@cat-factory/node-server 0.158.1 → 0.160.0

package/dist/db/tables/observability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../../../src/db/tables/observability.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,SAAS,qDAAwB,CAAA;AAM9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgD1B,CAAA;AAQD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBjC,CAAA;AAMD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB9B,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBxB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc3B,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAA"}

package/dist/db/tables/observability.js

@@ -0,0 +1,173 @@
+import { bigint, index, integer, pgSchema, pgTable, primaryKey, text } from 'drizzle-orm/pg-core';
+// The observability schema: the three append-heavy TELEMETRY sinks (one row per model call,
+// per dispatched agent context, per web search a container agent performed) plus the two
+// deployment-level PROJECTIONS the operator dashboard aggregates (settled gates, and the daily
+// run rollup behind the long windows).
+//
+// Split out of `schema.ts` as a cohesive module (the `tables/` pattern the identity, settings
+// and VCS groups already follow) when the platform projections pushed that file over its
+// size budget: budgets are split triggers, never numbers to raise. Re-exported from
+// `schema.ts`, so every `from '../db/schema.js'` importer is unchanged.
+// Telemetry has a very different write profile from the transactional domain
+// (append-heavy, high-volume, write-and-rarely-read, short retention), so it lives in
+// its own `telemetry` Postgres schema rather than `public`. This is the Node analogue
+// of the Cloudflare worker's separate TELEMETRY_DB D1 database. The schema is purely a
+// namespace served by the same connection/pool; `migrate()` creates it on boot. The
+// `llm_call_metrics` table and `agent_context_snapshots` table live here.
+export const telemetry = pgSchema('telemetry');
+// LLM observability sink (mirror of D1 migration 0026). One row per proxied
+// container-agent model call: full prompt/response, output-limit headroom and the
+// transport-vs-execution latency split. Pruned aggressively by retention (the full
+// bodies make it heavy); booleans are integer 0/1 to match the SQLite store.
+export const llmCallMetrics = telemetry.table('llm_call_metrics', {
+    id: text('id').primaryKey(),
+    workspace_id: text('workspace_id').notNull(),
+    execution_id: text('execution_id'),
+    agent_kind: text('agent_kind').notNull(),
+    provider: text('provider').notNull(),
+    model: text('model').notNull(),
+    created_at: bigint('created_at', { mode: 'number' }).notNull(),
+    streaming: integer('streaming').notNull().default(0),
+    // WHICH slice of the run spent the call (`agent` / `validation-repair` / … ), stamped by
+    // the harness that owns the phase boundary; '' is the unattributed slice, a real group in
+    // the rollup rather than a dropped row. `turn_index` is the harness's job-scoped `seq`,
+    // NULL where the producing channel has no turn concept (the proxy). Mirrors D1 migration
+    // 0004_llm_call_phase_turn. See docs/initiatives/token-burn-instrumentation.md.
+    phase: text('phase').notNull().default(''),
+    turn_index: integer('turn_index'),
+    message_count: integer('message_count').notNull().default(0),
+    tool_count: integer('tool_count').notNull().default(0),
+    request_max_tokens: integer('request_max_tokens'),
+    prompt_tokens: integer('prompt_tokens').notNull().default(0),
+    cache_read_tokens: integer('cache_read_tokens').notNull().default(0),
+    cache_write_tokens: integer('cache_write_tokens').notNull().default(0),
+    completion_tokens: integer('completion_tokens').notNull().default(0),
+    total_tokens: integer('total_tokens').notNull().default(0),
+    finish_reason: text('finish_reason'),
+    upstream_ms: integer('upstream_ms').notNull().default(0),
+    overhead_ms: integer('overhead_ms').notNull().default(0),
+    total_ms: integer('total_ms').notNull().default(0),
+    ok: integer('ok').notNull().default(1),
+    http_status: integer('http_status'),
+    error_message: text('error_message'),
+    // prompt_text is stored as a DELTA (only the messages this call appended beyond
+    // prompt_prefix_count); the full prompt is rebuilt on export. See D1 migration 0027.
+    prompt_text: text('prompt_text').notNull().default(''),
+    prompt_prefix_count: integer('prompt_prefix_count').notNull().default(0),
+    prompt_hash: text('prompt_hash').notNull().default(''),
+    response_text: text('response_text').notNull().default(''),
+    // The model's reasoning/"thinking" trace on a separate channel, when emitted (a
+    // reasoning model can spend its whole output budget here and return empty
+    // response_text). Mirrors D1 migration 0002_llm_reasoning_text.
+    reasoning_text: text('reasoning_text').notNull().default(''),
+}, (t) => [
+    index('idx_llm_call_metrics_execution').on(t.workspace_id, t.execution_id, t.created_at),
+    index('idx_llm_call_metrics_created').on(t.created_at),
+]);
+// The complete, redacted context provided to one container-agent dispatch (per step
+// attempt): the fully fragment-composed system + user prompts, the fragment bodies
+// folded in, and the full content of the files injected into the container. Captures
+// what proxy telemetry can't (the injected `.cat-context/*` files the agent reads via
+// tools). JSON-shaped columns are text; pruned on the same retention window as
+// llm_call_metrics. Mirrors the D1 agent_context_snapshots table column-for-column.
+export const agentContextSnapshots = telemetry.table('agent_context_snapshots', {
+    id: text('id').primaryKey(),
+    workspace_id: text('workspace_id').notNull(),
+    execution_id: text('execution_id').notNull(),
+    agent_kind: text('agent_kind').notNull(),
+    step_index: integer('step_index').notNull(),
+    created_at: bigint('created_at', { mode: 'number' }).notNull(),
+    model: text('model'),
+    harness: text('harness'),
+    system_prompt: text('system_prompt').notNull().default(''),
+    user_prompt: text('user_prompt').notNull().default(''),
+    // JSON arrays: [{id, body}] and [{path, title, url, content}].
+    fragments: text('fragments').notNull().default('[]'),
+    context_files: text('context_files').notNull().default('[]'),
+    // Redacted structural bits (repo/branch, webSearch, infra, decisions, revision).
+    extras: text('extras').notNull().default('{}'),
+}, (t) => [
+    index('idx_agent_context_snapshots_execution').on(t.workspace_id, t.execution_id, t.created_at),
+    index('idx_agent_context_snapshots_created').on(t.created_at),
+]);
+// One web search a container agent performed through the backend search proxy. Recorded
+// best-effort (gated by the same LLM_RECORD_PROMPTS + storeAgentContext double switch as
+// agent_context_snapshots) and pruned on the same retention window. Mirrors the D1
+// agent_search_queries table column-for-column.
+export const agentSearchQueries = telemetry.table('agent_search_queries', {
+    id: text('id').primaryKey(),
+    workspace_id: text('workspace_id').notNull(),
+    execution_id: text('execution_id').notNull(),
+    agent_kind: text('agent_kind').notNull(),
+    // The upstream backend that served the search (`brave` | `searxng`), or null.
+    provider: text('provider'),
+    query: text('query').notNull().default(''),
+    result_count: integer('result_count').notNull().default(0),
+    created_at: bigint('created_at', { mode: 'number' }).notNull(),
+}, (t) => [
+    index('idx_agent_search_queries_execution').on(t.workspace_id, t.execution_id, t.created_at),
+    index('idx_agent_search_queries_created').on(t.created_at),
+]);
+// ---------------------------------------------------------------------------
+// Platform-operator observability projections (mirrors D1 migration 0079). Both are read by
+// the account-scoped dashboard rollups; see the D1 migration for the full rationale.
+// ---------------------------------------------------------------------------
+/**
+ * One flat row per SETTLED polling gate, so the gate / CI-fixer attempt statistics are an
+ * ordinary aggregate over columns rather than a `jsonb_array_elements` expansion of the run's
+ * internal `steps[].gate.*` shape. The id is derived by the writer (`<runId>:<stepIndex>:
+ * <outcome>`) so a driver replay collapses onto one row.
+ */
+export const gateOutcomes = pgTable('gate_outcomes', {
+    id: text('id').primaryKey(),
+    workspace_id: text('workspace_id').notNull(),
+    execution_id: text('execution_id').notNull(),
+    block_id: text('block_id').notNull(),
+    gate_kind: text('gate_kind').notNull(),
+    helper_kind: text('helper_kind'),
+    outcome: text('outcome').notNull(),
+    attempts: integer('attempts').notNull().default(0),
+    max_attempts: integer('max_attempts').notNull().default(0),
+    helper_failures: integer('helper_failures').notNull().default(0),
+    duration_ms: bigint('duration_ms', { mode: 'number' }),
+    created_at: bigint('created_at', { mode: 'number' }).notNull(),
+}, (t) => [
+    // The rollup's access path: this account's workspaces, settled since T.
+    index('idx_gate_outcomes_workspace_created').on(t.workspace_id, t.created_at),
+    // The retention prune's access path (a global range delete, not workspace-scoped).
+    index('idx_gate_outcomes_created').on(t.created_at),
+]);
+/**
+ * The daily rollup of `agent_runs` behind the dashboard's `30d` / `90d` windows. `failure_kind`
+ * carries '' (never NULL) for a non-failed status because it is part of the primary key, and a
+ * NULL there would not deduplicate a re-run bucket; the repository maps it back to null at the
+ * read boundary. Rewritten in place on each sweep, never appended: the current day's counts are
+ * not final, so they must be corrected rather than frozen.
+ */
+export const platformRunDays = pgTable('platform_run_days', {
+    workspace_id: text('workspace_id').notNull(),
+    day_start: bigint('day_start', { mode: 'number' }).notNull(),
+    status: text('status').notNull(),
+    failure_kind: text('failure_kind').notNull().default(''),
+    run_count: integer('run_count').notNull(),
+}, (t) => [
+    primaryKey({ columns: [t.workspace_id, t.day_start, t.status, t.failure_kind] }),
+    // The prune's access path; the account-scoped read rides the primary key's leading columns.
+    index('idx_platform_run_days_day').on(t.day_start),
+]);
+/**
+ * How far the daily-rollup SWEEP has covered. A fact about the sweep, so it cannot be derived
+ * from the rolled-up rows: `MAX(day_start)` cannot tell an idle account from a wedged pass, nor
+ * a brand-new account from a rollup that has never run, and those call for opposite responses.
+ *
+ * DEPLOYMENT-scoped (one row per rollup, no tenant dimension) because one pass covers every
+ * workspace, and carrying only a day boundary and a timestamp it holds no tenant data. Written
+ * in the same transaction as the rewrite it describes. NOT workspace-scoped, hence absent from
+ * `WORKSPACE_SCOPED_TABLES` and from the retention prune.
+ */
+export const platformRollupState = pgTable('platform_rollup_state', {
+    rollup: text('rollup').primaryKey(),
+    through_day: bigint('through_day', { mode: 'number' }).notNull(),
+    updated_at: bigint('updated_at', { mode: 'number' }).notNull(),
+});
+//# sourceMappingURL=observability.js.map

package/dist/db/tables/observability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.js","sourceRoot":"","sources":["../../../src/db/tables/observability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAEjG,4FAA4F;AAC5F,yFAAyF;AACzF,+FAA+F;AAC/F,uCAAuC;AACvC,EAAE;AACF,8FAA8F;AAC9F,yFAAyF;AACzF,oFAAoF;AACpF,wEAAwE;AAExE,6EAA6E;AAC7E,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAA;AAE9C,4EAA4E;AAC5E,kFAAkF;AAClF,mFAAmF;AACnF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAC3C,kBAAkB,EAClB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;IAClC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9D,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,yFAAyF;IACzF,0FAA0F;IAC1F,wFAAwF;IACxF,yFAAyF;IACzF,gFAAgF;IAChF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC;IACjC,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,kBAAkB,EAAE,OAAO,CAAC,oBAAoB,CAAC;IACjD,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,kBAAkB,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC;IACnC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;IACpC,gFAAgF;IAChF,qFAAqF;IACrF,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,gFAAgF;IAChF,0EAA0E;IAC1E,gEAAgE;IAChE,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7D,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;IACxF,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;CACvD,CACF,CAAA;AAED,oFAAoF;AACpF,mFAAmF;AACnF,qFAAqF;AACrF,sFAAsF;AACtF,+EAA+E;AAC/E,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAClD,yBAAyB,EACzB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;IACxB,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,+DAA+D;IAC/D,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5D,iFAAiF;IACjF,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;IAC/F,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;CAC9D,CACF,CAAA;AAED,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAC/C,sBAAsB,EACtB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,8EAA8E;IAC9E,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/D,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;IAC5F,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;CAC3D,CACF,CAAA;AAED,8EAA8E;AAC9E,4FAA4F;AAC5F,qFAAqF;AACrF,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,eAAe,EACf;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACtC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IAClC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/D,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,wEAAwE;IACxE,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;IAC7E,mFAAmF;IACnF,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;CACpD,CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CACpC,mBAAmB,EACnB;IACE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxD,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CAC1C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;IAChF,4FAA4F;IAC5F,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CACnD,CACF,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,EAAE;IAClE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/D,CAAC,CAAA"}

package/dist/modelProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelProvider.d.ts","sourceRoot":"","sources":["../src/modelProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EAAE,KAAK,qBAAqB,EAAqB,MAAM,qBAAqB,CAAA;AAMnF,OAAO,EACL,KAAK,qBAAqB,EAI3B,MAAM,qBAAqB,CAAA;AAe5B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAEpD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,sBAAsB,EAAE,mBAAmB,GAC1C,gBAAgB,GAAG,SAAS,CA2B9B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAE3F;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,mBAAmB,CAAC,EAAE,yBAAyB,GAC9C,qBAAqB,CAwCvB"}
+{"version":3,"file":"modelProvider.d.ts","sourceRoot":"","sources":["../src/modelProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EAAE,KAAK,qBAAqB,EAAqB,MAAM,qBAAqB,CAAA;AAMnF,OAAO,EACL,KAAK,qBAAqB,EAI3B,MAAM,qBAAqB,CAAA;AAe5B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAEpD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,sBAAsB,EAAE,mBAAmB,GAC1C,gBAAgB,GAAG,SAAS,CA2B9B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAE3F;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,mBAAmB,CAAC,EAAE,yBAAyB,GAC9C,qBAAqB,CAyCvB"}

package/dist/modelProvider.js

@@ -81,9 +81,10 @@ export function createNodeModelProviderResolver(env, apiKeys, localModelEndpoint
         apiKeys,
         baseUrlFor: (provider) => baseUrlForNode(provider, env),
         extraRegistries,
-        localEndpointsFor: localModelEndpoints
-            ? (userId) => localModelEndpoints.listResolved(userId)
-            : undefined,
+        // The service itself, so the endpoint read and the transport carrying the deployment's
+        // loopback/LAN policy (re-validated on every redirect hop, SEC-2/SEC-3) cannot come from
+        // two different places.
+        localRunners: localModelEndpoints,
     });
 }
 //# sourceMappingURL=modelProvider.js.map

package/dist/modelProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"modelProvider.js","sourceRoot":"","sources":["../src/modelProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAA8B,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAA;AACzE,OAAO,EAEL,uBAAuB,EACvB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,qBAAqB,CAAA;AA4B5B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAsB,EACtB,sBAA2C;IAE3C,MAAM,YAAY,GAChB,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,MAAM;QACvC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QAC/B,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QAC7B,CAAC,CAAC,kBAAkB,CAAC;YACjB,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACzC,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACzC,OAAO,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;SACpD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,QAAQ,GACZ,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC5E,CAAC,CAAC,kBAAkB,CAAC;YACjB,QAAQ,EAAE,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE;YAChD,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzD,WAAW,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;SACxD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC7D,OAAO,SAAS;QACd,CAAC,CAAC;YACE,SAAS;YACT,aAAa,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,KAAK,OAAO;YACzD,sBAAsB;SACvB;QACH,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAsB;IACrE,OAAO,8BAA8B,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;AAC5F,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAAsB,EACtB,OAAkC,EAClC,mBAA+C;IAE/C,MAAM,eAAe,GAAuB,EAAE,CAAA;IAE9C,0CAA0C;IAC1C,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC1D,eAAe,CAAC,IAAI,CAClB,sBAAsB,CAAC;YACrB,SAAS,EAAE,GAAG,CAAC,qBAAqB;YACpC,QAAQ,EAAE,GAAG,CAAC,oBAAoB;YAClC,OAAO,EAAE,GAAG,CAAC,qBAAqB;SACnC,CAAC,CACH,CAAA;IACH,CAAC;IAED,4FAA4F;IAC5F,2FAA2F;IAC3F,wFAAwF;IACxF,kDAAkD;IAClD,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAC/C,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,eAAe,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACpD,eAAe,CAAC,IAAI,CAClB,eAAe,CAAC;YACd,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,GAAG,CAAC,iBAAiB;YAClC,eAAe,EAAE,GAAG,CAAC,qBAAqB;YAC1C,YAAY,EAAE,GAAG,CAAC,iBAAiB;YACnC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,iCAAiC,CAAC;QACvC,OAAO;QACP,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC;QACvD,eAAe;QACf,iBAAiB,EAAE,mBAAmB;YACpC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,YAAY,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,SAAS;KACd,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"modelProvider.js","sourceRoot":"","sources":["../src/modelProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAA8B,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAA;AACzE,OAAO,EAEL,uBAAuB,EACvB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,qBAAqB,CAAA;AA4B5B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAsB,EACtB,sBAA2C;IAE3C,MAAM,YAAY,GAChB,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,MAAM;QACvC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QAC/B,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QAC7B,CAAC,CAAC,kBAAkB,CAAC;YACjB,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACzC,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACzC,OAAO,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;SACpD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,QAAQ,GACZ,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC5E,CAAC,CAAC,kBAAkB,CAAC;YACjB,QAAQ,EAAE,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE;YAChD,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzD,WAAW,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;SACxD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC7D,OAAO,SAAS;QACd,CAAC,CAAC;YACE,SAAS;YACT,aAAa,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,KAAK,OAAO;YACzD,sBAAsB;SACvB;QACH,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAsB;IACrE,OAAO,8BAA8B,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;AAC5F,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAAsB,EACtB,OAAkC,EAClC,mBAA+C;IAE/C,MAAM,eAAe,GAAuB,EAAE,CAAA;IAE9C,0CAA0C;IAC1C,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC1D,eAAe,CAAC,IAAI,CAClB,sBAAsB,CAAC;YACrB,SAAS,EAAE,GAAG,CAAC,qBAAqB;YACpC,QAAQ,EAAE,GAAG,CAAC,oBAAoB;YAClC,OAAO,EAAE,GAAG,CAAC,qBAAqB;SACnC,CAAC,CACH,CAAA;IACH,CAAC;IAED,4FAA4F;IAC5F,2FAA2F;IAC3F,wFAAwF;IACxF,kDAAkD;IAClD,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAC/C,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,eAAe,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACpD,eAAe,CAAC,IAAI,CAClB,eAAe,CAAC;YACd,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,GAAG,CAAC,iBAAiB;YAClC,eAAe,EAAE,GAAG,CAAC,qBAAqB;YAC1C,YAAY,EAAE,GAAG,CAAC,iBAAiB;YACnC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,iCAAiC,CAAC;QACvC,OAAO;QACP,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC;QACvD,eAAe;QACf,uFAAuF;QACvF,yFAAyF;QACzF,wBAAwB;QACxB,YAAY,EAAE,mBAAmB;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/realtime.d.ts

@@ -130,6 +130,8 @@ export declare class NodeEventPublisher implements ExecutionEventPublisher {
  */
 export interface MachineSubscribeDeps {
     accountOf: AccountOfWorkspace;
+    /** The machine-node roster's revocation read (SEC-5); a revoked node's subscribe is refused. */
+    isRevoked?: (nodeId: string) => Promise<boolean>;
 }
 /**
  * Attach the real-time WebSocket transport to a running Node HTTP server: accept

package/dist/realtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,EAElB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,MAAM,EACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAKhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAmB,MAAM,IAAI,CAAA;AAW/C,gFAAgF;AAChF,UAAU,gBAAgB;IACxB,EAAE,CACA,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GACzE,IAAI,CAAA;CACR;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;CAC1F;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,4CAA4C;IAC5C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC;AAED,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,UAAU,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAA;CACvD;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAgB,YAAW,cAAc,EAAE,mBAAmB;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAG1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IACjE,OAAO,CAAC,YAAY,CAAoC;IAExD;;;;;;;;;;OAUG;IACH,UAAU,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAQrD;IAED,OAAO,CAAC,UAAU;IAQlB,uEAAuE;IACvE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAapF;IAED,OAAO,CAAC,WAAW;IAUnB;;;;;OAKG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAYxF;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,uBAAuB;IAKpD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,cAAc,EAAI;IAErD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0C;IAExD,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,EACxB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,YAAY,EACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAEf;IAEK,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAEK,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;IAEK,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;IAEK,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;IAEK,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;IAEK,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;IAEK,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F;IAED,OAAO,CAAC,OAAO;CAehB;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,kBAAkB,CAAA;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,EACX,gBAAgB,CAAC,EAAE,oBAAoB,GACtC,MAAM,IAAI,CA2GZ"}
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,EAElB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,MAAM,EACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAMhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAmB,MAAM,IAAI,CAAA;AAW/C,gFAAgF;AAChF,UAAU,gBAAgB;IACxB,EAAE,CACA,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GACzE,IAAI,CAAA;CACR;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;CAC1F;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,4CAA4C;IAC5C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC;AAED,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,UAAU,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAA;CACvD;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAgB,YAAW,cAAc,EAAE,mBAAmB;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAG1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IACjE,OAAO,CAAC,YAAY,CAAoC;IAExD;;;;;;;;;;OAUG;IACH,UAAU,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAQrD;IAED,OAAO,CAAC,UAAU;IAQlB,uEAAuE;IACvE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAapF;IAED,OAAO,CAAC,WAAW;IAUnB;;;;;OAKG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAYxF;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,uBAAuB;IAKpD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,cAAc,EAAI;IAErD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0C;IAExD,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,EACxB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,YAAY,EACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAEf;IAEK,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAEK,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;IAEK,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;IAEK,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;IAEK,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;IAEK,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;IAEK,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;IAEK,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F;IAED,OAAO,CAAC,OAAO;CAehB;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,gGAAgG;IAChG,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACjD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,EACX,gBAAgB,CAAC,EAAE,oBAAoB,GACtC,MAAM,IAAI,CAyHZ"}

package/dist/realtime.js

@@ -190,9 +190,10 @@ const HEARTBEAT_INTERVAL_MS = 30_000;
 /**
  * Status-line reasons for a refused machine subscription. Keyed by the exact statuses
  * {@link authorizeMachineSubscribe} can return, so a new verdict status fails `tsc` here rather
- * than writing `undefined` into a raw HTTP status line. `503` is unreachable on THIS runtime (see
- * {@link MachineSubscribeDeps}) but is kept so the map stays total over the verdict union — a
- * `Partial` here would trade the compile-time guarantee for a runtime `undefined`.
+ * than writing `undefined` into a raw HTTP status line (a `Partial` here would trade the
+ * compile-time guarantee for a runtime `undefined`). `503` is reached when the machine-node
+ * roster cannot be read, which fails closed rather than serving a possibly-revoked node, and is
+ * also this listener's answer if the handshake throws for any other reason.
  */
 const MACHINE_REJECT_REASON = {
     403: 'Forbidden',
@@ -247,12 +248,26 @@ export function attachRealtime(server, hub, auth, log, machineSubscribe) {
                 token: request.headers.authorization,
                 workspaceId,
                 accountOf: machineSubscribe.accountOf,
-            }).then((verdict) => {
+                isRevoked: machineSubscribe.isRevoked,
+            })
+                .then((verdict) => {
                 if (!verdict.ok) {
                     reject(socket, verdict.status, MACHINE_REJECT_REASON[verdict.status]);
                     return;
                 }
                 accept(request, socket, head, workspaceId, cid);
+            })
+                // An upgrade has no error handler above it: an unhandled rejection here takes the
+                // whole process down (Node's default) and leaves the socket hanging open, so the
+                // handshake must settle every path itself. `authorizeMachineSubscribe` already
+                // converts a roster read failure into a 503 verdict; this is the backstop for
+                // anything a future input adds.
+                .catch((error) => {
+                logger.error('machine event subscribe: handshake failed', {
+                    workspaceId,
+                    err: describeError(error),
+                });
+                reject(socket, 503, MACHINE_REJECT_REASON[503]);
             });
             return;
         }

package/dist/realtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,aAAa,GAId,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAGL,gCAAgC,EAChC,yBAAyB,EACzB,kBAAkB,EAClB,MAAM,GACP,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAA;AAmB/C,MAAM,cAAc,GAAG,iCAAiC,CAAA;AAqCxD;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IACT,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC1D,yFAAyF;IACzF,uFAAuF;IACtE,aAAa,GAAG,IAAI,OAAO,EAAqB,CAAA;IACzD,YAAY,GAAgC,IAAI,CAAA;IAExD;;;;;;;;;;OAUG;IACH,UAAU,CAAC,QAA8B;QACvC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAA;QAC5B,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC9D,CAAC,CAAA;IACH,CAAC;IAEO,UAAU,CAAC,KAAkC,EAAE,WAAmB;QACxE,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,WAAmB,EAAE,MAAiB,EAAE,YAA4B;QAC5E,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;YAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAA;QAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChB,IAAI,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACxD,IAAI,YAAY;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC;IAEO,WAAW,CAAC,WAAmB,EAAE,MAAiB;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACnB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAC9B,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,WAAmB,EAAE,OAAe,EAAE,kBAAkC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,SAAQ;YAClD,IAAI,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,kBAAkB;gBAAE,SAAQ;YACzF,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IAKA,IAAI;IAJjC,0FAA0F;IAC1F,2FAA2F;IAC3F,wFAAwF;IACxF,aAAa;IACb,YAA6B,IAAoB;oBAApB,IAAI;IAAmB,CAAC;IAErD;;;OAGG;IACc,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;IAE9D,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,QAA2B,EAC3B,KAAoB;QAEpB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YACxB,IAAI,EAAE,WAAW;YACjB,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;SACf,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAc,EACd,QAAwB,EACxB,kBAAkC;QAElC,0FAA0F;QAC1F,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,GAAiB,EACjB,KAAoB;QAEpB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,WAAmB,EAAE,GAAuB;QACvE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,GAAuB;QAC/D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,YAA0B;QACvE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,MAA4B;QACvE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,QAAyB;QAClE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,WAAmB,EAAE,MAAyB;QAC3E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,WAAmB,EAAE,OAAyB;QAC1E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,MAAqB;QACnE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,WAAmB,EAAE,OAA0B;QAC5E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,OAAsB;QACpE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,UAAsB;QACjE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,OAA4B;QACzE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IAEO,OAAO,CACb,WAAmB,EACnB,KAAqB,EACrB,kBAAkC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAA;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE;gBAChF,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,GAAG,aAAa,CAAC,KAAK,CAAC;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAoC;IAC7D,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,qBAAqB;CAC3B,CAAA;AAuBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAwB,EACxB,GAAoB,EACpB,IAAgB,EAChB,GAAW,EACX,gBAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnD,gGAAgG;IAChG,MAAM,MAAM,GAAG,CACb,OAAwB,EACxB,MAAc,EACd,IAAY,EACZ,WAAmB,EACnB,GAAkB,EAClB,EAAE;QACF,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC9C,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YACnC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,8FAA8F;IAC9F,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE;QAChE,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,MAAM,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC3D,8FAA8F;QAC9F,+FAA+F;QAC/F,6BAA6B;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAEvC,yFAAyF;QACzF,wFAAwF;QACxF,2CAA2C;QAC3C,MAAM,YAAY,GAAG,gBAAgB;YACnC,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YACrD,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,YAAY,IAAI,gBAAgB,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAA;YACxD,KAAK,yBAAyB,CAAC;gBAC7B,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;gBACpC,WAAW;gBACX,SAAS,EAAE,gBAAgB,CAAC,SAAS;aACtC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAClB,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;oBACrE,OAAM;gBACR,CAAC;gBACD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/C,iFAAiF;QACjF,8BAA8B;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAE1D,KAAK,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAClE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,CACJ,MAAM,EACN,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAChE,CAAA;gBACD,OAAM;YACR,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,mFAAmF;IACnF,MAAM,KAAK,GAAG,IAAI,OAAO,EAAa,CAAA;IACtC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE;QAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACb,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnB,EAAE,CAAC,SAAS,EAAE,CAAA;gBACd,SAAQ;YACV,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChB,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,CAAA;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,CAAC,SAAS,EAAE,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,qBAAqB,CAAC,CAAA;IACzB,oEAAoE;IACpE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAA;IAEnB,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,EAAE,CAAC,CAAA;IAE/E,OAAO,GAAG,EAAE;QACV,aAAa,CAAC,SAAS,CAAC,CAAA;QACxB,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO;YAAE,EAAE,CAAC,SAAS,EAAE,CAAA;QAC5C,GAAG,CAAC,KAAK,EAAE,CAAA;IACb,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,aAAa,GAId,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAGL,gCAAgC,EAEhC,yBAAyB,EACzB,kBAAkB,EAClB,MAAM,GACP,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAA;AAmB/C,MAAM,cAAc,GAAG,iCAAiC,CAAA;AAqCxD;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IACT,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC1D,yFAAyF;IACzF,uFAAuF;IACtE,aAAa,GAAG,IAAI,OAAO,EAAqB,CAAA;IACzD,YAAY,GAAgC,IAAI,CAAA;IAExD;;;;;;;;;;OAUG;IACH,UAAU,CAAC,QAA8B;QACvC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAA;QAC5B,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC9D,CAAC,CAAA;IACH,CAAC;IAEO,UAAU,CAAC,KAAkC,EAAE,WAAmB;QACxE,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,WAAmB,EAAE,MAAiB,EAAE,YAA4B;QAC5E,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;YAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAA;QAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChB,IAAI,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACxD,IAAI,YAAY;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC;IAEO,WAAW,CAAC,WAAmB,EAAE,MAAiB;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACnB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAC9B,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,WAAmB,EAAE,OAAe,EAAE,kBAAkC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,SAAQ;YAClD,IAAI,kBAAkB,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,kBAAkB;gBAAE,SAAQ;YACzF,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IAKA,IAAI;IAJjC,0FAA0F;IAC1F,2FAA2F;IAC3F,wFAAwF;IACxF,aAAa;IACb,YAA6B,IAAoB;oBAApB,IAAI;IAAmB,CAAC;IAErD;;;OAGG;IACc,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;IAE9D,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,QAA2B,EAC3B,KAAoB;QAEpB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YACxB,IAAI,EAAE,WAAW;YACjB,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;SACf,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAc,EACd,QAAwB,EACxB,kBAAkC;QAElC,0FAA0F;QAC1F,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,GAAiB,EACjB,KAAoB;QAEpB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,WAAmB,EAAE,GAAuB;QACvE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,GAAuB;QAC/D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,YAA0B;QACvE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,MAA4B;QACvE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,QAAyB;QAClE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,WAAmB,EAAE,MAAyB;QAC3E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,WAAmB,EAAE,OAAyB;QAC1E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,MAAqB;QACnE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,WAAmB,EAAE,OAA0B;QAC5E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,OAAsB;QACpE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,UAAsB;QACjE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,OAA4B;QACzE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IAEO,OAAO,CACb,WAAmB,EACnB,KAAqB,EACrB,kBAAkC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAA;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE;gBAChF,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,GAAG,aAAa,CAAC,KAAK,CAAC;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAkD;IAC3E,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,qBAAqB;CAC3B,CAAA;AAyBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAwB,EACxB,GAAoB,EACpB,IAAgB,EAChB,GAAW,EACX,gBAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnD,gGAAgG;IAChG,MAAM,MAAM,GAAG,CACb,OAAwB,EACxB,MAAc,EACd,IAAY,EACZ,WAAmB,EACnB,GAAkB,EAClB,EAAE;QACF,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC9C,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YACnC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,8FAA8F;IAC9F,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE;QAChE,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,MAAM,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC3D,8FAA8F;QAC9F,+FAA+F;QAC/F,6BAA6B;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAEvC,yFAAyF;QACzF,wFAAwF;QACxF,2CAA2C;QAC3C,MAAM,YAAY,GAAG,gBAAgB;YACnC,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YACrD,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,YAAY,IAAI,gBAAgB,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAA;YACxD,KAAK,yBAAyB,CAAC;gBAC7B,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;gBACpC,WAAW;gBACX,SAAS,EAAE,gBAAgB,CAAC,SAAS;gBACrC,SAAS,EAAE,gBAAgB,CAAC,SAAS;aACtC,CAAC;iBACC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;oBACrE,OAAM;gBACR,CAAC;gBACD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC,CAAC;gBACF,kFAAkF;gBAClF,iFAAiF;gBACjF,+EAA+E;gBAC/E,8EAA8E;gBAC9E,gCAAgC;iBAC/B,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;oBACxD,WAAW;oBACX,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC1B,CAAC,CAAA;gBACF,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAA;YACjD,CAAC,CAAC,CAAA;YACJ,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/C,iFAAiF;QACjF,8BAA8B;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAE1D,KAAK,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAClE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,CACJ,MAAM,EACN,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAChE,CAAA;gBACD,OAAM;YACR,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,mFAAmF;IACnF,MAAM,KAAK,GAAG,IAAI,OAAO,EAAa,CAAA;IACtC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE;QAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACb,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnB,EAAE,CAAC,SAAS,EAAE,CAAA;gBACd,SAAQ;YACV,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChB,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,CAAA;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,CAAC,SAAS,EAAE,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,qBAAqB,CAAC,CAAA;IACzB,oEAAoE;IACpE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAA;IAEnB,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,EAAE,CAAC,CAAA;IAE/E,OAAO,GAAG,EAAE;QACV,aAAa,CAAC,SAAS,CAAC,CAAA;QACxB,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO;YAAE,EAAE,CAAC,SAAS,EAAE,CAAA;QAC5C,GAAG,CAAC,KAAK,EAAE,CAAA;IACb,CAAC,CAAA;AACH,CAAC"}

package/dist/repositories/drizzle/accounts.d.ts

@@ -1,4 +1,4 @@
-import type { AccountInvitationRecord, AccountInvitationRepository, AccountRecord, AccountRepository, AccountSettingsPatch, EmailConnectionRecord, EmailConnectionRepository, IdentityProvider, Membership, MembershipRepository, PasswordResetTokenRecord, PasswordResetTokenRepository, PasswordResetTokenStatus, UserIdentityRecord, UserRecord, UserRepository } from '@cat-factory/kernel';
+import type { AccountInvitationRecord, AccountInvitationRepository, AccountRecord, AccountRepository, AccountSettingsPatch, AuthAttemptRecord, AuthAttemptRepository, EmailConnectionRecord, EmailConnectionRepository, IdentityProvider, MachineNodeMint, MachineNodeMintOutcome, MachineNodeRecord, MachineNodeRepository, Membership, MembershipRepository, PasswordResetTokenRecord, PasswordResetTokenRepository, PasswordResetTokenStatus, UserIdentityRecord, UserRecord, UserRepository } from '@cat-factory/kernel';
 import type { DrizzleDb } from '../../db/client.js';
 export declare class DrizzleAccountRepository implements AccountRepository {
     private readonly db;
@@ -52,6 +52,26 @@ export declare class DrizzlePasswordResetTokenRepository implements PasswordRese
     consume(id: string): Promise<boolean>;
     deleteExpired(before: number): Promise<number>;
 }
+/** Postgres auth-attempt ledger for the password-endpoint throttle (SEC-4). Mirror of the D1 repo. */
+export declare class DrizzleAuthAttemptRepository implements AuthAttemptRepository {
+    private readonly db;
+    constructor(db: DrizzleDb);
+    record(attempt: AuthAttemptRecord): Promise<void>;
+    countByKeySince(key: string, sinceMs: number): Promise<number>;
+    countByIpSince(ip: string, sinceMs: number): Promise<number>;
+    deleteOlderThan(epochMs: number): Promise<number>;
+}
+/** Postgres machine-node roster + revocation tombstones (SEC-5). Mirror of the D1 repo. */
+export declare class DrizzleMachineNodeRepository implements MachineNodeRepository {
+    private readonly db;
+    constructor(db: DrizzleDb);
+    recordMint(mint: MachineNodeMint): Promise<MachineNodeMintOutcome>;
+    get(nodeId: string): Promise<MachineNodeRecord | null>;
+    listByUser(userId: string): Promise<MachineNodeRecord[]>;
+    revoke(nodeId: string, revokedAt: number, revokedByUserId: string): Promise<boolean>;
+    isRevoked(nodeId: string): Promise<boolean>;
+    deleteExpired(before: number): Promise<number>;
+}
 export declare class DrizzleEmailConnectionRepository implements EmailConnectionRepository {
     private readonly db;
     constructor(db: DrizzleDb);

package/dist/repositories/drizzle/accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/repositories/drizzle/accounts.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,aAAa,EACb,iBAAiB,EAEjB,oBAAoB,EAEpB,qBAAqB,EACrB,yBAAyB,EAEzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EAClB,UAAU,EACV,cAAc,EACf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AA0BnD,qBAAa,wBAAyB,YAAW,iBAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAGnD;IAEK,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAYvD;IAEK,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAWlD;IAEK,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAyBnE;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAU3E;IAEK,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAMtE;CACF;AAqBD,qBAAa,2BAA4B,YAAW,oBAAoB;IAC1D,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOtD;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAO5D;IAEK,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAMvE;IAEK,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAalD;IAEK,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7D;CACF;AAuBD,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAGhD;IAEK,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5C;IAEK,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC,GAC/D,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAO5F;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAM3D;IAEK,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAIpD;IAEK,WAAW,CACf,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAMpC;IAEK,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAMlE;CACF;AAgBD,qBAAa,kCAAmC,YAAW,2BAA2B;IACxE,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY3D;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAM7D;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAMhF;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAOzE;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;CACF;AAeD,qBAAa,mCAAoC,YAAW,4BAA4B;IAC1E,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5D;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAMjF;IAEK,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAS3E;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKnD;CACF;AAcD,qBAAa,gCAAiC,YAAW,yBAAyB;IACpE,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAM3E;IAEK,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBzD;IAEK,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;CACF"}
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/repositories/drizzle/accounts.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,aAAa,EACb,iBAAiB,EAEjB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,oBAAoB,EACpB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EAClB,UAAU,EACV,cAAc,EACf,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AA4BnD,qBAAa,wBAAyB,YAAW,iBAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAGnD;IAEK,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAYvD;IAEK,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAWlD;IAEK,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAyBnE;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAU3E;IAEK,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAMtE;CACF;AAqBD,qBAAa,2BAA4B,YAAW,oBAAoB;IAC1D,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOtD;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAO5D;IAEK,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAMvE;IAEK,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAalD;IAEK,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7D;CACF;AAuBD,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAGhD;IAEK,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5C;IAEK,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC,GAC/D,OAAO,CAAC,IAAI,CAAC,CAOf;IAEK,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAO5F;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAM3D;IAEK,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAIpD;IAEK,WAAW,CACf,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAMpC;IAEK,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAMlE;CACF;AAgBD,qBAAa,kCAAmC,YAAW,2BAA2B;IACxE,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY3D;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAM7D;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAMhF;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAOzE;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;CACF;AAeD,qBAAa,mCAAoC,YAAW,4BAA4B;IAC1E,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5D;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAMjF;IAEK,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAS3E;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKnD;CACF;AAED,sGAAsG;AACtG,qBAAa,4BAA6B,YAAW,qBAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtD;IAEK,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMnE;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE;IAEK,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGtD;CACF;AAeD,2FAA2F;AAC3F,qBAAa,4BAA6B,YAAW,qBAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA8BvE;IAEK,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAG3D;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAO7D;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASzF;IAEK,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMhD;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGnD;CACF;AAcD,qBAAa,gCAAiC,YAAW,yBAAyB;IACpE,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,SAAS,EAAI;IAExC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAM3E;IAEK,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBzD;IAEK,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;CACF"}

package/dist/repositories/drizzle/accounts.js

@@ -3,8 +3,9 @@
 // is the SAME shared mapping the D1 repos use (@cat-factory/server), so behaviour
 // matches across stores; this layer only owns the Drizzle queries. Assembled into the
 // CoreRepositories set by ./drizzle.ts (the barrel).
-import { and, desc, eq, inArray, isNull, lt } from 'drizzle-orm';
-import { accountInvitations, accounts, emailConnections, memberships, passwordResetTokens, userIdentities, users, } from '../../db/schema.js';
+import { and, count, desc, eq, gte, inArray, isNull, lt, sql } from 'drizzle-orm';
+import { randomUUID } from 'node:crypto';
+import { accountInvitations, accounts, authAttempts, emailConnections, machineNodes, memberships, passwordResetTokens, userIdentities, users, } from '../../db/schema.js';
 function rowToAccount(row) {
     return {
         id: row.id,
@@ -382,6 +383,123 @@ export class DrizzlePasswordResetTokenRepository {
         return result.rowCount ?? 0;
     }
 }
+/** Postgres auth-attempt ledger for the password-endpoint throttle (SEC-4). Mirror of the D1 repo. */
+export class DrizzleAuthAttemptRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async record(attempt) {
+        await this.db.insert(authAttempts).values({
+            id: `atmpt_${randomUUID()}`,
+            key: attempt.key,
+            ip: attempt.ip,
+            at: attempt.at,
+        });
+    }
+    async countByKeySince(key, sinceMs) {
+        const [row] = await this.db
+            .select({ n: count() })
+            .from(authAttempts)
+            .where(and(eq(authAttempts.key, key), gte(authAttempts.at, sinceMs)));
+        return row?.n ?? 0;
+    }
+    async countByIpSince(ip, sinceMs) {
+        const [row] = await this.db
+            .select({ n: count() })
+            .from(authAttempts)
+            .where(and(eq(authAttempts.ip, ip), gte(authAttempts.at, sinceMs)));
+        return row?.n ?? 0;
+    }
+    async deleteOlderThan(epochMs) {
+        const result = await this.db.delete(authAttempts).where(lt(authAttempts.at, epochMs));
+        return result.rowCount ?? 0;
+    }
+}
+function rowToMachineNode(row) {
+    return {
+        nodeId: row.node_id,
+        userId: row.user_id,
+        accountIds: JSON.parse(row.account_ids),
+        createdAt: row.created_at,
+        lastMintedAt: row.last_minted_at,
+        expiresAt: row.expires_at,
+        revokedAt: row.revoked_at,
+        revokedByUserId: row.revoked_by,
+    };
+}
+/** Postgres machine-node roster + revocation tombstones (SEC-5). Mirror of the D1 repo. */
+export class DrizzleMachineNodeRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async recordMint(mint) {
+        // The upsert refreshes only the mint-shaped columns: `user_id`, `created_at` and the
+        // revocation tombstone never change here. `GREATEST` keeps `expires_at` the latest exp
+        // ever signed, so a shorter re-mint cannot make the roster forget a longer token.
+        //
+        // `setWhere` is what makes ownership atomic rather than check-then-write: a concurrent
+        // first mint of the same node id by another user updates nothing instead of stamping its
+        // scope onto the winner's row, and a revoked id can never be resurrected.
+        const result = await this.db
+            .insert(machineNodes)
+            .values({
+            node_id: mint.nodeId,
+            user_id: mint.userId,
+            account_ids: JSON.stringify(mint.accountIds),
+            created_at: mint.mintedAt,
+            last_minted_at: mint.mintedAt,
+            expires_at: mint.expiresAt,
+        })
+            .onConflictDoUpdate({
+            target: machineNodes.node_id,
+            set: {
+                account_ids: JSON.stringify(mint.accountIds),
+                last_minted_at: mint.mintedAt,
+                expires_at: sql `GREATEST(${machineNodes.expires_at}, ${mint.expiresAt})`,
+            },
+            setWhere: and(eq(machineNodes.user_id, mint.userId), isNull(machineNodes.revoked_at)),
+        });
+        // A guarded no-op and a successful refresh are both "no error", so the write count is the
+        // only thing that distinguishes them.
+        return (result.rowCount ?? 0) > 0 ? 'recorded' : 'refused';
+    }
+    async get(nodeId) {
+        const [row] = await this.db.select().from(machineNodes).where(eq(machineNodes.node_id, nodeId));
+        return row ? rowToMachineNode(row) : null;
+    }
+    async listByUser(userId) {
+        const rows = await this.db
+            .select()
+            .from(machineNodes)
+            .where(eq(machineNodes.user_id, userId))
+            .orderBy(desc(machineNodes.last_minted_at));
+        return rows.map(rowToMachineNode);
+    }
+    async revoke(nodeId, revokedAt, revokedByUserId) {
+        // Idempotent kill switch: only the FIRST revocation writes (the tombstone keeps its
+        // original timestamp/actor), but re-revoking an already-revoked node still reports true.
+        const result = await this.db
+            .update(machineNodes)
+            .set({ revoked_at: revokedAt, revoked_by: revokedByUserId })
+            .where(and(eq(machineNodes.node_id, nodeId), isNull(machineNodes.revoked_at)));
+        if ((result.rowCount ?? 0) > 0)
+            return true;
+        return (await this.get(nodeId)) !== null;
+    }
+    async isRevoked(nodeId) {
+        const [row] = await this.db
+            .select({ revoked_at: machineNodes.revoked_at })
+            .from(machineNodes)
+            .where(eq(machineNodes.node_id, nodeId));
+        return row?.revoked_at != null;
+    }
+    async deleteExpired(before) {
+        const result = await this.db.delete(machineNodes).where(lt(machineNodes.expires_at, before));
+        return result.rowCount ?? 0;
+    }
+}
 function rowToEmailConnection(row) {
     return {
         accountId: row.account_id,