,uBAAuB;IAqB/B,KAAK;IAiCL,IAAI;CAeX"}