@cat-factory/server 0.202.0 → 0.203.0

package/dist/agents/modelProviderResolver.d.ts

@@ -1,5 +1,5 @@
 import { type ProviderRegistry, type VendorConcurrencyLimiter, type WorkspaceBodiesGate } from '@cat-factory/agents';
-import { type ApiKeyService } from '@cat-factory/integrations';
+import type { ApiKeyService, LocalModelEndpointService } from '@cat-factory/integrations';
 import type { InlineLlmCallRecorder, LlmTraceSink, ModelProviderResolver } from '@cat-factory/kernel';
 export interface ScopedModelProviderOptions {
     /**
@@ -13,16 +13,18 @@ export interface ScopedModelProviderOptions {
     /** Opt-in registries that need no DB key — the Cloudflare lib + Bedrock. */
     extraRegistries?: ProviderRegistry[];
     /**
-     * Resolve a user's locally-run model endpoints (Ollama / LM Studio / …) so inline LLM
-     * calls reach them like the proxied path. Keyless by design (the endpoint carries an
+     * The initiating user's locally-run model endpoints (Ollama / LM Studio / …) so inline
+     * LLM calls reach them like the proxied path. Keyless by design (the endpoint carries an
      * optional key), so these register into the per-scope registry directly rather than via
-     * the DB API-key pool. Keyed by the scope's user (the run initiator).
+     * the DB API-key pool.
+     *
+     * Typed as the SERVICE's own methods, not as a pair of callbacks: the read and the
+     * transport must come from ONE instance, because that instance is what binds the
+     * deployment's loopback/LAN policy (SSRF re-validation on every redirect hop). A
+     * structural `{ endpointsFor, fetch }` pair still typechecked when a facade passed the
+     * global `fetch`, which is the wrong-policy wiring this option exists to prevent.
      */
-    localEndpointsFor?: (userId: string) => Promise<{
-        provider: string;
-        baseUrl: string;
-        apiKey: string | null;
-    }[]>;
+    localRunners?: Pick<LocalModelEndpointService, 'listResolved' | 'fetchRunner'>;
 }
 /**
  * How inline calls are observed: persisted to `llm_call_metrics` via {@link recordCall}, and/or

package/dist/agents/modelProviderResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelProviderResolver.d.ts","sourceRoot":"","sources":["../../src/agents/modelProviderResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,2BAA2B,CAAA;AAChF,OAAO,KAAK,EACV,qBAAqB,EACrB,YAAY,EAEZ,qBAAqB,EAEtB,MAAM,qBAAqB,CAAA;AAe5B,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,qFAAqF;IACrF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IACpD,4EAA4E;IAC5E,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAA;IACpC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAClB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAAA;CAC7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAClC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;OAOG;IACH,sBAAsB,EAAE,mBAAmB,CAAA;CAC5C;AAED,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,0BAA0B,GAC/B,qBAAqB,CA2CvB;AAuDD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAClC,2GAA2G;IAC3G,OAAO,EAAE,wBAAwB,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,sBAAsB,GAC5B,qBAAqB,CAKvB"}
+{"version":3,"file":"modelProviderResolver.d.ts","sourceRoot":"","sources":["../../src/agents/modelProviderResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,KAAK,EACV,qBAAqB,EACrB,YAAY,EAEZ,qBAAqB,EAEtB,MAAM,qBAAqB,CAAA;AAe5B,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,qFAAqF;IACrF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IACpD,4EAA4E;IAC5E,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAA;IACpC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,cAAc,GAAG,aAAa,CAAC,CAAA;CAC/E;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAClC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;OAOG;IACH,sBAAsB,EAAE,mBAAmB,CAAA;CAC5C;AAED,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,0BAA0B,GAC/B,qBAAqB,CA4CvB;AAuDD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAA;IAClC,2GAA2G;IAC3G,OAAO,EAAE,wBAAwB,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,sBAAsB,GAC5B,qBAAqB,CAKvB"}

package/dist/agents/modelProviderResolver.js

@@ -1,5 +1,4 @@
 import { CompositeModelProvider, InstrumentedModelProvider, anthropicResolver, limitModelProvider, openAiCompatibleResolver, openAiResolver, } from '@cat-factory/agents';
-import { fetchLocalRunner } from '@cat-factory/integrations';
 import { logger } from '../observability/logger.js';
 import { openAiCompatibleBaseUrlError } from './providerErrors.js';
 export function createScopedModelProviderResolver(opts) {
@@ -25,17 +24,18 @@ export function createScopedModelProviderResolver(opts) {
                 }
             }
             // The initiating user's locally-run runners (keyless OpenAI-compatible endpoints).
-            // Route their transport through `fetchLocalRunner` so the inline path re-validates the
-            // SSRF allow-list on EVERY redirect hop — the same guard the proxy path applies. Without
-            // it the AI-SDK default fetch would silently follow a local runner's 302 to the
-            // cloud-metadata endpoint (SEC-2).
-            if (scope.userId && opts.localEndpointsFor) {
-                for (const ep of await opts.localEndpointsFor(scope.userId)) {
+            // Route their transport through the facade's policy-bound runner fetch so the inline
+            // path re-validates the SSRF allow-list on EVERY redirect hop, the same guard the
+            // proxy path applies. Without it the AI-SDK default fetch would silently follow a
+            // local runner's 302 to the cloud-metadata endpoint (SEC-2/SEC-3).
+            const runners = opts.localRunners;
+            if (scope.userId && runners) {
+                for (const ep of await runners.listResolved(scope.userId)) {
                     registry[ep.provider] = openAiCompatibleResolver({
                         name: ep.provider,
                         apiKey: ep.apiKey || 'local',
                         baseURL: ep.baseUrl,
-                        fetch: (url, init) => fetchLocalRunner(String(url), init ?? {}),
+                        fetch: (url, init) => runners.fetchRunner(String(url), init ?? {}),
                     });
                 }
             }

package/dist/agents/modelProviderResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"modelProviderResolver.js","sourceRoot":"","sources":["../../src/agents/modelProviderResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EAKzB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAsB,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAQhF,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAmElE,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAiB;YAC9B,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;YACrE,MAAM,QAAQ,GAAqB,EAAE,CAAA;YACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;gBACrF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;wBAC9E,QAAQ,CAAC,QAAQ,CAAC,GAAG,mBAAmB,CACtC,QAAQ,EACR,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC1B,CAAA;oBACH,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,2EAA2E;wBAC3E,kFAAkF;wBAClF,+EAA+E;wBAC/E,gFAAgF;wBAChF,wDAAwD;wBACxD,QAAQ,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,mFAAmF;YACnF,uFAAuF;YACvF,yFAAyF;YACzF,gFAAgF;YAChF,mCAAmC;YACnC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAC;wBAC/C,IAAI,EAAE,EAAE,CAAC,QAAQ;wBACjB,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,OAAO;wBAC5B,OAAO,EAAE,EAAE,CAAC,OAAO;wBACnB,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;qBAChE,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,IAAI,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9E,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,+BAA+B,CACtC,QAA+B,EAC/B,UAA6C;IAE7C,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAA;IAChC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAiB;YAC9B,OAAO,IAAI,yBAAyB,CAAC;gBACnC,KAAK,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACrC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;gBACzD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC9B,QAA+B,EAC/B,OAAiC;IAEjC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAA;IACpC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAiB;YAC9B,OAAO,kBAAkB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;QACpE,CAAC;KACF,CAAA;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA+B,EAC/B,KAA6B;IAE7B,OAAO,uBAAuB,CAC5B,+BAA+B,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAC3D,KAAK,CAAC,OAAO,CACd,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,GAAG,EAAE;QACV,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,MAAc,EACd,OAA2B;IAE3B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IACrE,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,+FAA+F;IAC/F,+FAA+F;IAC/F,oEAAoE;IACpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,wBAAwB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACtE,CAAC"}
+{"version":3,"file":"modelProviderResolver.js","sourceRoot":"","sources":["../../src/agents/modelProviderResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EAKzB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAS5B,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAuElE,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAiB;YAC9B,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;YACrE,MAAM,QAAQ,GAAqB,EAAE,CAAA;YACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;gBACrF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;wBAC9E,QAAQ,CAAC,QAAQ,CAAC,GAAG,mBAAmB,CACtC,QAAQ,EACR,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC1B,CAAA;oBACH,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,2EAA2E;wBAC3E,kFAAkF;wBAClF,+EAA+E;wBAC/E,gFAAgF;wBAChF,wDAAwD;wBACxD,QAAQ,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,mFAAmF;YACnF,qFAAqF;YACrF,kFAAkF;YAClF,kFAAkF;YAClF,mEAAmE;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAA;YACjC,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC5B,KAAK,MAAM,EAAE,IAAI,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1D,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAC;wBAC/C,IAAI,EAAE,EAAE,CAAC,QAAQ;wBACjB,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,OAAO;wBAC5B,OAAO,EAAE,EAAE,CAAC,OAAO;wBACnB,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;qBACnE,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,IAAI,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9E,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,+BAA+B,CACtC,QAA+B,EAC/B,UAA6C;IAE7C,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAA;IAChC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAiB;YAC9B,OAAO,IAAI,yBAAyB,CAAC;gBACnC,KAAK,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACrC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;gBACzD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC9B,QAA+B,EAC/B,OAAiC;IAEjC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAA;IACpC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAiB;YAC9B,OAAO,kBAAkB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;QACpE,CAAC;KACF,CAAA;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA+B,EAC/B,KAA6B;IAE7B,OAAO,uBAAuB,CAC5B,+BAA+B,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAC3D,KAAK,CAAC,OAAO,CACd,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,GAAG,EAAE;QACV,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,MAAc,EACd,OAA2B;IAE3B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IACrE,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,+FAA+F;IAC/F,+FAA+F;IAC/F,oEAAoE;IACpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,wBAAwB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACtE,CAAC"}

package/dist/auth/machineGate.d.ts

@@ -0,0 +1,21 @@
+import type { Context } from 'hono';
+import type { AppEnv } from '../http/env.js';
+import { type MachinePayload } from './signing.js';
+/**
+ * The ONE machine-token gate for every `/internal/*` machine endpoint: verify the
+ * `machine`-audience token, then consult the machine-node roster so a REVOKED node is
+ * refused everywhere at once (SEC-5). Before this helper each controller inlined the same
+ * six verify lines, which is exactly how a revocation check would have landed on some
+ * endpoints and not others.
+ *
+ * Returns the verified payload, or null when the request must be refused; each controller
+ * keeps its own refusal envelope (the relay controllers' `{ ok: false }` shape and the
+ * plain `{ error }` shape both stay where they are). A revoked node gets the same 403 as
+ * an invalid token: the caller holds the token either way, so there is no oracle to
+ * protect, and the reconnect flow is the remedy for both.
+ *
+ * A roster read that THROWS propagates (a 500, retried by the machine clients), because
+ * an unreadable roster is not consent to serve a possibly-revoked node.
+ */
+export declare function verifyMachineRequest(c: Context<AppEnv>): Promise<MachinePayload | null>;
+//# sourceMappingURL=machineGate.d.ts.map

package/dist/auth/machineGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machineGate.d.ts","sourceRoot":"","sources":["../../src/auth/machineGate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,KAAK,cAAc,EAA6B,MAAM,cAAc,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAW7F"}

package/dist/auth/machineGate.js

@@ -0,0 +1,32 @@
+import { TOKEN_AUDIENCE, signerFor } from './signing.js';
+/**
+ * The ONE machine-token gate for every `/internal/*` machine endpoint: verify the
+ * `machine`-audience token, then consult the machine-node roster so a REVOKED node is
+ * refused everywhere at once (SEC-5). Before this helper each controller inlined the same
+ * six verify lines, which is exactly how a revocation check would have landed on some
+ * endpoints and not others.
+ *
+ * Returns the verified payload, or null when the request must be refused; each controller
+ * keeps its own refusal envelope (the relay controllers' `{ ok: false }` shape and the
+ * plain `{ error }` shape both stay where they are). A revoked node gets the same 403 as
+ * an invalid token: the caller holds the token either way, so there is no oracle to
+ * protect, and the reconnect flow is the remedy for both.
+ *
+ * A roster read that THROWS propagates (a 500, retried by the machine clients), because
+ * an unreadable roster is not consent to serve a possibly-revoked node.
+ */
+export async function verifyMachineRequest(c) {
+    const container = c.get('container');
+    const secret = container.config.auth.sessionSecret;
+    const token = c.req.header('authorization')?.replace(/^Bearer\s+/i, '');
+    const payload = secret
+        ? await signerFor(secret).verify(token, { aud: TOKEN_AUDIENCE.machine })
+        : null;
+    if (!payload)
+        return null;
+    const nodes = container.machineNodeRepository;
+    if (nodes && (await nodes.isRevoked(payload.nodeId)))
+        return null;
+    return payload;
+}
+//# sourceMappingURL=machineGate.js.map

package/dist/auth/machineGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machineGate.js","sourceRoot":"","sources":["../../src/auth/machineGate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,CAAkB;IAC3D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;IAClD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;QACxF,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,KAAK,GAAG,SAAS,CAAC,qBAAqB,CAAA;IAC7C,IAAI,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACjE,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/config/types.d.ts

@@ -120,6 +120,27 @@ export interface AuthConfig {
      * invite. Empty ⇒ new-user creation is invite-only (the default, fail-closed).
      */
     allowedEmailDomains: string[];
+    /**
+     * Whether a proxy in front of this process may be believed about the client address.
+     * OFF by default on Node: `x-forwarded-for` is attacker-supplied on a bare deployment,
+     * and a client-chosen address hands the attacker unlimited fresh throttle buckets plus
+     * the ability to pin someone else's (SEC-4). Node deployments behind a proxy opt in with
+     * `AUTH_TRUST_PROXY=true`; the Worker hardcodes it on because the Cloudflare edge injects
+     * and overwrites `cf-connecting-ip`.
+     *
+     * WHICH header is consulted is the facade's decision, not this flag's: see each facade's
+     * `resolveClientAddress`.
+     */
+    trustProxyHeaders: boolean;
+    /**
+     * How many trusted proxies sit in front of this process, used to pick the client hop out
+     * of an `x-forwarded-for` chain (`AUTH_TRUST_PROXY_HOPS`, default 1). The rightmost entry
+     * was appended by the nearest proxy, so with a single proxy the client is last; behind a
+     * CDN plus a load balancer it is two from the end. Getting it wrong over-counts (several
+     * clients share a bucket) rather than under-counting, because a chain shorter than the
+     * declared topology is discarded in favour of the socket peer.
+     */
+    trustedProxyHops: number;
 }
 export interface EmailConfig {
     /**

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,2BAA2B,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOtD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,QAAQ,GAAG,SAAS,CAAA;IACxE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,uBAAuB,EAAE,MAAM,CAAA;IAC/B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,2FAA2F;IAC3F,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAA;QAC/B,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,yDAAyD;IACzD,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,kFAAkF;IAClF,OAAO,EAAE,KAAK,GAAG,UAAU,CAAA;IAC3B,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CAIvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;CAGvB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,mFAAmF;IACnF,QAAQ,EAAE,KAAK,GAAG,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,eAAe,EAAE,yBAAyB,CAAA;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB,2FAA2F;IAC3F,MAAM,EAAE,2BAA2B,CAAA;IACnC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAA;IACf,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,wEAAwE;IACxE,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,EAAE,eAAe,CAAA;IAC1B,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAA;IACnB,mFAAmF;IACnF,MAAM,EAAE,YAAY,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,oFAAoF;IACpF,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,SAAS,EAAE,eAAe,CAAA;IAC1B,uFAAuF;IACvF,KAAK,EAAE,WAAW,CAAA;IAClB,4FAA4F;IAC5F,YAAY,EAAE,kBAAkB,CAAA;IAChC,0EAA0E;IAC1E,OAAO,EAAE,gBAAgB,CAAA;IACzB,+EAA+E;IAC/E,KAAK,EAAE,WAAW,CAAA;IAClB,mFAAmF;IACnF,oBAAoB,EAAE,yBAAyB,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAA;IAClB,+EAA+E;IAC/E,SAAS,EAAE,eAAe,CAAA;IAC1B,qFAAqF;IACrF,eAAe,EAAE,qBAAqB,CAAA;IACtC,6EAA6E;IAC7E,aAAa,EAAE,mBAAmB,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,cAAc,CAAA;IACxB,gGAAgG;IAChG,IAAI,EAAE,UAAU,CAAA;IAChB,yFAAyF;IACzF,cAAc,EAAE,mBAAmB,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAA;IAC3C;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,2BAA2B,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOtD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,QAAQ,GAAG,SAAS,CAAA;IACxE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,uBAAuB,EAAE,MAAM,CAAA;IAC/B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,2FAA2F;IAC3F,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAA;QAC/B,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,yDAAyD;IACzD,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,kFAAkF;IAClF,OAAO,EAAE,KAAK,GAAG,UAAU,CAAA;IAC3B,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CAIvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;CAGvB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,mFAAmF;IACnF,QAAQ,EAAE,KAAK,GAAG,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,eAAe,EAAE,yBAAyB,CAAA;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB,2FAA2F;IAC3F,MAAM,EAAE,2BAA2B,CAAA;IACnC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAA;IACf,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,wEAAwE;IACxE,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,EAAE,eAAe,CAAA;IAC1B,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAA;IACnB,mFAAmF;IACnF,MAAM,EAAE,YAAY,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,oFAAoF;IACpF,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,SAAS,EAAE,eAAe,CAAA;IAC1B,uFAAuF;IACvF,KAAK,EAAE,WAAW,CAAA;IAClB,4FAA4F;IAC5F,YAAY,EAAE,kBAAkB,CAAA;IAChC,0EAA0E;IAC1E,OAAO,EAAE,gBAAgB,CAAA;IACzB,+EAA+E;IAC/E,KAAK,EAAE,WAAW,CAAA;IAClB,mFAAmF;IACnF,oBAAoB,EAAE,yBAAyB,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAA;IAClB,+EAA+E;IAC/E,SAAS,EAAE,eAAe,CAAA;IAC1B,qFAAqF;IACrF,eAAe,EAAE,qBAAqB,CAAA;IACtC,6EAA6E;IAC7E,aAAa,EAAE,mBAAmB,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,cAAc,CAAA;IACxB,gGAAgG;IAChG,IAAI,EAAE,UAAU,CAAA;IAChB,yFAAyF;IACzF,cAAc,EAAE,mBAAmB,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAA;IAC3C;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAA;CAClC"}

package/dist/events/machineSubscribe.d.ts

@@ -19,9 +19,18 @@ export type MachineSubscribeAuth = {
     payload: MachinePayload;
 } | {
     ok: false;
-    status: 403 | 404 | 503;
+    status: MachineSubscribeRefusalStatus;
     message: string;
 };
+/** The statuses a refused handshake can carry. */
+export type MachineSubscribeRefusalStatus = 403 | 404 | 503;
+/**
+ * The `{ ok: false }` code each refusal status reports to a machine client. An exhaustive
+ * `Record`, so adding a status forces a decision here rather than silently collapsing onto
+ * `forbidden`: a node RETRIES an `unavailable` (we could not read the roster) and reconnects
+ * for a fresh node id on a `forbidden`, so the two must stay distinguishable.
+ */
+export declare const MACHINE_SUBSCRIBE_ERROR_CODE: Record<MachineSubscribeRefusalStatus, string>;
 /** Resolves a workspace to its owning account — the mothership's own `workspaceRepository`. */
 export type AccountOfWorkspace = (workspaceId: string) => Promise<string | null | undefined> | string | null | undefined;
 /**
@@ -50,6 +59,13 @@ export declare function authorizeMachineSubscribe(opts: {
     workspaceId: string;
     /** The mothership's workspace → account resolver; absent ⇒ this facade is not a mothership. */
     accountOf: AccountOfWorkspace | undefined;
+    /**
+     * The machine-node roster's revocation read (SEC-5), threaded from the facade's
+     * `machineNodeRepository`; absent ⇒ no roster is wired and no revocation check runs.
+     * This handshake cannot go through the shared HTTP gate (it rides a WS upgrade, not a
+     * Hono context), so it takes the same check as an input instead.
+     */
+    isRevoked?: (nodeId: string) => Promise<boolean>;
 }): Promise<MachineSubscribeAuth>;
 /** Accepts either a raw token or a full `Authorization: Bearer …` header value. */
 export declare function stripBearer(value: string | undefined): string | undefined;

package/dist/events/machineSubscribe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machineSubscribe.d.ts","sourceRoot":"","sources":["../../src/events/machineSubscribe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,KAAK,cAAc,EAA6B,MAAM,oBAAoB,CAAA;AAwBnF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,+BAA+B,CAAA;AAEzE,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,QAA6C,CAAA;AAE1F;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3D,+FAA+F;AAC/F,MAAM,MAAM,kBAAkB,GAAG,CAC/B,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,UAAU,CAAA;IAChB,+FAA+F;IAC/F,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,+FAA+F;IAC/F,SAAS,EAAE,kBAAkB,GAAG,SAAS,CAAA;CAC1C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEzE"}
+{"version":3,"file":"machineSubscribe.d.ts","sourceRoot":"","sources":["../../src/events/machineSubscribe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,KAAK,cAAc,EAA6B,MAAM,oBAAoB,CAAA;AAwBnF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,+BAA+B,CAAA;AAEzE,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,QAA6C,CAAA;AAE1F;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,6BAA6B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzE,kDAAkD;AAClD,MAAM,MAAM,6BAA6B,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAItF,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,kBAAkB,GAAG,CAC/B,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,UAAU,CAAA;IAChB,+FAA+F;IAC/F,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,+FAA+F;IAC/F,SAAS,EAAE,kBAAkB,GAAG,SAAS,CAAA;IACzC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACjD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqChC;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEzE"}

package/dist/events/machineSubscribe.js

@@ -29,6 +29,17 @@ import { TOKEN_AUDIENCE, signerFor } from '../auth/signing.js';
 export const MACHINE_EVENTS_SUBSCRIBE_PATH = '/internal/events/subscribe';
 /** Matches `/internal/events/subscribe/<workspaceId>`, capturing the (still-encoded) id. */
 export const MACHINE_EVENTS_SUBSCRIBE_PATTERN = /^\/internal\/events\/subscribe\/([^/]+)$/;
+/**
+ * The `{ ok: false }` code each refusal status reports to a machine client. An exhaustive
+ * `Record`, so adding a status forces a decision here rather than silently collapsing onto
+ * `forbidden`: a node RETRIES an `unavailable` (we could not read the roster) and reconnects
+ * for a fresh node id on a `forbidden`, so the two must stay distinguishable.
+ */
+export const MACHINE_SUBSCRIBE_ERROR_CODE = {
+    403: 'forbidden',
+    404: 'not_found',
+    503: 'unavailable',
+};
 /**
  * Authorise a machine subscribe handshake for `workspaceId`.
  *
@@ -57,6 +68,25 @@ export async function authorizeMachineSubscribe(opts) {
         : null;
     if (!payload)
         return { ok: false, status: 403, message: 'invalid machine token' };
+    if (opts.isRevoked) {
+        // An unreadable roster is not consent to serve a possibly-revoked node, so a throwing
+        // read REFUSES rather than propagating: unlike the HTTP gate (whose throw becomes a 500
+        // through `handleError`), this runs on a WebSocket upgrade where the only caller can do
+        // nothing with a rejected promise but crash the process and leave the socket dangling.
+        // 503 rather than 403, because "we could not check" and "you are revoked" need different
+        // reactions from the node: retry the connection, versus reconnect for a fresh id.
+        let revoked;
+        try {
+            revoked = await opts.isRevoked(payload.nodeId);
+        }
+        catch {
+            return { ok: false, status: 503, message: 'machine node state is unavailable' };
+        }
+        // Same 403 as an invalid token: the caller holds the token, so there is no oracle to
+        // protect, and reconnecting (which mints a fresh node) is the remedy for both.
+        if (revoked)
+            return { ok: false, status: 403, message: 'invalid machine token' };
+    }
     if (!opts.accountOf) {
         return { ok: false, status: 503, message: 'event subscription is not enabled' };
     }

package/dist/events/machineSubscribe.js.map

@@ -1 +1 @@
-{"version":3,"file":"machineSubscribe.js","sourceRoot":"","sources":["../../src/events/machineSubscribe.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEnF,2FAA2F;AAC3F,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,mGAAmG;AACnG,+FAA+F;AAC/F,uEAAuE;AACvE,EAAE;AACF,4FAA4F;AAC5F,wFAAwF;AACxF,kGAAkG;AAClG,iGAAiG;AACjG,8FAA8F;AAC9F,8CAA8C;AAC9C,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,iGAAiG;AACjG,+FAA+F;AAC/F,qFAAqF;AACrF,mEAAmE;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAA;AAEzE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gCAAgC,GAAG,0CAA0C,CAAA;AAgB1F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAO/C;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACtE,GAAG,EAAE,cAAc,CAAC,OAAO;SAC5B,CAAC;QACJ,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAEjF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;IACjF,CAAC;IAED,6FAA6F;IAC7F,6DAA6D;IAC7D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAChG,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,OAAO,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAC1C,CAAC"}
+{"version":3,"file":"machineSubscribe.js","sourceRoot":"","sources":["../../src/events/machineSubscribe.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,cAAc,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEnF,2FAA2F;AAC3F,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,mGAAmG;AACnG,+FAA+F;AAC/F,uEAAuE;AACvE,EAAE;AACF,4FAA4F;AAC5F,wFAAwF;AACxF,kGAAkG;AAClG,iGAAiG;AACjG,8FAA8F;AAC9F,8CAA8C;AAC9C,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,iGAAiG;AACjG,+FAA+F;AAC/F,qFAAqF;AACrF,mEAAmE;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAA;AAEzE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gCAAgC,GAAG,0CAA0C,CAAA;AAc1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAkD;IACzF,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,aAAa;CACnB,CAAA;AAOD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAc/C;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAiB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACtE,GAAG,EAAE,cAAc,CAAC,OAAO;SAC5B,CAAC;QACJ,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IACjF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,sFAAsF;QACtF,wFAAwF;QACxF,wFAAwF;QACxF,uFAAuF;QACvF,yFAAyF;QACzF,kFAAkF;QAClF,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QACjF,CAAC;QACD,qFAAqF;QACrF,+EAA+E;QAC/E,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAClF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;IACjF,CAAC;IAED,6FAA6F;IAC7F,6DAA6D;IAC7D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAChG,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,OAAO,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/http/clientAddress.d.ts

@@ -0,0 +1,40 @@
+/**
+ * How many trusted proxies sit in front of this process (`AUTH_TRUST_PROXY_HOPS`).
+ *
+ * Defaults to 1, the single-reverse-proxy shape, and clamps to at least 1: a 0 would mean
+ * "believe the leftmost entry", which is the client-controlled end of the chain and the very
+ * spoof this setting exists to close. An unparseable value takes the default rather than
+ * failing boot, matching how every other numeric knob here degrades.
+ */
+export declare function resolveTrustedProxyHops(raw: string | undefined): number;
+/**
+ * Pick the client hop out of an `x-forwarded-for` chain, given how many trusted proxies
+ * sit in front of this process.
+ *
+ * The chain grows left to right as a request traverses proxies, so the RIGHTMOST entry was
+ * appended by our nearest proxy and is the address that actually connected to it. That
+ * makes rightmost correct under BOTH common configurations (nginx's appending
+ * `proxy_add_x_forwarded_for` and an overwriting `proxy_set_header`), where leftmost is
+ * correct only under the second and is otherwise whatever the client typed. With `n`
+ * trusted proxies the client sits `n` from the end.
+ *
+ * Returns `null` when the header is absent, unparseable, or SHORTER than the configured
+ * chain: a chain that does not look like the declared topology is not evidence about the
+ * client, so the caller falls back to the socket peer rather than trusting a guess.
+ */
+export declare function forwardedClientAddress(header: string | undefined, trustedHops: number): string | null;
+/**
+ * Normalise one address into the form the throttle keys on, or `null` when it is not an
+ * address at all.
+ *
+ * Two things happen here, both load-bearing:
+ *
+ *  - Anything not IP-shaped is REFUSED rather than passed through. A proxy that appends
+ *    `ip:port` per connection, or an attacker sending free text, would otherwise mint a
+ *    distinct bucket per request and land unbounded strings in the ledger's key column.
+ *  - An IPv6 address is bucketed to its /64. A single residential or hosting allocation is
+ *    routinely a /64 or larger, so keying on the full address gives an attacker 2^64
+ *    buckets, which is the same hole as trusting a spoofable header.
+ */
+export declare function normalizeClientAddress(raw: string): string | null;
+//# sourceMappingURL=clientAddress.d.ts.map

package/dist/http/clientAddress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAddress.d.ts","sourceRoot":"","sources":["../../src/http/clientAddress.ts"],"names":[],"mappings":"AAkBA;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGvE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAUf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBjE"}

package/dist/http/clientAddress.js

@@ -0,0 +1,140 @@
+// ---------------------------------------------------------------------------
+// Client-address resolution for the password throttle (SEC-4).
+//
+// The throttle's whole value rests on the address being one the CLIENT cannot choose:
+// a spoofable value is unlimited fresh buckets (and, worse, the ability to pin a
+// victim's bucket). Which header carries that address is a property of the FACADE's
+// topology, not of the throttle, so the facade resolves it (`resolveClientAddress`) and
+// only the normalisation below is shared:
+//
+//  - The Worker reads `cf-connecting-ip`. That header is authentic on that facade alone,
+//    because the Cloudflare edge injects it and overwrites whatever the client sent.
+//  - Node reads the socket peer by default, and `x-forwarded-for` only when
+//    `AUTH_TRUST_PROXY=true`. It must NOT consult `cf-connecting-ip`: nginx / Caddy /
+//    ALB / HAProxy rewrite `x-forwarded-for` and pass every other header through
+//    untouched, so trusting a Cloudflare-specific header on a generic proxy leaves it
+//    fully client-controlled.
+// ---------------------------------------------------------------------------
+/**
+ * How many trusted proxies sit in front of this process (`AUTH_TRUST_PROXY_HOPS`).
+ *
+ * Defaults to 1, the single-reverse-proxy shape, and clamps to at least 1: a 0 would mean
+ * "believe the leftmost entry", which is the client-controlled end of the chain and the very
+ * spoof this setting exists to close. An unparseable value takes the default rather than
+ * failing boot, matching how every other numeric knob here degrades.
+ */
+export function resolveTrustedProxyHops(raw) {
+    const parsed = Number.parseInt(raw?.trim() ?? '', 10);
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : 1;
+}
+/**
+ * Pick the client hop out of an `x-forwarded-for` chain, given how many trusted proxies
+ * sit in front of this process.
+ *
+ * The chain grows left to right as a request traverses proxies, so the RIGHTMOST entry was
+ * appended by our nearest proxy and is the address that actually connected to it. That
+ * makes rightmost correct under BOTH common configurations (nginx's appending
+ * `proxy_add_x_forwarded_for` and an overwriting `proxy_set_header`), where leftmost is
+ * correct only under the second and is otherwise whatever the client typed. With `n`
+ * trusted proxies the client sits `n` from the end.
+ *
+ * Returns `null` when the header is absent, unparseable, or SHORTER than the configured
+ * chain: a chain that does not look like the declared topology is not evidence about the
+ * client, so the caller falls back to the socket peer rather than trusting a guess.
+ */
+export function forwardedClientAddress(header, trustedHops) {
+    if (!header)
+        return null;
+    const hops = Math.max(1, Math.trunc(trustedHops));
+    const entries = header
+        .split(',')
+        .map((part) => part.trim())
+        .filter(Boolean);
+    const candidate = entries[entries.length - hops];
+    if (!candidate)
+        return null;
+    return normalizeClientAddress(candidate);
+}
+/**
+ * Normalise one address into the form the throttle keys on, or `null` when it is not an
+ * address at all.
+ *
+ * Two things happen here, both load-bearing:
+ *
+ *  - Anything not IP-shaped is REFUSED rather than passed through. A proxy that appends
+ *    `ip:port` per connection, or an attacker sending free text, would otherwise mint a
+ *    distinct bucket per request and land unbounded strings in the ledger's key column.
+ *  - An IPv6 address is bucketed to its /64. A single residential or hosting allocation is
+ *    routinely a /64 or larger, so keying on the full address gives an attacker 2^64
+ *    buckets, which is the same hole as trusting a spoofable header.
+ */
+export function normalizeClientAddress(raw) {
+    let value = raw.trim().toLowerCase();
+    if (!value)
+        return null;
+    // `[2001:db8::1]:443` and `[2001:db8::1]` both carry a bracketed v6 literal.
+    const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(value);
+    if (bracketed?.[1])
+        value = bracketed[1];
+    // A bare `1.2.3.4:443` from a port-appending proxy; a v6 literal has >1 colon so it is
+    // never mistaken for one.
+    else if ((value.match(/:/g) ?? []).length === 1)
+        value = value.split(':')[0] ?? value;
+    // Drop an IPv6 zone index (`fe80::1%eth0`), which is host-local decoration.
+    const zone = value.indexOf('%');
+    if (zone >= 0)
+        value = value.slice(0, zone);
+    if (isIpv4(value))
+        return value;
+    const groups = expandIpv6(value);
+    // The /64 is the routable unit; the interface half is the attacker's to vary freely.
+    return groups ? `${groups.slice(0, 4).join(':')}::/64` : null;
+}
+function isIpv4(value) {
+    const parts = value.split('.');
+    return (parts.length === 4 &&
+        parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255 && (p === '0' || !p.startsWith('0'))));
+}
+/** Expand an IPv6 literal to its eight 16-bit groups, or `null` if it is not one. */
+function expandIpv6(value) {
+    if (!value.includes(':'))
+        return null;
+    const halves = value.split('::');
+    if (halves.length > 2)
+        return null;
+    const parse = (part) => {
+        if (!part)
+            return [];
+        const out = [];
+        for (const group of part.split(':')) {
+            // A trailing dotted-quad (`::ffff:127.0.0.1`) occupies two groups.
+            if (group.includes('.')) {
+                if (!isIpv4(group))
+                    return null;
+                const [a, b, c, d] = group.split('.').map(Number);
+                out.push(hex((a << 8) | b), hex((c << 8) | d));
+                continue;
+            }
+            if (!/^[0-9a-f]{1,4}$/.test(group))
+                return null;
+            out.push(group);
+        }
+        return out;
+    };
+    const head = parse(halves[0] ?? '');
+    const tail = halves.length === 2 ? parse(halves[1] ?? '') : null;
+    if (!head)
+        return null;
+    if (halves.length === 1)
+        return head.length === 8 ? head : null;
+    if (!tail)
+        return null;
+    const fill = 8 - head.length - tail.length;
+    if (fill < 1)
+        return null;
+    return [...head, ...Array.from({ length: fill }, () => '0'), ...tail];
+}
+function hex(n) {
+    return n.toString(16);
+}
+//# sourceMappingURL=clientAddress.js.map

package/dist/http/clientAddress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAddress.js","sourceRoot":"","sources":["../../src/http/clientAddress.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,+DAA+D;AAC/D,EAAE;AACF,sFAAsF;AACtF,iFAAiF;AACjF,oFAAoF;AACpF,wFAAwF;AACxF,0CAA0C;AAC1C,EAAE;AACF,yFAAyF;AACzF,qFAAqF;AACrF,4EAA4E;AAC5E,sFAAsF;AACtF,iFAAiF;AACjF,sFAAsF;AACtF,8BAA8B;AAC9B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA0B,EAC1B,WAAmB;IAEnB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,sBAAsB,CAAC,SAAS,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,6EAA6E;IAC7E,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAAE,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;IACxC,uFAAuF;IACvF,0BAA0B;SACrB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;IACrF,4EAA4E;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,IAAI,IAAI,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;IAChC,qFAAqF;IACrF,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CACjG,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAmB,EAAE;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QACpB,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,mEAAmE;YACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBAC/B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAA;gBACrF,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC9C,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1C,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC"}

package/dist/http/env.d.ts

@@ -1,4 +1,5 @@
-import type { AgentRunRepository, ExecutionRepository, NotificationChannel, ResolveBinaryArtifactStore, ConsensusSessionRepository, ResolveRunRepoContext, Logger, SealedSecretInventory, UserRepoAccessRepository, VcsIdentityRegistry, VcsProviderRegistry, VcsWebhookSink, WorkspacePermission, WorkspaceRole } from '@cat-factory/kernel';
+import type { Context } from 'hono';
+import type { AgentRunRepository, AuthAttemptRepository, ExecutionRepository, MachineNodeRepository, NotificationChannel, ResolveBinaryArtifactStore, ConsensusSessionRepository, ResolveRunRepoContext, Logger, SealedSecretInventory, UserRepoAccessRepository, VcsIdentityRegistry, VcsProviderRegistry, VcsWebhookSink, WorkspacePermission, WorkspaceRole } from '@cat-factory/kernel';
 import type { ApiKeyService, EnvironmentBackendRegistry, LocalModelEndpointService, LocalSettingsService, OpenRouterCatalogService, PersonalSubscriptionService, ProviderSubscriptionService, NotificationWebhookService, PublicApiKeyService, RunnerBackendRegistry, TestSecretsService, CapabilityCredentialsService, ValidationConfigService, UserSecretService } from '@cat-factory/integrations';
 import type { Core } from '@cat-factory/orchestration';
 import type { AgentKindRegistry } from '@cat-factory/agents';
@@ -319,6 +320,30 @@ export interface ServerContainer extends Core {
      * 503s when absent. See docs/initiatives/mothership-mode.md.
      */
     mothershipConnect?: MothershipConnector;
+    /**
+     * The machine-node roster + revocation tombstones (SEC-5): recorded on every machine-token
+     * mint, consulted by the shared machine gate (`verifyMachineRequest`) on every `/internal/*`
+     * machine call so a revoked node is refused everywhere at once, and served to the owner via
+     * `GET /auth/machine-nodes` / `POST /auth/machine-nodes/:nodeId/revoke`. Wired by both hosted
+     * facades from their main DB; absent ⇒ mints go unrecorded and no revocation check runs (a
+     * deployment that never acts as a mothership loses nothing).
+     */
+    machineNodeRepository?: MachineNodeRepository;
+    /**
+     * The durable auth-attempt ledger behind the password-endpoint throttle (SEC-4), the
+     * cross-replica window the per-isolate Map cannot be. Wired by both facades from their main
+     * DB; absent (or erroring) the throttle degrades to the in-process backstop rather than
+     * failing open.
+     */
+    authAttemptRepository?: AuthAttemptRepository;
+    /**
+     * The transport-level client address of a request (the socket peer on Node), read by the
+     * password throttle when `auth.trustProxyHeaders` is off, because a forwarded header is
+     * attacker-controlled unless a trusted proxy overwrites it (SEC-4). Wired by the Node
+     * facade; the Worker leaves it absent because Cloudflare injects `cf-connecting-ip` at the
+     * edge, which that facade trusts instead.
+     */
+    resolveClientAddress?: (c: Context<AppEnv>) => string | undefined;
 }
 /**
  * Mints a GitHub App installation token for a machine-authed mothership-mode node.

package/dist/http/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,EACN,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;OAMG;IACH,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,mBAAmB,CAAA;IACjD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAA;CAC9C;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;QACrB,oGAAoG;QACpG,eAAe,CAAC,EAAE,sBAAsB,CAAA;QACxC;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB;;;;WAIG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;CACF,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,EACN,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;OAMG;IACH,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,mBAAmB,CAAA;IACjD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;IACvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,CAAA;CAClE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAA;CAC9C;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;QACrB,oGAAoG;QACpG,eAAe,CAAC,EAAE,sBAAsB,CAAA;QACxC;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB;;;;WAIG;QACH,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;CACF,CAAA"}

package/dist/index.d.ts

@@ -41,13 +41,14 @@ export { registerCoreControllers } from './app.js';
 export { FanOutEventPublisher, type FanOutEventPublisherDependencies, } from './events/FanOutEventPublisher.js';
 export { InAppNotificationChannel } from './events/InAppNotificationChannel.js';
 export { type MachineEventRelay, type MachineEventClient, type RelayedRealtimeEvent, HttpMachineEventClient, } from './events/machineEvents.js';
-export { type AccountOfWorkspace, type MachineSubscribeAuth, MACHINE_EVENTS_SUBSCRIBE_PATH, MACHINE_EVENTS_SUBSCRIBE_PATTERN, authorizeMachineSubscribe, stripBearer, } from './events/machineSubscribe.js';
+export { type AccountOfWorkspace, type MachineSubscribeAuth, MACHINE_EVENTS_SUBSCRIBE_PATH, MACHINE_EVENTS_SUBSCRIBE_PATTERN, authorizeMachineSubscribe, stripBearer, MACHINE_SUBSCRIBE_ERROR_CODE, type MachineSubscribeRefusalStatus, } from './events/machineSubscribe.js';
 export { type DelegatedNotificationRequest, type MachineNotificationClient, type HttpMachineNotificationClientOptions, type RemoteNotificationChannelOptions, HttpMachineNotificationClient, RemoteNotificationChannel, } from './notifications/machineNotifications.js';
 export { MAX_TELEMETRY_INGEST_CHARS, TELEMETRY_INGEST_LIMITS, type HttpMachineTelemetryClientOptions, type MachineTelemetryClient, type TelemetryIngestRequest, type TelemetryIngestResult, HttpMachineTelemetryClient, MachineTokenUnavailableError, } from './telemetry/machineTelemetry.js';
 export { MAX_TELEMETRY_READ_CHARS, MAX_TELEMETRY_READ_ROW_CHARS, TELEMETRY_READ_METHODS, TELEMETRY_READ_PAGE_SIZES, TELEMETRY_READ_TOO_LARGE_CODE, type HttpMachineTelemetryReadClientOptions, type MachineTelemetryReadClient, type TelemetryReadBound, type TelemetryReadRepository, type TelemetryReadRequest, type TelemetryReadResponse, type TelemetryReadResults, HttpMachineTelemetryReadClient, MachineTokenUnavailableForReadError, TelemetryReadTooLargeError, telemetryReadBodyCap, } from './telemetry/machineTelemetryRead.js';
 export { mountAuthGate } from './http/authGate.js';
 export { REQUEST_ID_HEADER, mountRequestLogging, requestIdOf, requestLogger, resolveRequestId, } from './http/requestLogging.js';
 export { param } from './http/params.js';
+export { forwardedClientAddress, normalizeClientAddress, resolveTrustedProxyHops, } from './http/clientAddress.js';
 export { assertCapability, assertUser, requireCapability, requireUser } from './http/guards.js';
 export { handleError } from './http/errorHandler.js';
 export { CORS_ALLOWED_HEADERS, CORS_EXPOSED_HEADERS, corsReflectsWhenUnset, parseAllowedOrigins, resolveCorsOrigin, } from './http/cors.js';