@llui/agent 0.0.30 → 0.0.31

package/dist/server/factory.js

@@ -1,69 +1,29 @@
-import { InMemoryTokenStore } from './token-store.js';
-import { consoleAuditSink } from './audit.js';
-import { defaultRateLimiter } from './rate-limit.js';
-import { createHttpRouter } from './http/router.js';
-import { createLapRouter } from './lap/router.js';
-import { WsPairingRegistry } from './ws/pairing-registry.js';
+import { createLluiAgentCore } from './core.js';
 import { createWsUpgradeHandler } from './ws/upgrade.js';
-const ANONYMOUS_RESOLVER = async () => null;
 /**
- * Compose the server from its (defaulted) parts. Returns a handle with a
- * `router` that dispatches `/agent/lap/v1/*` (LAP, checked first) then
- * `/agent/*` (HTTP management), and a `wsUpgrade` for `/agent/ws`.
+ * Node adapter. Wraps the runtime-neutral core with a Node-specific
+ * `wsUpgrade` handler that uses the `ws` library. Imports `ws`
+ * eagerly, so this module only works where `ws` is available — use
+ * `@llui/agent/server/web` for Cloudflare Workers, Deno, or other
+ * WHATWG runtimes.
  *
  * Spec §10.1, §10.4.
  */
 export function createLluiAgentServer(opts) {
-    if (!opts.signingKey) {
-        throw new Error('createLluiAgentServer: signingKey is required');
-    }
-    const tokenStore = opts.tokenStore ?? new InMemoryTokenStore();
-    const identityResolver = opts.identityResolver ?? ANONYMOUS_RESOLVER;
-    const auditSink = opts.auditSink ?? consoleAuditSink;
-    const rateLimiter = opts.rateLimiter ?? defaultRateLimiter({ perBucket: '30/minute' });
-    const lapBasePath = opts.lapBasePath ?? '/agent/lap/v1';
-    const registry = new WsPairingRegistry({
-        onLogAppend: (tid, entry) => {
-            void auditSink.write({
-                at: entry.at,
-                tid,
-                uid: null,
-                event: 'lap-call',
-                detail: {
-                    source: 'client-log',
-                    kind: entry.kind,
-                    variant: entry.variant,
-                    intent: entry.intent,
-                },
-            });
-        },
-    });
-    const httpRouter = createHttpRouter({
-        signingKey: opts.signingKey,
-        tokenStore,
-        identityResolver,
-        auditSink,
-        lapBasePath,
-    });
-    const lapRouter = createLapRouter({
-        signingKey: opts.signingKey,
-        tokenStore,
-        registry,
-        auditSink,
-        rateLimiter,
-    }, lapBasePath);
-    const router = async (req) => {
-        const lapRes = await lapRouter(req);
-        if (lapRes)
-            return lapRes;
-        return httpRouter(req);
-    };
+    const core = createLluiAgentCore(opts);
     const wsUpgrade = createWsUpgradeHandler({
         signingKey: opts.signingKey,
-        tokenStore,
-        registry,
-        auditSink,
+        tokenStore: core.tokenStore,
+        registry: core.registry,
+        auditSink: core.auditSink,
     });
-    return { router, wsUpgrade };
+    return {
+        router: core.router,
+        wsUpgrade,
+        registry: core.registry,
+        tokenStore: core.tokenStore,
+        auditSink: core.auditSink,
+        acceptConnection: core.acceptConnection,
+    };
 }
 //# sourceMappingURL=factory.js.map

package/dist/server/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/server/factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAExD,MAAM,kBAAkB,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAA;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,kBAAkB,EAAE,CAAA;IAC9D,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,CAAA;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAA;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,eAAe,CAAA;IAEvD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;QACrC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1B,KAAK,SAAS,CAAC,KAAK,CAAC;gBACnB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,GAAG;gBACH,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE;oBACN,MAAM,EAAE,YAAY;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;IAEF,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU;QACV,gBAAgB;QAChB,SAAS;QACT,WAAW;KACZ,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,eAAe,CAC/B;QACE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU;QACV,QAAQ;QACR,SAAS;QACT,WAAW;KACZ,EACD,WAAW,CACZ,CAAA;IAED,MAAM,MAAM,GAAgC,KAAK,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,OAAO,UAAU,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,sBAAsB,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU;QACV,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;IAEF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AAC9B,CAAC","sourcesContent":["import type { ServerOptions, AgentServerHandle } from './options.js'\nimport { InMemoryTokenStore } from './token-store.js'\nimport { consoleAuditSink } from './audit.js'\nimport { defaultRateLimiter } from './rate-limit.js'\nimport { createHttpRouter } from './http/router.js'\nimport { createLapRouter } from './lap/router.js'\nimport { WsPairingRegistry } from './ws/pairing-registry.js'\nimport { createWsUpgradeHandler } from './ws/upgrade.js'\n\nconst ANONYMOUS_RESOLVER = async () => null\n\n/**\n * Compose the server from its (defaulted) parts. Returns a handle with a\n * `router` that dispatches `/agent/lap/v1/*` (LAP, checked first) then\n * `/agent/*` (HTTP management), and a `wsUpgrade` for `/agent/ws`.\n *\n * Spec §10.1, §10.4.\n */\nexport function createLluiAgentServer(opts: ServerOptions): AgentServerHandle {\n  if (!opts.signingKey) {\n    throw new Error('createLluiAgentServer: signingKey is required')\n  }\n\n  const tokenStore = opts.tokenStore ?? new InMemoryTokenStore()\n  const identityResolver = opts.identityResolver ?? ANONYMOUS_RESOLVER\n  const auditSink = opts.auditSink ?? consoleAuditSink\n  const rateLimiter = opts.rateLimiter ?? defaultRateLimiter({ perBucket: '30/minute' })\n  const lapBasePath = opts.lapBasePath ?? '/agent/lap/v1'\n\n  const registry = new WsPairingRegistry({\n    onLogAppend: (tid, entry) => {\n      void auditSink.write({\n        at: entry.at,\n        tid,\n        uid: null,\n        event: 'lap-call',\n        detail: {\n          source: 'client-log',\n          kind: entry.kind,\n          variant: entry.variant,\n          intent: entry.intent,\n        },\n      })\n    },\n  })\n\n  const httpRouter = createHttpRouter({\n    signingKey: opts.signingKey,\n    tokenStore,\n    identityResolver,\n    auditSink,\n    lapBasePath,\n  })\n\n  const lapRouter = createLapRouter(\n    {\n      signingKey: opts.signingKey,\n      tokenStore,\n      registry,\n      auditSink,\n      rateLimiter,\n    },\n    lapBasePath,\n  )\n\n  const router: AgentServerHandle['router'] = async (req) => {\n    const lapRes = await lapRouter(req)\n    if (lapRes) return lapRes\n    return httpRouter(req)\n  }\n\n  const wsUpgrade = createWsUpgradeHandler({\n    signingKey: opts.signingKey,\n    tokenStore,\n    registry,\n    auditSink,\n  })\n\n  return { router, wsUpgrade }\n}\n"]}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/server/factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,sBAAsB,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAA;AACH,CAAC","sourcesContent":["import type { ServerOptions, AgentServerHandle } from './options.js'\nimport { createLluiAgentCore } from './core.js'\nimport { createWsUpgradeHandler } from './ws/upgrade.js'\n\n/**\n * Node adapter. Wraps the runtime-neutral core with a Node-specific\n * `wsUpgrade` handler that uses the `ws` library. Imports `ws`\n * eagerly, so this module only works where `ws` is available — use\n * `@llui/agent/server/web` for Cloudflare Workers, Deno, or other\n * WHATWG runtimes.\n *\n * Spec §10.1, §10.4.\n */\nexport function createLluiAgentServer(opts: ServerOptions): AgentServerHandle {\n  const core = createLluiAgentCore(opts)\n\n  const wsUpgrade = createWsUpgradeHandler({\n    signingKey: opts.signingKey,\n    tokenStore: core.tokenStore,\n    registry: core.registry,\n    auditSink: core.auditSink,\n  })\n\n  return {\n    router: core.router,\n    wsUpgrade,\n    registry: core.registry,\n    tokenStore: core.tokenStore,\n    auditSink: core.auditSink,\n    acceptConnection: core.acceptConnection,\n  }\n}\n"]}

package/dist/server/http/mint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../../src/server/http/mint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAK5C,MAAM,MAAM,QAAQ,GAAG;IACrB,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,MAAM,CAAA;IACnB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwDhF"}
+{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../../src/server/http/mint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAI5C,MAAM,MAAM,QAAQ,GAAG;IACrB,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,MAAM,CAAA;IACnB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwDhF"}

package/dist/server/http/mint.js

@@ -1,5 +1,4 @@
 import { signToken } from '../token.js';
-import { randomUUID } from 'node:crypto';
 /**
  * POST /agent/mint — creates a pairing record and returns the mint
  * response. See spec §6.2. The caller is responsible for routing
@@ -13,7 +12,7 @@ export async function handleMint(req, deps) {
         });
     }
     const now = deps.now ?? (() => Date.now());
-    const uuid = deps.uuid ?? randomUUID;
+    const uuid = deps.uuid ?? (() => crypto.randomUUID());
     const hardExpiryMs = deps.hardExpiryMs ?? 24 * 60 * 60 * 1000;
     const uid = await deps.identityResolver(req);
     const tid = uuid();
@@ -22,7 +21,7 @@ export async function handleMint(req, deps) {
     const exp = Math.floor((nowMs + hardExpiryMs) / 1000);
     const origin = new URL(req.url).origin;
     const payload = { tid, iat, exp, scope: 'agent' };
-    const token = signToken(payload, deps.signingKey);
+    const token = await signToken(payload, deps.signingKey);
     const record = {
         tid,
         uid,

package/dist/server/http/mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"mint.js","sourceRoot":"","sources":["../../../src/server/http/mint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAgBxC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,IAAc;IAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAA;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAE7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,IAAI,EAAE,CAAA;IAClB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAA;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAEtC,MAAM,OAAO,GAAiB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAEjD,MAAM,MAAM,GAAgB;QAC1B,GAAG;QACH,GAAG;QACH,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,IAAI;QACxB,MAAM;QACN,KAAK,EAAE,IAAI;KACZ,CAAA;IACD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEpC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG;QACH,GAAG;QACH,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,EAAE,MAAM,EAAE;KACnB,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,CAAA;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAE3D,MAAM,IAAI,GAAiB;QACzB,KAAK;QACL,GAAG;QACH,KAAK;QACL,MAAM;QACN,SAAS,EAAE,GAAG;KACf,CAAA;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QACtC,CAAC,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAChD,CAAC,CAAC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AAClD,CAAC","sourcesContent":["import type { TokenStore } from '../token-store.js'\nimport type { IdentityResolver } from '../identity.js'\nimport type { AuditSink } from '../audit.js'\nimport { signToken } from '../token.js'\nimport type { MintResponse, TokenPayload, TokenRecord } from '../../protocol.js'\nimport { randomUUID } from 'node:crypto'\n\nexport type MintDeps = {\n  signingKey: string | Uint8Array\n  tokenStore: TokenStore\n  identityResolver: IdentityResolver\n  auditSink: AuditSink\n  lapBasePath: string\n  /** Wall-clock in milliseconds; injectable for tests. */\n  now?: () => number\n  /** UUID generator; injectable for tests. */\n  uuid?: () => string\n  /** Hard-expiry window, default 24 h. */\n  hardExpiryMs?: number\n}\n\n/**\n * POST /agent/mint — creates a pairing record and returns the mint\n * response. See spec §6.2. The caller is responsible for routing\n * `/agent/mint` requests to this handler; `router.ts` composes that.\n */\nexport async function handleMint(req: Request, deps: MintDeps): Promise<Response> {\n  if (req.method !== 'POST') {\n    return new Response(JSON.stringify({ error: { code: 'method-not-allowed' } }), {\n      status: 405,\n      headers: { 'content-type': 'application/json' },\n    })\n  }\n\n  const now = deps.now ?? (() => Date.now())\n  const uuid = deps.uuid ?? randomUUID\n  const hardExpiryMs = deps.hardExpiryMs ?? 24 * 60 * 60 * 1000\n\n  const uid = await deps.identityResolver(req)\n  const tid = uuid()\n  const nowMs = now()\n  const iat = Math.floor(nowMs / 1000)\n  const exp = Math.floor((nowMs + hardExpiryMs) / 1000)\n  const origin = new URL(req.url).origin\n\n  const payload: TokenPayload = { tid, iat, exp, scope: 'agent' }\n  const token = signToken(payload, deps.signingKey)\n\n  const record: TokenRecord = {\n    tid,\n    uid,\n    status: 'awaiting-ws',\n    createdAt: nowMs,\n    lastSeenAt: nowMs,\n    pendingResumeUntil: null,\n    origin,\n    label: null,\n  }\n  await deps.tokenStore.create(record)\n\n  await deps.auditSink.write({\n    at: nowMs,\n    tid,\n    uid,\n    event: 'mint',\n    detail: { origin },\n  })\n\n  const wsUrl = toWsUrl(new URL(req.url).origin) + '/agent/ws'\n  const lapUrl = new URL(deps.lapBasePath, origin).toString()\n\n  const body: MintResponse = {\n    token,\n    tid,\n    wsUrl,\n    lapUrl,\n    expiresAt: exp,\n  }\n  return new Response(JSON.stringify(body), {\n    status: 200,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nfunction toWsUrl(httpOrigin: string): string {\n  return httpOrigin.startsWith('https://')\n    ? 'wss://' + httpOrigin.slice('https://'.length)\n    : 'ws://' + httpOrigin.slice('http://'.length)\n}\n"]}
+{"version":3,"file":"mint.js","sourceRoot":"","sources":["../../../src/server/http/mint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAiBvC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,IAAc;IAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAE7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,IAAI,EAAE,CAAA;IAClB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAA;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAEtC,MAAM,OAAO,GAAiB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAEvD,MAAM,MAAM,GAAgB;QAC1B,GAAG;QACH,GAAG;QACH,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,IAAI;QACxB,MAAM;QACN,KAAK,EAAE,IAAI;KACZ,CAAA;IACD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEpC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG;QACH,GAAG;QACH,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,EAAE,MAAM,EAAE;KACnB,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,CAAA;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAE3D,MAAM,IAAI,GAAiB;QACzB,KAAK;QACL,GAAG;QACH,KAAK;QACL,MAAM;QACN,SAAS,EAAE,GAAG;KACf,CAAA;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QACtC,CAAC,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAChD,CAAC,CAAC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AAClD,CAAC","sourcesContent":["import type { TokenStore } from '../token-store.js'\nimport type { IdentityResolver } from '../identity.js'\nimport type { AuditSink } from '../audit.js'\nimport { signToken } from '../token.js'\nimport type { MintResponse, TokenPayload, TokenRecord } from '../../protocol.js'\n\nexport type MintDeps = {\n  signingKey: string | Uint8Array\n  tokenStore: TokenStore\n  identityResolver: IdentityResolver\n  auditSink: AuditSink\n  lapBasePath: string\n  /** Wall-clock in milliseconds; injectable for tests. */\n  now?: () => number\n  /** UUID generator; injectable for tests. */\n  uuid?: () => string\n  /** Hard-expiry window, default 24 h. */\n  hardExpiryMs?: number\n}\n\n/**\n * POST /agent/mint — creates a pairing record and returns the mint\n * response. See spec §6.2. The caller is responsible for routing\n * `/agent/mint` requests to this handler; `router.ts` composes that.\n */\nexport async function handleMint(req: Request, deps: MintDeps): Promise<Response> {\n  if (req.method !== 'POST') {\n    return new Response(JSON.stringify({ error: { code: 'method-not-allowed' } }), {\n      status: 405,\n      headers: { 'content-type': 'application/json' },\n    })\n  }\n\n  const now = deps.now ?? (() => Date.now())\n  const uuid = deps.uuid ?? (() => crypto.randomUUID())\n  const hardExpiryMs = deps.hardExpiryMs ?? 24 * 60 * 60 * 1000\n\n  const uid = await deps.identityResolver(req)\n  const tid = uuid()\n  const nowMs = now()\n  const iat = Math.floor(nowMs / 1000)\n  const exp = Math.floor((nowMs + hardExpiryMs) / 1000)\n  const origin = new URL(req.url).origin\n\n  const payload: TokenPayload = { tid, iat, exp, scope: 'agent' }\n  const token = await signToken(payload, deps.signingKey)\n\n  const record: TokenRecord = {\n    tid,\n    uid,\n    status: 'awaiting-ws',\n    createdAt: nowMs,\n    lastSeenAt: nowMs,\n    pendingResumeUntil: null,\n    origin,\n    label: null,\n  }\n  await deps.tokenStore.create(record)\n\n  await deps.auditSink.write({\n    at: nowMs,\n    tid,\n    uid,\n    event: 'mint',\n    detail: { origin },\n  })\n\n  const wsUrl = toWsUrl(new URL(req.url).origin) + '/agent/ws'\n  const lapUrl = new URL(deps.lapBasePath, origin).toString()\n\n  const body: MintResponse = {\n    token,\n    tid,\n    wsUrl,\n    lapUrl,\n    expiresAt: exp,\n  }\n  return new Response(JSON.stringify(body), {\n    status: 200,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nfunction toWsUrl(httpOrigin: string): string {\n  return httpOrigin.startsWith('https://')\n    ? 'wss://' + httpOrigin.slice('https://'.length)\n    : 'ws://' + httpOrigin.slice('http://'.length)\n}\n"]}

package/dist/server/http/resume.js

@@ -53,7 +53,7 @@ export async function handleResumeClaim(req, deps) {
     const iat = Math.floor(nowMs / 1000);
     const exp = Math.floor((nowMs + hardExpiryMs) / 1000);
     const payload = { tid: rec.tid, iat, exp, scope: 'agent' };
-    const token = signToken(payload, deps.signingKey);
+    const token = await signToken(payload, deps.signingKey);
     await deps.tokenStore.markActive(rec.tid, rec.label ?? '(resumed)', nowMs);
     await deps.auditSink.write({
         at: nowMs,

package/dist/server/http/resume.js.map

@@ -1 +1 @@
-{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../../src/server/http/resume.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAmBvC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,IAAgB;IACnE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,gBAAgB,EAAE,CAAA;IACpD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA6B,CAAA;IAC7E,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,EAAE,CAAA;IAE3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,MAAM,GAAG,GAAmB,EAAE,CAAA;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,SAAQ;QAClB,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;YAAE,SAAQ;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB;YAAE,SAAQ;QAC7C,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,GAAG,KAAK;YAAE,SAAQ;QAC/E,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,WAAW;YAC/B,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAA;IACrD,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,IAAgB;IACpE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,gBAAgB,EAAE,CAAA;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAEhE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAA;IAC9E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAA;IAE9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,EAAE,CAAA;IAC5B,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,SAAS,EAAE,CAAA;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,SAAS,EAAE,CAAA;IAEvD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,EAAE,CAAA;IAE7C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAA;IACrD,MAAM,OAAO,GAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACxE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAEjD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,WAAW,EAAE,KAAK,CAAC,CAAA;IAE1E,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,EAAE,MAAM,EAAE;KACnB,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,WAAW,CAAA;IAC3C,MAAM,GAAG,GAAwB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACjD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QACtC,CAAC,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAChD,CAAC,CAAC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AAClD,CAAC","sourcesContent":["import type { TokenStore } from '../token-store.js'\nimport type { IdentityResolver } from '../identity.js'\nimport type { AuditSink } from '../audit.js'\nimport { signToken } from '../token.js'\nimport type {\n  ResumeListRequest,\n  ResumeListResponse,\n  ResumeClaimRequest,\n  ResumeClaimResponse,\n  TokenPayload,\n  AgentSession,\n} from '../../protocol.js'\n\nexport type ResumeDeps = {\n  tokenStore: TokenStore\n  identityResolver: IdentityResolver\n  auditSink: AuditSink\n  signingKey?: string | Uint8Array\n  now?: () => number\n  hardExpiryMs?: number\n}\n\nexport async function handleResumeList(req: Request, deps: ResumeDeps): Promise<Response> {\n  if (req.method !== 'POST') return methodNotAllowed()\n  const body = (await req.json().catch(() => null)) as ResumeListRequest | null\n  if (!body || !Array.isArray(body.tids)) return badRequest()\n\n  const uid = await deps.identityResolver(req)\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  const out: AgentSession[] = []\n  for (const tid of body.tids) {\n    const rec = await deps.tokenStore.findByTid(tid)\n    if (!rec) continue\n    if (rec.uid !== uid) continue\n    if (rec.status !== 'pending-resume') continue\n    if (rec.pendingResumeUntil === null || rec.pendingResumeUntil < nowMs) continue\n    out.push({\n      tid: rec.tid,\n      label: rec.label ?? '(unknown)',\n      status: 'pending-resume',\n      createdAt: rec.createdAt,\n      lastSeenAt: rec.lastSeenAt,\n    })\n  }\n\n  const payload: ResumeListResponse = { sessions: out }\n  return jsonResponse(payload, 200)\n}\n\nexport async function handleResumeClaim(req: Request, deps: ResumeDeps): Promise<Response> {\n  if (req.method !== 'POST') return methodNotAllowed()\n  if (!deps.signingKey) return new Response(null, { status: 500 })\n\n  const body = (await req.json().catch(() => null)) as ResumeClaimRequest | null\n  if (!body || typeof body.tid !== 'string') return badRequest()\n\n  const uid = await deps.identityResolver(req)\n  const rec = await deps.tokenStore.findByTid(body.tid)\n  if (!rec) return forbidden()\n  if (rec.uid !== uid) return forbidden()\n  if (rec.status !== 'pending-resume') return forbidden()\n\n  const origin = new URL(req.url).origin\n  if (rec.origin !== origin) return forbidden()\n\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  const hardExpiryMs = deps.hardExpiryMs ?? 24 * 60 * 60 * 1000\n  const iat = Math.floor(nowMs / 1000)\n  const exp = Math.floor((nowMs + hardExpiryMs) / 1000)\n  const payload: TokenPayload = { tid: rec.tid, iat, exp, scope: 'agent' }\n  const token = signToken(payload, deps.signingKey)\n\n  await deps.tokenStore.markActive(rec.tid, rec.label ?? '(resumed)', nowMs)\n\n  await deps.auditSink.write({\n    at: nowMs,\n    tid: rec.tid,\n    uid: rec.uid,\n    event: 'claim',\n    detail: { origin },\n  })\n\n  const wsUrl = toWsUrl(origin) + '/agent/ws'\n  const out: ResumeClaimResponse = { token, wsUrl }\n  return jsonResponse(out, 200)\n}\n\nfunction jsonResponse(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nfunction methodNotAllowed(): Response {\n  return jsonResponse({ error: { code: 'method-not-allowed' } }, 405)\n}\n\nfunction badRequest(): Response {\n  return jsonResponse({ error: { code: 'invalid' } }, 400)\n}\n\nfunction forbidden(): Response {\n  return jsonResponse({ error: { code: 'revoked' } }, 403)\n}\n\nfunction toWsUrl(httpOrigin: string): string {\n  return httpOrigin.startsWith('https://')\n    ? 'wss://' + httpOrigin.slice('https://'.length)\n    : 'ws://' + httpOrigin.slice('http://'.length)\n}\n"]}
+{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../../src/server/http/resume.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAmBvC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,IAAgB;IACnE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,gBAAgB,EAAE,CAAA;IACpD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA6B,CAAA;IAC7E,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,EAAE,CAAA;IAE3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,MAAM,GAAG,GAAmB,EAAE,CAAA;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,SAAQ;QAClB,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;YAAE,SAAQ;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB;YAAE,SAAQ;QAC7C,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,GAAG,KAAK;YAAE,SAAQ;QAC/E,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,WAAW;YAC/B,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAA;IACrD,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,IAAgB;IACpE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,gBAAgB,EAAE,CAAA;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAEhE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAA;IAC9E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAA;IAE9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,EAAE,CAAA;IAC5B,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,SAAS,EAAE,CAAA;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,SAAS,EAAE,CAAA;IAEvD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,EAAE,CAAA;IAE7C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAA;IACrD,MAAM,OAAO,GAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACxE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAEvD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,WAAW,EAAE,KAAK,CAAC,CAAA;IAE1E,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,EAAE,MAAM,EAAE;KACnB,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,WAAW,CAAA;IAC3C,MAAM,GAAG,GAAwB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACjD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QACtC,CAAC,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAChD,CAAC,CAAC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AAClD,CAAC","sourcesContent":["import type { TokenStore } from '../token-store.js'\nimport type { IdentityResolver } from '../identity.js'\nimport type { AuditSink } from '../audit.js'\nimport { signToken } from '../token.js'\nimport type {\n  ResumeListRequest,\n  ResumeListResponse,\n  ResumeClaimRequest,\n  ResumeClaimResponse,\n  TokenPayload,\n  AgentSession,\n} from '../../protocol.js'\n\nexport type ResumeDeps = {\n  tokenStore: TokenStore\n  identityResolver: IdentityResolver\n  auditSink: AuditSink\n  signingKey?: string | Uint8Array\n  now?: () => number\n  hardExpiryMs?: number\n}\n\nexport async function handleResumeList(req: Request, deps: ResumeDeps): Promise<Response> {\n  if (req.method !== 'POST') return methodNotAllowed()\n  const body = (await req.json().catch(() => null)) as ResumeListRequest | null\n  if (!body || !Array.isArray(body.tids)) return badRequest()\n\n  const uid = await deps.identityResolver(req)\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  const out: AgentSession[] = []\n  for (const tid of body.tids) {\n    const rec = await deps.tokenStore.findByTid(tid)\n    if (!rec) continue\n    if (rec.uid !== uid) continue\n    if (rec.status !== 'pending-resume') continue\n    if (rec.pendingResumeUntil === null || rec.pendingResumeUntil < nowMs) continue\n    out.push({\n      tid: rec.tid,\n      label: rec.label ?? '(unknown)',\n      status: 'pending-resume',\n      createdAt: rec.createdAt,\n      lastSeenAt: rec.lastSeenAt,\n    })\n  }\n\n  const payload: ResumeListResponse = { sessions: out }\n  return jsonResponse(payload, 200)\n}\n\nexport async function handleResumeClaim(req: Request, deps: ResumeDeps): Promise<Response> {\n  if (req.method !== 'POST') return methodNotAllowed()\n  if (!deps.signingKey) return new Response(null, { status: 500 })\n\n  const body = (await req.json().catch(() => null)) as ResumeClaimRequest | null\n  if (!body || typeof body.tid !== 'string') return badRequest()\n\n  const uid = await deps.identityResolver(req)\n  const rec = await deps.tokenStore.findByTid(body.tid)\n  if (!rec) return forbidden()\n  if (rec.uid !== uid) return forbidden()\n  if (rec.status !== 'pending-resume') return forbidden()\n\n  const origin = new URL(req.url).origin\n  if (rec.origin !== origin) return forbidden()\n\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  const hardExpiryMs = deps.hardExpiryMs ?? 24 * 60 * 60 * 1000\n  const iat = Math.floor(nowMs / 1000)\n  const exp = Math.floor((nowMs + hardExpiryMs) / 1000)\n  const payload: TokenPayload = { tid: rec.tid, iat, exp, scope: 'agent' }\n  const token = await signToken(payload, deps.signingKey)\n\n  await deps.tokenStore.markActive(rec.tid, rec.label ?? '(resumed)', nowMs)\n\n  await deps.auditSink.write({\n    at: nowMs,\n    tid: rec.tid,\n    uid: rec.uid,\n    event: 'claim',\n    detail: { origin },\n  })\n\n  const wsUrl = toWsUrl(origin) + '/agent/ws'\n  const out: ResumeClaimResponse = { token, wsUrl }\n  return jsonResponse(out, 200)\n}\n\nfunction jsonResponse(body: unknown, status: number): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nfunction methodNotAllowed(): Response {\n  return jsonResponse({ error: { code: 'method-not-allowed' } }, 405)\n}\n\nfunction badRequest(): Response {\n  return jsonResponse({ error: { code: 'invalid' } }, 400)\n}\n\nfunction forbidden(): Response {\n  return jsonResponse({ error: { code: 'revoked' } }, 403)\n}\n\nfunction toWsUrl(httpOrigin: string): string {\n  return httpOrigin.startsWith('https://')\n    ? 'wss://' + httpOrigin.slice('https://'.length)\n    : 'ws://' + httpOrigin.slice('http://'.length)\n}\n"]}

package/dist/server/identity.d.ts

@@ -4,5 +4,9 @@ export type IdentityCookieConfig = {
     signingKey: string | Uint8Array;
 };
 export declare function defaultIdentityResolver(cfg: IdentityCookieConfig): IdentityResolver;
-export declare function signCookieValue(value: string, signingKey: string | Uint8Array): string;
+/**
+ * Async because `crypto.subtle.sign` is the cross-runtime standard.
+ * Callers building a `Set-Cookie` header must `await` this.
+ */
+export declare function signCookieValue(value: string, signingKey: string | Uint8Array): Promise<string>;
 //# sourceMappingURL=identity.d.ts.map

package/dist/server/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/server/identity.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAEvE,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;CAChC,CAAA;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,oBAAoB,GAAG,gBAAgB,CA8BnF;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAKtF"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/server/identity.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAEvE,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;CAChC,CAAA;AA4CD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,oBAAoB,GAAG,gBAAgB,CA4BnF;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GAAG,UAAU,GAC9B,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/server/identity.js

@@ -1,11 +1,42 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
+/**
+ * Normalize to `Uint8Array<ArrayBuffer>` — WebCrypto rejects
+ * `Uint8Array<ArrayBufferLike>` which is what `TextEncoder.encode()`
+ * produces under newer TS lib types. One-shot copy is cheap.
+ */
+function toBytes(input) {
+    const raw = typeof input === 'string' ? new TextEncoder().encode(input) : input;
+    const buf = new ArrayBuffer(raw.byteLength);
+    const out = new Uint8Array(buf);
+    out.set(raw);
+    return out;
+}
+async function importHmacKey(key, usages) {
+    return crypto.subtle.importKey('raw', toBytes(key), { name: 'HMAC', hash: 'SHA-256' }, false, usages);
+}
+function toBase64Url(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.byteLength; i++)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function fromBase64Url(s) {
+    try {
+        const b64 = s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4);
+        const bin = atob(b64);
+        const buf = new ArrayBuffer(bin.length);
+        const bytes = new Uint8Array(buf);
+        for (let i = 0; i < bin.length; i++)
+            bytes[i] = bin.charCodeAt(i);
+        return bytes;
+    }
+    catch {
+        return null;
+    }
+}
 export function defaultIdentityResolver(cfg) {
     if (!cfg.signingKey || (typeof cfg.signingKey === 'string' && cfg.signingKey.length < 32)) {
         throw new Error('IdentityCookie signingKey must be at least 32 bytes');
     }
-    const keyBuf = typeof cfg.signingKey === 'string'
-        ? Buffer.from(cfg.signingKey, 'utf8')
-        : Buffer.from(cfg.signingKey);
     return async (req) => {
         const cookie = req.headers.get('cookie');
         if (!cookie)
@@ -24,18 +55,25 @@ export function defaultIdentityResolver(cfg) {
                 return null;
             const rawValue = value.slice(0, dot);
             const sigPart = value.slice(dot + 1);
-            const sigBuf = Buffer.from(sigPart, 'base64url');
-            const expected = createHmac('sha256', keyBuf).update(rawValue).digest();
-            if (expected.length !== sigBuf.length || !timingSafeEqual(expected, sigBuf))
+            const sigBytes = fromBase64Url(sigPart);
+            if (!sigBytes)
+                return null;
+            const cryptoKey = await importHmacKey(cfg.signingKey, ['verify']);
+            const ok = await crypto.subtle.verify('HMAC', cryptoKey, sigBytes, toBytes(rawValue));
+            if (!ok)
                 return null;
             return rawValue;
         }
         return null;
     };
 }
-export function signCookieValue(value, signingKey) {
-    const keyBuf = typeof signingKey === 'string' ? Buffer.from(signingKey, 'utf8') : Buffer.from(signingKey);
-    const mac = createHmac('sha256', keyBuf).update(value).digest('base64url');
-    return `${value}.${mac}`;
+/**
+ * Async because `crypto.subtle.sign` is the cross-runtime standard.
+ * Callers building a `Set-Cookie` header must `await` this.
+ */
+export async function signCookieValue(value, signingKey) {
+    const cryptoKey = await importHmacKey(signingKey, ['sign']);
+    const macBuf = await crypto.subtle.sign('HMAC', cryptoKey, toBytes(value));
+    return `${value}.${toBase64Url(new Uint8Array(macBuf))}`;
 }
 //# sourceMappingURL=identity.js.map

package/dist/server/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/server/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AASzD,MAAM,UAAU,uBAAuB,CAAC,GAAyB;IAC/D,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAChC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,EAAE,GAAG,CAAC;gBAAE,SAAQ;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YAChC,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI;gBAAE,SAAQ;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAA;YACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAA;YACxF,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,UAA+B;IAC5E,MAAM,MAAM,GACV,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5F,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC1E,OAAO,GAAG,KAAK,IAAI,GAAG,EAAE,CAAA;AAC1B,CAAC","sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto'\n\nexport type IdentityResolver = (req: Request) => Promise<string | null>\n\nexport type IdentityCookieConfig = {\n  name: string\n  signingKey: string | Uint8Array\n}\n\nexport function defaultIdentityResolver(cfg: IdentityCookieConfig): IdentityResolver {\n  if (!cfg.signingKey || (typeof cfg.signingKey === 'string' && cfg.signingKey.length < 32)) {\n    throw new Error('IdentityCookie signingKey must be at least 32 bytes')\n  }\n  const keyBuf =\n    typeof cfg.signingKey === 'string'\n      ? Buffer.from(cfg.signingKey, 'utf8')\n      : Buffer.from(cfg.signingKey)\n\n  return async (req) => {\n    const cookie = req.headers.get('cookie')\n    if (!cookie) return null\n    const pairs = cookie.split(';').map((s) => s.trim())\n    for (const pair of pairs) {\n      const eq = pair.indexOf('=')\n      if (eq < 0) continue\n      const name = pair.slice(0, eq)\n      const value = pair.slice(eq + 1)\n      if (name !== cfg.name) continue\n      const dot = value.indexOf('.')\n      if (dot < 0) return null\n      const rawValue = value.slice(0, dot)\n      const sigPart = value.slice(dot + 1)\n      const sigBuf = Buffer.from(sigPart, 'base64url')\n      const expected = createHmac('sha256', keyBuf).update(rawValue).digest()\n      if (expected.length !== sigBuf.length || !timingSafeEqual(expected, sigBuf)) return null\n      return rawValue\n    }\n    return null\n  }\n}\n\nexport function signCookieValue(value: string, signingKey: string | Uint8Array): string {\n  const keyBuf =\n    typeof signingKey === 'string' ? Buffer.from(signingKey, 'utf8') : Buffer.from(signingKey)\n  const mac = createHmac('sha256', keyBuf).update(value).digest('base64url')\n  return `${value}.${mac}`\n}\n"]}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/server/identity.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAA0B;IACzC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC/E,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAwB,EAAE,MAAkB;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,GAAG,CAAC,EACZ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,MAAM,CACP,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAyB;IAC/D,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,EAAE,GAAG,CAAC;gBAAE,SAAQ;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YAChC,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI;gBAAE,SAAQ;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAC1B,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;YACrF,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YACpB,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,UAA+B;IAE/B,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,OAAO,GAAG,KAAK,IAAI,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AAC1D,CAAC","sourcesContent":["export type IdentityResolver = (req: Request) => Promise<string | null>\n\nexport type IdentityCookieConfig = {\n  name: string\n  signingKey: string | Uint8Array\n}\n\n/**\n * Normalize to `Uint8Array<ArrayBuffer>` — WebCrypto rejects\n * `Uint8Array<ArrayBufferLike>` which is what `TextEncoder.encode()`\n * produces under newer TS lib types. One-shot copy is cheap.\n */\nfunction toBytes(input: string | Uint8Array): Uint8Array<ArrayBuffer> {\n  const raw = typeof input === 'string' ? new TextEncoder().encode(input) : input\n  const buf = new ArrayBuffer(raw.byteLength)\n  const out = new Uint8Array(buf)\n  out.set(raw)\n  return out\n}\n\nasync function importHmacKey(key: string | Uint8Array, usages: KeyUsage[]): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    'raw',\n    toBytes(key),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    usages,\n  )\n}\n\nfunction toBase64Url(bytes: Uint8Array): string {\n  let bin = ''\n  for (let i = 0; i < bytes.byteLength; i++) bin += String.fromCharCode(bytes[i]!)\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nfunction fromBase64Url(s: string): Uint8Array<ArrayBuffer> | null {\n  try {\n    const b64 = s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4)\n    const bin = atob(b64)\n    const buf = new ArrayBuffer(bin.length)\n    const bytes = new Uint8Array(buf)\n    for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i)\n    return bytes\n  } catch {\n    return null\n  }\n}\n\nexport function defaultIdentityResolver(cfg: IdentityCookieConfig): IdentityResolver {\n  if (!cfg.signingKey || (typeof cfg.signingKey === 'string' && cfg.signingKey.length < 32)) {\n    throw new Error('IdentityCookie signingKey must be at least 32 bytes')\n  }\n\n  return async (req) => {\n    const cookie = req.headers.get('cookie')\n    if (!cookie) return null\n    const pairs = cookie.split(';').map((s) => s.trim())\n    for (const pair of pairs) {\n      const eq = pair.indexOf('=')\n      if (eq < 0) continue\n      const name = pair.slice(0, eq)\n      const value = pair.slice(eq + 1)\n      if (name !== cfg.name) continue\n      const dot = value.indexOf('.')\n      if (dot < 0) return null\n      const rawValue = value.slice(0, dot)\n      const sigPart = value.slice(dot + 1)\n      const sigBytes = fromBase64Url(sigPart)\n      if (!sigBytes) return null\n      const cryptoKey = await importHmacKey(cfg.signingKey, ['verify'])\n      const ok = await crypto.subtle.verify('HMAC', cryptoKey, sigBytes, toBytes(rawValue))\n      if (!ok) return null\n      return rawValue\n    }\n    return null\n  }\n}\n\n/**\n * Async because `crypto.subtle.sign` is the cross-runtime standard.\n * Callers building a `Set-Cookie` header must `await` this.\n */\nexport async function signCookieValue(\n  value: string,\n  signingKey: string | Uint8Array,\n): Promise<string> {\n  const cryptoKey = await importHmacKey(signingKey, ['sign'])\n  const macBuf = await crypto.subtle.sign('HMAC', cryptoKey, toBytes(value))\n  return `${value}.${toBase64Url(new Uint8Array(macBuf))}`\n}\n"]}

package/dist/server/index.d.ts

@@ -1,11 +1,26 @@
+/**
+ * Default entry for Node server processes. Bundles the runtime-neutral
+ * core with a `ws`-library-based WebSocket upgrade handler. For web
+ * runtimes (Cloudflare Workers, Deno, Bun) where `ws` isn't
+ * available, use `@llui/agent/server/core` + `@llui/agent/server/web`
+ * instead.
+ */
 export { createLluiAgentServer } from './factory.js';
 export type { ServerOptions, AgentServerHandle } from './options.js';
+export { createLluiAgentCore } from './core.js';
+export type { CoreOptions, AgentCoreHandle, AcceptResult } from './core.js';
+export { InMemoryPairingRegistry } from './ws/pairing-registry.js';
+export type { PairingConnection, PairingRegistry, FrameSubscriber } from './ws/pairing-registry.js';
+export { rpc, waitForConfirm, waitForChange } from './ws/rpc.js';
+export type { RpcOptions, RpcError } from './ws/rpc.js';
 export { InMemoryTokenStore } from './token-store.js';
 export type { TokenStore } from './token-store.js';
-export { defaultIdentityResolver } from './identity.js';
+export { defaultIdentityResolver, signCookieValue } from './identity.js';
 export type { IdentityResolver } from './identity.js';
 export { consoleAuditSink } from './audit.js';
 export type { AuditSink } from './audit.js';
 export { defaultRateLimiter } from './rate-limit.js';
 export type { RateLimiter } from './rate-limit.js';
+export { signToken, verifyToken } from './token.js';
+export type { TokenPayload, VerifyResult } from './token.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAC/C,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAClE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AACnG,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACxE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACnD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}

package/dist/server/index.js

@@ -1,6 +1,18 @@
+/**
+ * Default entry for Node server processes. Bundles the runtime-neutral
+ * core with a `ws`-library-based WebSocket upgrade handler. For web
+ * runtimes (Cloudflare Workers, Deno, Bun) where `ws` isn't
+ * available, use `@llui/agent/server/core` + `@llui/agent/server/web`
+ * instead.
+ */
 export { createLluiAgentServer } from './factory.js';
+// Runtime-neutral core — re-exported so Node users don't need a second import.
+export { createLluiAgentCore } from './core.js';
+export { InMemoryPairingRegistry } from './ws/pairing-registry.js';
+export { rpc, waitForConfirm, waitForChange } from './ws/rpc.js';
 export { InMemoryTokenStore } from './token-store.js';
-export { defaultIdentityResolver } from './identity.js';
+export { defaultIdentityResolver, signCookieValue } from './identity.js';
 export { consoleAuditSink } from './audit.js';
 export { defaultRateLimiter } from './rate-limit.js';
+export { signToken, verifyToken } from './token.js';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA","sourcesContent":["export { createLluiAgentServer } from './factory.js'\nexport type { ServerOptions, AgentServerHandle } from './options.js'\nexport { InMemoryTokenStore } from './token-store.js'\nexport type { TokenStore } from './token-store.js'\nexport { defaultIdentityResolver } from './identity.js'\nexport type { IdentityResolver } from './identity.js'\nexport { consoleAuditSink } from './audit.js'\nexport type { AuditSink } from './audit.js'\nexport { defaultRateLimiter } from './rate-limit.js'\nexport type { RateLimiter } from './rate-limit.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEpD,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAE/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAElE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA","sourcesContent":["/**\n * Default entry for Node server processes. Bundles the runtime-neutral\n * core with a `ws`-library-based WebSocket upgrade handler. For web\n * runtimes (Cloudflare Workers, Deno, Bun) where `ws` isn't\n * available, use `@llui/agent/server/core` + `@llui/agent/server/web`\n * instead.\n */\nexport { createLluiAgentServer } from './factory.js'\nexport type { ServerOptions, AgentServerHandle } from './options.js'\n// Runtime-neutral core — re-exported so Node users don't need a second import.\nexport { createLluiAgentCore } from './core.js'\nexport type { CoreOptions, AgentCoreHandle, AcceptResult } from './core.js'\nexport { InMemoryPairingRegistry } from './ws/pairing-registry.js'\nexport type { PairingConnection, PairingRegistry, FrameSubscriber } from './ws/pairing-registry.js'\nexport { rpc, waitForConfirm, waitForChange } from './ws/rpc.js'\nexport type { RpcOptions, RpcError } from './ws/rpc.js'\nexport { InMemoryTokenStore } from './token-store.js'\nexport type { TokenStore } from './token-store.js'\nexport { defaultIdentityResolver, signCookieValue } from './identity.js'\nexport type { IdentityResolver } from './identity.js'\nexport { consoleAuditSink } from './audit.js'\nexport type { AuditSink } from './audit.js'\nexport { defaultRateLimiter } from './rate-limit.js'\nexport type { RateLimiter } from './rate-limit.js'\nexport { signToken, verifyToken } from './token.js'\nexport type { TokenPayload, VerifyResult } from './token.js'\n"]}

package/dist/server/lap/confirm-result.d.ts

@@ -1,11 +1,11 @@
 import type { TokenStore } from '../token-store.js';
-import type { WsPairingRegistry } from '../ws/pairing-registry.js';
+import type { PairingRegistry } from '../ws/pairing-registry.js';
 import type { AuditSink } from '../audit.js';
 import type { RateLimiter } from '../rate-limit.js';
 export type LapConfirmResultDeps = {
     signingKey: string | Uint8Array;
     tokenStore: TokenStore;
-    registry: WsPairingRegistry;
+    registry: PairingRegistry;
     auditSink: AuditSink;
     rateLimiter: RateLimiter;
     now?: () => number;

package/dist/server/lap/confirm-result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-result.d.ts","sourceRoot":"","sources":["../../../src/server/lap/confirm-result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAInD,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,QAAQ,CAAC,CA0DnB"}
+{"version":3,"file":"confirm-result.d.ts","sourceRoot":"","sources":["../../../src/server/lap/confirm-result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAInD,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,eAAe,CAAA;IACzB,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,QAAQ,CAAC,CA0DnB"}

package/dist/server/lap/confirm-result.js

@@ -1,6 +1,6 @@
 import { verifyAndReadTid } from './describe.js';
 export async function handleLapConfirmResult(req, deps) {
-    const auth = verifyAndReadTid(req, deps.signingKey);
+    const auth = await verifyAndReadTid(req, deps.signingKey);
     if (!auth.ok)
         return json({ error: { code: auth.code } }, auth.status);
     const rec = await deps.tokenStore.findByTid(auth.tid);

package/dist/server/lap/confirm-result.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-result.js","sourceRoot":"","sources":["../../../src/server/lap/confirm-result.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAYhD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAY,EACZ,IAA0B;IAE1B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAEtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC/D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAA;IACnF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAEzC,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAEtF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YACzB,EAAE,EAAE,KAAK;YACT,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SACtC,CAAC,CAAA;QACF,OAAO,IAAI,CACT,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAqC,EACzF,GAAG,CACJ,CAAA;IACH,CAAC;IACD,sFAAsF;IACtF,uFAAuF;IACvF,sFAAsF;IACtF,uFAAuF;IACvF,uFAAuF;IACvF,mFAAmF;IACnF,wFAAwF;IACxF,uFAAuF;IACvF,+EAA+E;IAC/E,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;KACtC,CAAC,CAAA;IACF,OAAO,IAAI,CACT,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAqC,EACnF,GAAG,CACJ,CAAA;AACH,CAAC;AAED,SAAS,IAAI,CAAC,CAAU,EAAE,CAAS;IACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACrC,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { TokenStore } from '../token-store.js'\nimport type { WsPairingRegistry } from '../ws/pairing-registry.js'\nimport type { AuditSink } from '../audit.js'\nimport type { RateLimiter } from '../rate-limit.js'\nimport { verifyAndReadTid } from './describe.js'\nimport type { LapConfirmResultRequest, LapConfirmResultResponse } from '../../protocol.js'\n\nexport type LapConfirmResultDeps = {\n  signingKey: string | Uint8Array\n  tokenStore: TokenStore\n  registry: WsPairingRegistry\n  auditSink: AuditSink\n  rateLimiter: RateLimiter\n  now?: () => number\n}\n\nexport async function handleLapConfirmResult(\n  req: Request,\n  deps: LapConfirmResultDeps,\n): Promise<Response> {\n  const auth = verifyAndReadTid(req, deps.signingKey)\n  if (!auth.ok) return json({ error: { code: auth.code } }, auth.status)\n\n  const rec = await deps.tokenStore.findByTid(auth.tid)\n  if (!rec || rec.status === 'revoked') return json({ error: { code: 'revoked' } }, 403)\n  if (!deps.registry.isPaired(auth.tid)) return json({ error: { code: 'paused' } }, 503)\n\n  const rlCheck = await deps.rateLimiter.check(auth.tid, 'token')\n  if (!rlCheck.allowed) {\n    return json({ error: { code: 'rate-limited', retryAfterMs: rlCheck.retryAfterMs } }, 429)\n  }\n\n  const body = (await req.json().catch(() => null)) as LapConfirmResultRequest | null\n  if (!body || typeof body.confirmId !== 'string') return json({ error: { code: 'invalid' } }, 400)\n  const timeoutMs = body.timeoutMs ?? 5_000\n\n  // Spec: if the confirm was already resolved during the earlier long-poll on\n  // /message, there's no second resolution to wait for. In the current design\n  // /confirm-result is ONLY used when /message bailed out early with\n  // pending-confirmation. So we call waitForConfirm with the given timeoutMs.\n  // If no resolution arrives in time, we surface 'still-pending'.\n  const result = await deps.registry.waitForConfirm(auth.tid, body.confirmId, timeoutMs)\n\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  if (result.outcome === 'confirmed') {\n    await deps.auditSink.write({\n      at: nowMs,\n      tid: auth.tid,\n      uid: rec.uid,\n      event: 'confirm-approved',\n      detail: { confirmId: body.confirmId },\n    })\n    return json(\n      { status: 'confirmed', stateAfter: result.stateAfter } satisfies LapConfirmResultResponse,\n      200,\n    )\n  }\n  // user-cancelled OR timeout. WsPairingRegistry returns user-cancelled on timeout too;\n  // we distinguish by checking whether the confirm is still in registry.pendingConfirm —\n  // but pendingConfirm cleanup happens inside waitForConfirm's timer, so we can't peek.\n  // For v1: treat user-cancelled as user-cancelled; treat explicit timeout as timeout by\n  // comparing elapsed vs. timeoutMs. Simpler: just return 'still-pending' on the timeout\n  // branch to let Claude poll again. Registry returns {outcome: 'user-cancelled'} on\n  // both timer and actual cancel — so we can't distinguish. Punt: return 'user-cancelled'\n  // (matches registry semantics). Spec §8.2 get_confirm_result allows 'user-cancelled' |\n  // 'timeout' | 'still-pending' — a refinement to distinguish is follow-up work.\n  await deps.auditSink.write({\n    at: nowMs,\n    tid: auth.tid,\n    uid: rec.uid,\n    event: 'confirm-rejected',\n    detail: { confirmId: body.confirmId },\n  })\n  return json(\n    { status: 'rejected', reason: 'user-cancelled' } satisfies LapConfirmResultResponse,\n    200,\n  )\n}\n\nfunction json(b: unknown, s: number): Response {\n  return new Response(JSON.stringify(b), {\n    status: s,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n"]}
+{"version":3,"file":"confirm-result.js","sourceRoot":"","sources":["../../../src/server/lap/confirm-result.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAYhD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAY,EACZ,IAA0B;IAE1B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAEtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC/D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAA;IACnF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAEzC,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAEtF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YACzB,EAAE,EAAE,KAAK;YACT,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SACtC,CAAC,CAAA;QACF,OAAO,IAAI,CACT,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAqC,EACzF,GAAG,CACJ,CAAA;IACH,CAAC;IACD,sFAAsF;IACtF,uFAAuF;IACvF,sFAAsF;IACtF,uFAAuF;IACvF,uFAAuF;IACvF,mFAAmF;IACnF,wFAAwF;IACxF,uFAAuF;IACvF,+EAA+E;IAC/E,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;KACtC,CAAC,CAAA;IACF,OAAO,IAAI,CACT,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAqC,EACnF,GAAG,CACJ,CAAA;AACH,CAAC;AAED,SAAS,IAAI,CAAC,CAAU,EAAE,CAAS;IACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACrC,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { TokenStore } from '../token-store.js'\nimport type { PairingRegistry } from '../ws/pairing-registry.js'\nimport type { AuditSink } from '../audit.js'\nimport type { RateLimiter } from '../rate-limit.js'\nimport { verifyAndReadTid } from './describe.js'\nimport type { LapConfirmResultRequest, LapConfirmResultResponse } from '../../protocol.js'\n\nexport type LapConfirmResultDeps = {\n  signingKey: string | Uint8Array\n  tokenStore: TokenStore\n  registry: PairingRegistry\n  auditSink: AuditSink\n  rateLimiter: RateLimiter\n  now?: () => number\n}\n\nexport async function handleLapConfirmResult(\n  req: Request,\n  deps: LapConfirmResultDeps,\n): Promise<Response> {\n  const auth = await verifyAndReadTid(req, deps.signingKey)\n  if (!auth.ok) return json({ error: { code: auth.code } }, auth.status)\n\n  const rec = await deps.tokenStore.findByTid(auth.tid)\n  if (!rec || rec.status === 'revoked') return json({ error: { code: 'revoked' } }, 403)\n  if (!deps.registry.isPaired(auth.tid)) return json({ error: { code: 'paused' } }, 503)\n\n  const rlCheck = await deps.rateLimiter.check(auth.tid, 'token')\n  if (!rlCheck.allowed) {\n    return json({ error: { code: 'rate-limited', retryAfterMs: rlCheck.retryAfterMs } }, 429)\n  }\n\n  const body = (await req.json().catch(() => null)) as LapConfirmResultRequest | null\n  if (!body || typeof body.confirmId !== 'string') return json({ error: { code: 'invalid' } }, 400)\n  const timeoutMs = body.timeoutMs ?? 5_000\n\n  // Spec: if the confirm was already resolved during the earlier long-poll on\n  // /message, there's no second resolution to wait for. In the current design\n  // /confirm-result is ONLY used when /message bailed out early with\n  // pending-confirmation. So we call waitForConfirm with the given timeoutMs.\n  // If no resolution arrives in time, we surface 'still-pending'.\n  const result = await deps.registry.waitForConfirm(auth.tid, body.confirmId, timeoutMs)\n\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  if (result.outcome === 'confirmed') {\n    await deps.auditSink.write({\n      at: nowMs,\n      tid: auth.tid,\n      uid: rec.uid,\n      event: 'confirm-approved',\n      detail: { confirmId: body.confirmId },\n    })\n    return json(\n      { status: 'confirmed', stateAfter: result.stateAfter } satisfies LapConfirmResultResponse,\n      200,\n    )\n  }\n  // user-cancelled OR timeout. WsPairingRegistry returns user-cancelled on timeout too;\n  // we distinguish by checking whether the confirm is still in registry.pendingConfirm —\n  // but pendingConfirm cleanup happens inside waitForConfirm's timer, so we can't peek.\n  // For v1: treat user-cancelled as user-cancelled; treat explicit timeout as timeout by\n  // comparing elapsed vs. timeoutMs. Simpler: just return 'still-pending' on the timeout\n  // branch to let Claude poll again. Registry returns {outcome: 'user-cancelled'} on\n  // both timer and actual cancel — so we can't distinguish. Punt: return 'user-cancelled'\n  // (matches registry semantics). Spec §8.2 get_confirm_result allows 'user-cancelled' |\n  // 'timeout' | 'still-pending' — a refinement to distinguish is follow-up work.\n  await deps.auditSink.write({\n    at: nowMs,\n    tid: auth.tid,\n    uid: rec.uid,\n    event: 'confirm-rejected',\n    detail: { confirmId: body.confirmId },\n  })\n  return json(\n    { status: 'rejected', reason: 'user-cancelled' } satisfies LapConfirmResultResponse,\n    200,\n  )\n}\n\nfunction json(b: unknown, s: number): Response {\n  return new Response(JSON.stringify(b), {\n    status: s,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n"]}

package/dist/server/lap/describe.d.ts

@@ -1,22 +1,22 @@
 import type { TokenStore } from '../token-store.js';
-import type { WsPairingRegistry } from '../ws/pairing-registry.js';
+import type { PairingRegistry } from '../ws/pairing-registry.js';
 import type { AuditSink } from '../audit.js';
 import type { RateLimiter } from '../rate-limit.js';
 export type LapDescribeDeps = {
     signingKey: string | Uint8Array;
     tokenStore: TokenStore;
-    registry: WsPairingRegistry;
+    registry: PairingRegistry;
     auditSink: AuditSink;
     rateLimiter: RateLimiter;
     now?: () => number;
 };
 export declare function handleLapDescribe(req: Request, deps: LapDescribeDeps): Promise<Response>;
-export declare function verifyAndReadTid(req: Request, key: string | Uint8Array): {
+export declare function verifyAndReadTid(req: Request, key: string | Uint8Array): Promise<{
     ok: true;
     tid: string;
 } | {
     ok: false;
     status: number;
     code: string;
-};
+}>;
 //# sourceMappingURL=describe.d.ts.map

package/dist/server/lap/describe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../../src/server/lap/describe.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAGnD,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoD9F;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GAAG,UAAU,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAOzE"}
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../../src/server/lap/describe.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAGnD,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,GAAG,UAAU,CAAA;IAC/B,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,eAAe,CAAA;IACzB,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoD9F;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GAAG,UAAU,GACvB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAOlF"}

package/dist/server/lap/describe.js

@@ -1,6 +1,6 @@
 import { verifyToken } from '../token.js';
 export async function handleLapDescribe(req, deps) {
-    const auth = verifyAndReadTid(req, deps.signingKey);
+    const auth = await verifyAndReadTid(req, deps.signingKey);
     if (!auth.ok)
         return json({ error: { code: auth.code } }, auth.status);
     const rec = await deps.tokenStore.findByTid(auth.tid);
@@ -37,7 +37,7 @@ export async function handleLapDescribe(req, deps) {
     await deps.tokenStore.markActive(auth.tid, label, nowMs);
     // Fire the active signal to the browser only on the first transition.
     if (wasAwaitingClaude) {
-        deps.registry.notify(auth.tid, { t: 'active' });
+        deps.registry.send(auth.tid, { t: 'active' });
     }
     await deps.auditSink.write({
         at: nowMs,
@@ -48,12 +48,12 @@ export async function handleLapDescribe(req, deps) {
     });
     return json(out, 200);
 }
-export function verifyAndReadTid(req, key) {
+export async function verifyAndReadTid(req, key) {
     const auth = req.headers.get('authorization');
     if (!auth || !auth.startsWith('Bearer '))
         return { ok: false, status: 401, code: 'auth-failed' };
     const token = auth.slice('Bearer '.length);
-    const v = verifyToken(token, key);
+    const v = await verifyToken(token, key);
     if (v.kind !== 'ok')
         return { ok: false, status: 401, code: 'auth-failed' };
     return { ok: true, tid: v.payload.tid };

package/dist/server/lap/describe.js.map

@@ -1 +1 @@
-{"version":3,"file":"describe.js","sourceRoot":"","sources":["../../../src/server/lap/describe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAgBzC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,IAAqB;IACzE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAEtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC/D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAE3D,MAAM,QAAQ,GAAuC,KAAK,CAAC,SAG1D,CAAA;IACD,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,KAAK,CAAC,OAAO;QACnB,OAAO,EAAE,KAAK,CAAC,UAAU;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ;QACR,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE;YACX,aAAa,EAAE,KAAK;YACpB,iBAAiB,EAAE,kBAAkB;YACrC,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,kBAAkB,CAAC;SACrF;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAA;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAA;IACjC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACxD,sEAAsE;IACtE,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;KACrC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,GAAwB;IAExB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;AACzC,CAAC;AAED,SAAS,IAAI,CAAC,CAAU,EAAE,CAAS;IACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACrC,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { verifyToken } from '../token.js'\nimport type { TokenStore } from '../token-store.js'\nimport type { WsPairingRegistry } from '../ws/pairing-registry.js'\nimport type { AuditSink } from '../audit.js'\nimport type { RateLimiter } from '../rate-limit.js'\nimport type { LapDescribeResponse, MessageSchemaEntry } from '../../protocol.js'\n\nexport type LapDescribeDeps = {\n  signingKey: string | Uint8Array\n  tokenStore: TokenStore\n  registry: WsPairingRegistry\n  auditSink: AuditSink\n  rateLimiter: RateLimiter\n  now?: () => number\n}\n\nexport async function handleLapDescribe(req: Request, deps: LapDescribeDeps): Promise<Response> {\n  const auth = verifyAndReadTid(req, deps.signingKey)\n  if (!auth.ok) return json({ error: { code: auth.code } }, auth.status)\n\n  const rec = await deps.tokenStore.findByTid(auth.tid)\n  if (!rec || rec.status === 'revoked') return json({ error: { code: 'revoked' } }, 403)\n  if (!deps.registry.isPaired(auth.tid)) return json({ error: { code: 'paused' } }, 503)\n\n  const rlCheck = await deps.rateLimiter.check(auth.tid, 'token')\n  if (!rlCheck.allowed) {\n    return json({ error: { code: 'rate-limited', retryAfterMs: rlCheck.retryAfterMs } }, 429)\n  }\n\n  const hello = deps.registry.getHello(auth.tid)\n  if (!hello) return json({ error: { code: 'paused' } }, 503)\n\n  const messages: Record<string, MessageSchemaEntry> = hello.msgSchema as Record<\n    string,\n    MessageSchemaEntry\n  >\n  const out: LapDescribeResponse = {\n    name: hello.appName,\n    version: hello.appVersion,\n    stateSchema: hello.stateSchema,\n    messages,\n    docs: hello.docs,\n    conventions: {\n      dispatchModel: 'TEA',\n      confirmationModel: 'runtime-mediated',\n      readSurfaces: ['state', 'query_dom', 'describe_visible_content', 'describe_context'],\n    },\n    schemaHash: hello.schemaHash,\n  }\n\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  // Transition to active: Claude has made its first LAP call to /describe,\n  // confirming both the browser WS and Claude are live.\n  const wasAwaitingClaude = rec.status === 'awaiting-claude'\n  const label = rec.uid ?? 'Claude'\n  await deps.tokenStore.markActive(auth.tid, label, nowMs)\n  // Fire the active signal to the browser only on the first transition.\n  if (wasAwaitingClaude) {\n    deps.registry.notify(auth.tid, { t: 'active' })\n  }\n  await deps.auditSink.write({\n    at: nowMs,\n    tid: auth.tid,\n    uid: rec.uid,\n    event: 'lap-call',\n    detail: { path: '/lap/v1/describe' },\n  })\n  return json(out, 200)\n}\n\nexport function verifyAndReadTid(\n  req: Request,\n  key: string | Uint8Array,\n): { ok: true; tid: string } | { ok: false; status: number; code: string } {\n  const auth = req.headers.get('authorization')\n  if (!auth || !auth.startsWith('Bearer ')) return { ok: false, status: 401, code: 'auth-failed' }\n  const token = auth.slice('Bearer '.length)\n  const v = verifyToken(token, key)\n  if (v.kind !== 'ok') return { ok: false, status: 401, code: 'auth-failed' }\n  return { ok: true, tid: v.payload.tid }\n}\n\nfunction json(b: unknown, s: number): Response {\n  return new Response(JSON.stringify(b), {\n    status: s,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n"]}
+{"version":3,"file":"describe.js","sourceRoot":"","sources":["../../../src/server/lap/describe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAgBzC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,IAAqB;IACzE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAEtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC/D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAE3D,MAAM,QAAQ,GAAuC,KAAK,CAAC,SAG1D,CAAA;IACD,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,KAAK,CAAC,OAAO;QACnB,OAAO,EAAE,KAAK,CAAC,UAAU;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ;QACR,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE;YACX,aAAa,EAAE,KAAK;YACpB,iBAAiB,EAAE,kBAAkB;YACrC,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,kBAAkB,CAAC;SACrF;QACD,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;IAChD,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAA;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAA;IACjC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACxD,sEAAsE;IACtE,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;KACrC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAY,EACZ,GAAwB;IAExB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;AACzC,CAAC;AAED,SAAS,IAAI,CAAC,CAAU,EAAE,CAAS;IACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACrC,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { verifyToken } from '../token.js'\nimport type { TokenStore } from '../token-store.js'\nimport type { PairingRegistry } from '../ws/pairing-registry.js'\nimport type { AuditSink } from '../audit.js'\nimport type { RateLimiter } from '../rate-limit.js'\nimport type { LapDescribeResponse, MessageSchemaEntry } from '../../protocol.js'\n\nexport type LapDescribeDeps = {\n  signingKey: string | Uint8Array\n  tokenStore: TokenStore\n  registry: PairingRegistry\n  auditSink: AuditSink\n  rateLimiter: RateLimiter\n  now?: () => number\n}\n\nexport async function handleLapDescribe(req: Request, deps: LapDescribeDeps): Promise<Response> {\n  const auth = await verifyAndReadTid(req, deps.signingKey)\n  if (!auth.ok) return json({ error: { code: auth.code } }, auth.status)\n\n  const rec = await deps.tokenStore.findByTid(auth.tid)\n  if (!rec || rec.status === 'revoked') return json({ error: { code: 'revoked' } }, 403)\n  if (!deps.registry.isPaired(auth.tid)) return json({ error: { code: 'paused' } }, 503)\n\n  const rlCheck = await deps.rateLimiter.check(auth.tid, 'token')\n  if (!rlCheck.allowed) {\n    return json({ error: { code: 'rate-limited', retryAfterMs: rlCheck.retryAfterMs } }, 429)\n  }\n\n  const hello = deps.registry.getHello(auth.tid)\n  if (!hello) return json({ error: { code: 'paused' } }, 503)\n\n  const messages: Record<string, MessageSchemaEntry> = hello.msgSchema as Record<\n    string,\n    MessageSchemaEntry\n  >\n  const out: LapDescribeResponse = {\n    name: hello.appName,\n    version: hello.appVersion,\n    stateSchema: hello.stateSchema,\n    messages,\n    docs: hello.docs,\n    conventions: {\n      dispatchModel: 'TEA',\n      confirmationModel: 'runtime-mediated',\n      readSurfaces: ['state', 'query_dom', 'describe_visible_content', 'describe_context'],\n    },\n    schemaHash: hello.schemaHash,\n  }\n\n  const nowMs = (deps.now ?? (() => Date.now()))()\n  // Transition to active: Claude has made its first LAP call to /describe,\n  // confirming both the browser WS and Claude are live.\n  const wasAwaitingClaude = rec.status === 'awaiting-claude'\n  const label = rec.uid ?? 'Claude'\n  await deps.tokenStore.markActive(auth.tid, label, nowMs)\n  // Fire the active signal to the browser only on the first transition.\n  if (wasAwaitingClaude) {\n    deps.registry.send(auth.tid, { t: 'active' })\n  }\n  await deps.auditSink.write({\n    at: nowMs,\n    tid: auth.tid,\n    uid: rec.uid,\n    event: 'lap-call',\n    detail: { path: '/lap/v1/describe' },\n  })\n  return json(out, 200)\n}\n\nexport async function verifyAndReadTid(\n  req: Request,\n  key: string | Uint8Array,\n): Promise<{ ok: true; tid: string } | { ok: false; status: number; code: string }> {\n  const auth = req.headers.get('authorization')\n  if (!auth || !auth.startsWith('Bearer ')) return { ok: false, status: 401, code: 'auth-failed' }\n  const token = auth.slice('Bearer '.length)\n  const v = await verifyToken(token, key)\n  if (v.kind !== 'ok') return { ok: false, status: 401, code: 'auth-failed' }\n  return { ok: true, tid: v.payload.tid }\n}\n\nfunction json(b: unknown, s: number): Response {\n  return new Response(JSON.stringify(b), {\n    status: s,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n"]}

package/dist/server/lap/forward.d.ts

@@ -1,11 +1,11 @@
 import type { TokenStore } from '../token-store.js';
-import type { WsPairingRegistry } from '../ws/pairing-registry.js';
+import type { PairingRegistry } from '../ws/pairing-registry.js';
 import type { AuditSink } from '../audit.js';
 import type { RateLimiter } from '../rate-limit.js';
 export type ForwardDeps = {
     signingKey: string | Uint8Array;
     tokenStore: TokenStore;
-    registry: WsPairingRegistry;
+    registry: PairingRegistry;
     auditSink: AuditSink;
     rateLimiter: RateLimiter;
     now?: () => number;