@opengsd/gsd-pi 1.3.0-dev.eed73bea → 1.4.0-dev.5fc22c6f

package/dist/web/standalone/.next/static/chunks/app/{page-6644fc6ee8ca1247.js → page-72a856634ad14c10.js}

@@ -1 +1 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[8974],{3267:(e,t,n)=>{Promise.resolve().then(n.bind(n,92703))},19013:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"workAsyncStorage",{enumerable:!0,get:function(){return r.workAsyncStorageInstance}});let r=n(34969)},23711:(e,t,n)=>{"use strict";n.d(t,{default:()=>u.a});var r=n(60276),u=n.n(r)},30039:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n={bindSnapshot:function(){return s},createAsyncLocalStorage:function(){return a},createSnapshot:function(){return i}};for(var r in n)Object.defineProperty(t,r,{enumerable:!0,get:n[r]});let u=Object.defineProperty(Error("Invariant: AsyncLocalStorage accessed in runtime where it is not available"),"__NEXT_ERROR_CODE",{value:"E504",enumerable:!1,configurable:!0});class l{disable(){throw u}getStore(){}run(){throw u}exit(){throw u}enterWith(){throw u}static bind(e){return e}}let o="u">typeof globalThis&&globalThis.AsyncLocalStorage;function a(){return o?new o:new l}function s(e){return o?o.bind(e):l.bind(e)}function i(){return o?o.snapshot():function(e,...t){return e(...t)}}},34969:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"workAsyncStorageInstance",{enumerable:!0,get:function(){return r}});let r=(0,n(30039).createAsyncLocalStorage)()},47811:(e,t,n)=>{"use strict";function r({reason:e,children:t}){return t}Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"BailoutToCSR",{enumerable:!0,get:function(){return r}}),n(71495)},60276:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"default",{enumerable:!0,get:function(){return u}});let r=n(51481)._(n(80260));function u(e,t){let n={};"function"==typeof e&&(n.loader=e);let u={...n,...t};return(0,r.default)({...u,modules:u.loadableGenerated?.modules})}("function"==typeof t.default||"object"==typeof t.default&&null!==t.default)&&void 0===t.default.__esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},76670:(e,t,n)=>{"use strict";function r({moduleIds:e}){return null}Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"PreloadChunks",{enumerable:!0,get:function(){return r}}),n(18870),n(29411),n(19013),n(19132),n(63632)},80260:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"default",{enumerable:!0,get:function(){return s}});let r=n(18870),u=n(45110),l=n(47811);function o(e){return{default:e&&"default"in e?e.default:e}}n(76670);let a={loader:()=>Promise.resolve(o(()=>null)),loading:null,ssr:!0},s=function(e){let t={...a,...e},n=(0,u.lazy)(()=>t.loader().then(o)),s=t.loading;function i(e){let o=s?(0,r.jsx)(s,{isLoading:!0,pastDelay:!0,error:null}):null,a=!t.ssr||!!t.loading,i=a?u.Suspense:u.Fragment,c=t.ssr?(0,r.jsxs)(r.Fragment,{children:[null,(0,r.jsx)(n,{...e})]}):(0,r.jsx)(l.BailoutToCSR,{reason:"next/dynamic",children:(0,r.jsx)(n,{...e})});return(0,r.jsx)(i,{...a?{fallback:o}:{},children:c})}return i.displayName="LoadableComponent",i}},92703:(e,t,n)=>{"use strict";n.r(t),n.d(t,{default:()=>l});var r=n(18870);let u=(0,n(23711).default)(()=>Promise.all([n.e(4825),n.e(5395),n.e(7882),n.e(796)]).then(n.bind(n,90796)).then(e=>e.GSDAppShell),{loadableGenerated:{webpack:()=>[90796]},ssr:!1,loading:()=>(0,r.jsx)("div",{className:"flex h-screen items-center justify-center bg-background text-sm text-muted-foreground",children:"Loading workspace…"})});function l(){return(0,r.jsx)(u,{})}}},e=>{e.O(0,[9990,686,7358],()=>e(e.s=3267)),_N_E=e.O()}]);
+(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[8974],{3267:(e,t,n)=>{Promise.resolve().then(n.bind(n,92703))},19013:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"workAsyncStorage",{enumerable:!0,get:function(){return r.workAsyncStorageInstance}});let r=n(34969)},23711:(e,t,n)=>{"use strict";n.d(t,{default:()=>u.a});var r=n(60276),u=n.n(r)},30039:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n={bindSnapshot:function(){return s},createAsyncLocalStorage:function(){return a},createSnapshot:function(){return i}};for(var r in n)Object.defineProperty(t,r,{enumerable:!0,get:n[r]});let u=Object.defineProperty(Error("Invariant: AsyncLocalStorage accessed in runtime where it is not available"),"__NEXT_ERROR_CODE",{value:"E504",enumerable:!1,configurable:!0});class l{disable(){throw u}getStore(){}run(){throw u}exit(){throw u}enterWith(){throw u}static bind(e){return e}}let o="u">typeof globalThis&&globalThis.AsyncLocalStorage;function a(){return o?new o:new l}function s(e){return o?o.bind(e):l.bind(e)}function i(){return o?o.snapshot():function(e,...t){return e(...t)}}},34969:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"workAsyncStorageInstance",{enumerable:!0,get:function(){return r}});let r=(0,n(30039).createAsyncLocalStorage)()},47811:(e,t,n)=>{"use strict";function r({reason:e,children:t}){return t}Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"BailoutToCSR",{enumerable:!0,get:function(){return r}}),n(71495)},60276:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"default",{enumerable:!0,get:function(){return u}});let r=n(51481)._(n(80260));function u(e,t){let n={};"function"==typeof e&&(n.loader=e);let u={...n,...t};return(0,r.default)({...u,modules:u.loadableGenerated?.modules})}("function"==typeof t.default||"object"==typeof t.default&&null!==t.default)&&void 0===t.default.__esModule&&(Object.defineProperty(t.default,"__esModule",{value:!0}),Object.assign(t.default,t),e.exports=t.default)},76670:(e,t,n)=>{"use strict";function r({moduleIds:e}){return null}Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"PreloadChunks",{enumerable:!0,get:function(){return r}}),n(18870),n(29411),n(19013),n(19132),n(63632)},80260:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),Object.defineProperty(t,"default",{enumerable:!0,get:function(){return s}});let r=n(18870),u=n(45110),l=n(47811);function o(e){return{default:e&&"default"in e?e.default:e}}n(76670);let a={loader:()=>Promise.resolve(o(()=>null)),loading:null,ssr:!0},s=function(e){let t={...a,...e},n=(0,u.lazy)(()=>t.loader().then(o)),s=t.loading;function i(e){let o=s?(0,r.jsx)(s,{isLoading:!0,pastDelay:!0,error:null}):null,a=!t.ssr||!!t.loading,i=a?u.Suspense:u.Fragment,c=t.ssr?(0,r.jsxs)(r.Fragment,{children:[null,(0,r.jsx)(n,{...e})]}):(0,r.jsx)(l.BailoutToCSR,{reason:"next/dynamic",children:(0,r.jsx)(n,{...e})});return(0,r.jsx)(i,{...a?{fallback:o}:{},children:c})}return i.displayName="LoadableComponent",i}},92703:(e,t,n)=>{"use strict";n.r(t),n.d(t,{default:()=>l});var r=n(18870);let u=(0,n(23711).default)(()=>Promise.all([n.e(4825),n.e(5395),n.e(7882),n.e(8937)]).then(n.bind(n,38937)).then(e=>e.GSDAppShell),{loadableGenerated:{webpack:()=>[38937]},ssr:!1,loading:()=>(0,r.jsx)("div",{className:"flex h-screen items-center justify-center bg-background text-sm text-muted-foreground",children:"Loading workspace…"})});function l(){return(0,r.jsx)(u,{})}}},e=>{e.O(0,[9990,686,7358],()=>e(e.s=3267)),_N_E=e.O()}]);

package/dist/web/standalone/.next/static/chunks/webpack-9c401904f87ded16.js

@@ -0,0 +1 @@
+(()=>{"use strict";var e,a,d,c,f,b,t,r,o,n={},i={};function l(e){var a=i[e];if(void 0!==a)return a.exports;var d=i[e]={exports:{}},c=!0;try{n[e].call(d.exports,d,d.exports,l),c=!1}finally{c&&delete i[e]}return d.exports}l.m=n,e=[],l.O=(a,d,c,f)=>{if(d){f=f||0;for(var b=e.length;b>0&&e[b-1][2]>f;b--)e[b]=e[b-1];e[b]=[d,c,f];return}for(var t=1/0,b=0;b<e.length;b++){for(var[d,c,f]=e[b],r=!0,o=0;o<d.length;o++)(!1&f||t>=f)&&Object.keys(l.O).every(e=>l.O[e](d[o]))?d.splice(o--,1):(r=!1,f<t&&(t=f));if(r){e.splice(b--,1);var n=c();void 0!==n&&(a=n)}}return a},l.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return l.d(a,{a:a}),a},d=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,l.t=function(e,c){if(1&c&&(e=this(e)),8&c||"object"==typeof e&&e&&(4&c&&e.__esModule||16&c&&"function"==typeof e.then))return e;var f=Object.create(null);l.r(f);var b={};a=a||[null,d({}),d([]),d(d)];for(var t=2&c&&e;"object"==typeof t&&!~a.indexOf(t);t=d(t))Object.getOwnPropertyNames(t).forEach(a=>b[a]=()=>e[a]);return b.default=()=>e,l.d(f,b),f},l.d=(e,a)=>{for(var d in a)l.o(a,d)&&!l.o(e,d)&&Object.defineProperty(e,d,{enumerable:!0,get:a[d]})},l.f={},l.e=e=>Promise.all(Object.keys(l.f).reduce((a,d)=>(l.f[d](e,a),a),[])),l.u=e=>5395===e?"static/chunks/5395-712c8b12d97fd36f.js":"static/chunks/"+(({1077:"3969fbf3",1444:"65aac708",2378:"654b0707",2415:"95b71484",2445:"b07d4d74",4408:"4b0d4931",4432:"2070ac3a",5002:"38a9ebc2",5400:"817dbc02",5745:"762f9c27",5992:"59e88d55",7110:"ff8cc638",7178:"cf3a91ff",8151:"e93892bd"})[e]||e)+"."+({126:"9ba2b9f3bc2decd1",129:"1c38353c1c400672",152:"1cffac9c3e622387",162:"3092aea0f592a5c8",179:"883699416402e239",207:"f66184b363f09cc6",287:"8209489f74af51fc",338:"72226320f355ae45",390:"19e95f0dff471e06",521:"d218eead5637baa4",592:"e0dc54386e138164",597:"687ca88aab4878a8",607:"389356bce0bec389",623:"9d7a30953efb9041",628:"ce453e3867eacdb0",652:"adc4c63df50976d9",655:"af70b892d9ee7ff0",722:"6b0f9ede4792fdb2",743:"e0182df2d265e5d6",760:"22f2b7b4675cc37c",764:"7b85222921596e25",854:"8e11a99837f41820",860:"f5bd652b07d26589",873:"d55eae71db4fdae4",885:"a2eda74573a6b7d5",919:"ca6561eb1b7f14b6",941:"ed6bac59022f3080",945:"63ba715dc6e4fea3",1077:"9b07abe025da44ba",1123:"f7f3ad40134d8e99",1136:"2f76140d08eada66",1153:"048157f0fff9e01e",1206:"9baa9dd13a543ddb",1214:"2056b3a6e6552f7a",1250:"07796cdda0cd2444",1261:"e4d2bba8cd005033",1315:"3d55775d86c54851",1322:"c4c89a279a52df74",1345:"a4cf42ea9b13c909",1351:"7ee94d2f73451e23",1361:"4f4a1888e523849e",1423:"7cad9e54180af25d",1444:"d079243ca36c5ea2",1473:"a6b64091fe87340e",1482:"9689d3f766caf505",1495:"614c12ff10a7e552",1571:"7d29379eb7395921",1669:"6274d62b0b7a0b48",1695:"3bd5062799f8d633",1718:"160d45447ee37ec6",1743:"17835c4ac8e5ccd5",1874:"a76b2f83e3692ed0",1884:"8b25180bb68977e8",1912:"6c18c811ab80a30b",2070:"972cc52aecb08f83",2112:"8ecf08fc933fda55",2216:"bef68d39d583e498",2268:"104fd1e51f9091e9",2310:"573f48b61ab7f1c3",2331:"af7117be987990f3",2338:"a00ee44a19bee4d9",2365:"3d9a40778b3035bc",2378:"673f7e2ed249e9ac",2381:"7801777a8df06b9d",2397:"119f6bec0d803dc9",2415:"cb591d7769c93747",2445:"e34a3c703203c8a1",2474:"f820659ebb687bd5",2510:"24179d76deadadc7",2514:"3272efa11f4cabf5",2546:"1f2445595be11d8c",2598:"1df225a5dcc14011",2599:"bfc3f47c5f83c1cb",2659:"58e950899a9bb82f",2661:"f9009d1618461a73",2686:"fc7ea5c1eee5a2a8",2740:"92d294a92e7d850a",2755:"282d43af08df2f84",2759:"edfe5f37338ad459",2772:"a7c1fcc69a4685ef",2780:"02c859ba77180283",2786:"a9688cc5fe6b1c38",2819:"84bfdb28b9c3f9f5",2918:"a2f8d785597a319c",2921:"030672c0326dd867",2930:"40ef631ca72bb6d9",2967:"9216a21dcf13c273",2996:"618f0444a810fe91",3009:"f86fd5262e3248d8",3011:"6b7a2b1cdf640f37",3050:"15d6b994e9ba45f6",3090:"94a59ca356662efa",3096:"1135d2c0caf0226d",3166:"8607f1a8a3e9ce29",3211:"e54601c5020211c0",3225:"ec603e751e9e2675",3238:"eaeace056cf95a31",3271:"675adb98e68d6675",3338:"397da6ca541ffabd",3367:"9ff7dfd30b60f0b9",3459:"b19b5fb587be680c",3475:"31918bc1df82570e",3549:"5fa9a69d3e72cbc5",3565:"97dbecedec5aa86f",3605:"e6efa3efb3ea2838",3606:"c9441114c48a7815",3616:"61a2af74bb8833c8",3626:"5941c941868c4fa8",3676:"467ce1e6a1891598",3703:"b38f3e26f586a6aa",3726:"17cdcaae372b7230",3783:"e5bbeed5b0dd959f",3813:"46cde9b866a32a7f",3842:"54fd91b4e63d1012",3859:"b20f5f8e7372b1c7",3876:"614c12ff10a7e552",3903:"b8cf9b1681e071cd",3915:"a9e8cf78d79c6fe8",3957:"19008089a14b9721",4015:"b1bc267728bc0e2e",4017:"cd6aafccbc8a5e12",4033:"45786a60d513a2a1",4046:"48caa601045e2e89",4055:"610fdd174210a882",4084:"b1c0e215bb966f15",4135:"bf2b662e89fa9c68",4221:"a9909c11be2eeb3c",4263:"1ccab47318fedba3",4279:"35af682f7b26217e",4283:"d0d9e0a955e441cb",4299:"d971e70cc188496c",4310:"85e674ad8ee69a44",4312:"3f57c4272be6993f",4369:"6934f56ee86a8304",4400:"7c5baaa08cb92ee3",4408:"ec26e3162e59e1dd",4432:"4684627aebae47be",4469:"3c155fdefafbeac6",4489:"8e74b0a7841998bb",4500:"75ec698780c458a3",4527:"f98d84e6a3fefd9b",4531:"236d7761b344aa8e",4556:"14611bd48f6e6b1a",4580:"8b21303ba8c17b40",4599:"853e8906611708d8",4605:"3fdedf487b53ad50",4607:"d3a39503f7ada32c",4665:"3126cd18619abaaa",4688:"edb09f1d5243212b",4692:"e94d1622b2a7af47",4735:"15c4dc9989dc0c48",4739:"93da5ac1a266e99c",4745:"3b1cd948aa85140e",4771:"8afee58317ca8820",4785:"c69323ddb2466dd8",4803:"9c22573110c833c2",4804:"1f6298ef85b61a54",4853:"0f266e143041f851",4861:"55f11124e2b01b24",4864:"0a4f49ce4630b8bb",4866:"41b99152f0c51f4b",4872:"16772f4c5aa2b6a7",4912:"4a896e1d83eaa89b",4949:"5dda0f80f5194ff4",4961:"f65af5ad4c40e445",4980:"23b955704d3685ea",5002:"e67f676b4ef0838a",5027:"8337dcfe6eed9b0e",5038:"844d2aa705a41935",5070:"719b31da3890ad9f",5085:"7718342da25f214c",5104:"b878b75861e1b371",5105:"8257972ee4d137cc",5134:"cedbfd63d65c7eeb",5142:"74bc377e596dba8a",5146:"8c2a145b6c08d3f3",5151:"716e0bef5b829eae",5220:"baabab50a7e52b0f",5270:"e4955d0ca95de492",5290:"87c54425f7d924ac",5315:"cca12f675faf2924",5323:"935348720adb1d4b",5331:"0b7d0c72ec8da097",5380:"3a2fe1150cd5cfef",5400:"28b6e9abcbbd2557",5411:"3f8f37be9655e773",5444:"af7e242c7457254f",5504:"2edf0833e947dc1d",5577:"bb3f81f2c408e4c3",5665:"0860090e30838620",5668:"0bd93611a3ff4f2a",5678:"a239c70dc8ec7d8c",5707:"8b562162c503157c",5745:"488b55f511068b38",5782:"e86f388ced29aa87",5826:"5421d66c72b9f34e",5827:"c822e70f3d43bb6c",5941:"e2a61bd1f0fc65fb",5992:"82ae77105fe4dcf3",6051:"0ab65c096f692a42",6060:"e9b71068a93cba84",6063:"194b823374fd9c16",6065:"69030ecc96ee5829",6256:"0024d6cdbdaabb80",6312:"cf845477965a9183",6377:"fff6670a1759c9bb",6416:"f3dfee279b1572cc",6419:"038812086fdebf95",6467:"3a11d073b387ad12",6473:"9e963ae0b1628f43",6478:"697eab7a0fa21e82",6482:"f5ef60e285fa0d1f",6515:"1b82f729a9a0dde5",6559:"5bff64ac811186e1",6666:"f3f23d326569033b",6734:"fc8332529bdf41a1",6808:"643c09c4c01c8290",6841:"b5728e150f722169",6941:"ea8e2c9c71fd2cd0",6962:"112712eec82c5fad",6964:"0662b8072a44a3a6",7007:"7ef64327e1e42a17",7075:"3f7a6832ccc2dbe8",7086:"b713f78c1940ed4f",7110:"e57b30faf568a97e",7170:"16c4c2d8390e7cdf",7178:"5000c510258cf59b",7220:"0d05ce4590e86996",7228:"b3c3c9a814277ca7",7243:"49a137f606af7436",7261:"11dbc0180fbeae09",7262:"af8c8aba42d990fd",7297:"f2e305e4ce4d6702",7369:"5dbdfce41fb966c3",7377:"1a2ecf5a0c739873",7442:"72f474c7a32ffbf2",7471:"1132b103963d5fe4",7483:"f100f7dfce9431da",7553:"bc417df10b98ab1c",7578:"20d5d4e28e5d5a4b",7618:"96a41c270cdeb199",7638:"74b89c0a7bdf1ec8",7649:"9d8449840e323ea6",7672:"044ef970373de035",7684:"b48a9d5a3e104ce9",7686:"0ecda170d92f7c4e",7700:"306f4f14afb8f968",7756:"869b916ffa9b76c2",7781:"81ecc647deef0cca",7782:"61500afd4448c579",7785:"7000da1e2563cbb7",7788:"9b4f158263603eee",7790:"e33b1b03b35fedd6",7821:"2ed1ed0bbba0c7a0",7834:"71cf3c773b7ee0a8",7858:"250d64a985f6e4a7",7881:"a0cb60288b12f49a",7882:"2dfaedf0ae29d207",7905:"42c1464b38b8689c",7908:"b2110aab2c2c875a",7914:"4fb198fb5f5d135f",7915:"eaa5c56a7a6d3cf3",8013:"4f60a29f86748b7f",8029:"0958bda6fa108971",8077:"8f546fac0418c4bb",8114:"d4ae3814aa14ef0d",8135:"375e00a47d8a5268",8141:"57b2214799d878db",8150:"4b423a101d0b144b",8151:"53d0131855c7fa0c",8216:"a8ce0716eb650868",8222:"69f21959d892b776",8230:"19ca527d74bf10ed",8294:"a132a7a174a21659",8297:"ace10997725e096b",8343:"ae355f353bfaaf03",8355:"14bf1e0f561d91d3",8359:"ed1285561fe3ad31",8402:"b0f22d7eef4994ae",8412:"20d56a7d288a956a",8418:"c7c4ddbaadf85f19",8468:"b5657f4c281580a8",8477:"2290b6016a1b17c8",8668:"8896b07da8d7d96d",8705:"5be5ebdc43a9a420",8751:"d0b568b914ffbfa5",8770:"a97126f1f3a9b4e2",8785:"e29b3134cab1d153",8790:"f19e4db908478e1a",8896:"7e3f3cf029b5db75",8899:"1a8dfdb581aed370",8916:"a9e0829115188fd3",8937:"640dc9c2aaa1dfad",8945:"7b20fc20debe768f",9044:"3187ff246dcd1b78",9046:"1e28d52982f425ef",9052:"a55c33d156aa70f2",9114:"614c12ff10a7e552",9160:"f7deac955caf6a4f",9221:"281cc760f1370692",9293:"9ddf213e52267513",9299:"52c007a28e886ab4",9331:"368ea567d63fdf3c",9339:"1acf9e17e3123140",9386:"452f3e344fcfcb71",9477:"50a92b2b535540b7",9482:"3557a55c151b9921",9503:"768da88f4b56bd52",9504:"bd652590ec1e8283",9510:"8bf1926d9f577451",9519:"4e7fac0240299c0e",9531:"a3c12da2280caaa2",9543:"33777036c8886f6f",9571:"89d2beccb4237857",9572:"ba1ea7694a5b0c21",9579:"0e7f9c150e345f3a",9622:"76af19fdfdf8b510",9635:"e3c114e207c1af16",9646:"896fe7beac2909ce",9684:"ffb5e0e3bcb7df84",9695:"530c0c12a9f06089",9723:"7f9f73336bdf3d88",9731:"a1eaf64717f7fccc",9740:"18d3fff3bcd9452d",9778:"cd22c6d56df0ee93",9840:"05ba47aa17ee6185",9929:"6faefd225ec8d02f",9996:"036f15bb95080f44"})[e]+".js",l.miniCssF=e=>"static/css/659eccb5db697b76.css",l.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||Function("return this")()}catch(e){if("object"==typeof window)return window}}(),l.o=(e,a)=>Object.prototype.hasOwnProperty.call(e,a),c={},l.l=(e,a,d,f)=>{if(c[e])return void c[e].push(a);if(void 0!==d)for(var b,t,r=document.getElementsByTagName("script"),o=0;o<r.length;o++){var n=r[o];if(n.getAttribute("src")==e||n.getAttribute("data-webpack")=="_N_E:"+d){b=n;break}}b||(t=!0,(b=document.createElement("script")).charset="utf-8",b.timeout=120,l.nc&&b.setAttribute("nonce",l.nc),b.setAttribute("data-webpack","_N_E:"+d),b.src=l.tu(e)),c[e]=[a];var i=(a,d)=>{b.onerror=b.onload=null,clearTimeout(s);var f=c[e];if(delete c[e],b.parentNode&&b.parentNode.removeChild(b),f&&f.forEach(e=>e(d)),a)return a(d)},s=setTimeout(i.bind(null,void 0,{type:"timeout",target:b}),12e4);b.onerror=i.bind(null,b.onerror),b.onload=i.bind(null,b.onload),t&&document.head.appendChild(b)},l.r=e=>{"u">typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.tt=()=>(void 0===f&&(f={createScriptURL:e=>e},"u">typeof trustedTypes&&trustedTypes.createPolicy&&(f=trustedTypes.createPolicy("nextjs#bundler",f))),f),l.tu=e=>l.tt().createScriptURL(e),l.p="/_next/",b={8068:0},l.f.miniCss=(e,a)=>{if(b[e])a.push(b[e]);else 0!==b[e]&&({4825:1})[e]&&a.push(b[e]=new Promise((a,d)=>{var c=l.miniCssF(e),f=l.p+c;if(((e,a)=>{for(var d=document.getElementsByTagName("link"),c=0;c<d.length;c++){var f=d[c],b=f.getAttribute("data-href")||f.getAttribute("href");if("stylesheet"===f.rel&&(b===e||b===a))return f}for(var t=document.getElementsByTagName("style"),c=0;c<t.length;c++){var f=t[c],b=f.getAttribute("data-href");if(b===e||b===a)return f}})(c,f))return a();((e,a,d,c)=>{var f=document.createElement("link");f.rel="stylesheet",f.type="text/css",f.onerror=f.onload=b=>{if(f.onerror=f.onload=null,"load"===b.type)d();else{var t=b&&("load"===b.type?"missing":b.type),r=b&&b.target&&b.target.href||a,o=Error("Loading CSS chunk "+e+" failed.\n("+r+")");o.code="CSS_CHUNK_LOAD_FAILED",o.type=t,o.request=r,f.parentNode.removeChild(f),c(o)}},f.href=a;if("function"==typeof _N_E_STYLE_LOAD){var b=f.href,t=f.onload,r=f.onerror;_N_E_STYLE_LOAD(0===b.indexOf(window.location.origin)?new URL(b).pathname:b).then(function(){t&&t.call(f,{type:"load"})},function(){r&&r.call(f,{})})}else document.head.appendChild(f)})(e,f,a,d)}).then(()=>{b[e]=0},a=>{throw delete b[e],a}))},t={8068:0,4337:0},l.f.j=(e,a)=>{var d=l.o(t,e)?t[e]:void 0;if(0!==d)if(d)a.push(d[2]);else if(/^(4337|4825|8068)$/.test(e))t[e]=0;else{var c=new Promise((a,c)=>d=t[e]=[a,c]);a.push(d[2]=c);var f=l.p+l.u(e),b=Error();l.l(f,a=>{if(l.o(t,e)&&(0!==(d=t[e])&&(t[e]=void 0),d)){var c=a&&("load"===a.type?"missing":a.type),f=a&&a.target&&a.target.src;b.message="Loading chunk "+e+" failed.\n("+c+": "+f+")",b.name="ChunkLoadError",b.type=c,b.request=f,d[1](b)}},"chunk-"+e,e)}},l.O.j=e=>0===t[e],r=(e,a)=>{var d,c,[f,b,r]=a,o=0;if(f.some(e=>0!==t[e])){for(d in b)l.o(b,d)&&(l.m[d]=b[d]);if(r)var n=r(l)}for(e&&e(a);o<f.length;o++)c=f[o],l.o(t,c)&&t[c]&&t[c][0](),t[c]=0;return l.O(n)},(o=self.webpackChunk_N_E=self.webpackChunk_N_E||[]).forEach(r.bind(null,0)),o.push=r.bind(null,o.push.bind(o)),l.nc=void 0})();

package/dist/web/standalone/node_modules/@gsd/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/native",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Native Rust bindings for GSD — high-performance native modules via N-API",
   "type": "commonjs",
   "gsd": {

package/dist/web/standalone/node_modules/node-pty/build/Makefile

@@ -353,8 +353,8 @@ ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
 endif
 
 quiet_cmd_regen_makefile = ACTION Regenerating $@
-cmd_regen_makefile = cd $(srcdir); /github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp/gyp/gyp_main.py -fmake --ignore-environment "-Dlibrary=shared_library" "-Dvisibility=default" "-Dnode_root_dir=/github/home/.cache/node-gyp/24.17.0" "-Dnode_gyp_dir=/github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp" "-Dnode_lib_file=/github/home/.cache/node-gyp/24.17.0/<(target_arch)/node.lib" "-Dmodule_root_dir=/__w/gsd-pi/gsd-pi/node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty" "-Dnode_engine=v8" "--depth=." "-Goutput_dir=." "--generator-output=build" -I/__w/gsd-pi/gsd-pi/node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/build/config.gypi -I/github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp/addon.gypi -I/github/home/.cache/node-gyp/24.17.0/include/node/common.gypi "--toplevel-dir=." binding.gyp
-Makefile: $(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api/except.gypi $(srcdir)/../../../../../../../../github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp/addon.gypi $(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api/noexcept.gypi $(srcdir)/binding.gyp $(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api/node_addon_api.gyp $(srcdir)/../../../../../../../../github/home/.cache/node-gyp/24.17.0/include/node/common.gypi $(srcdir)/build/config.gypi
+cmd_regen_makefile = cd $(srcdir); /github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp/gyp/gyp_main.py -fmake --ignore-environment "-Dlibrary=shared_library" "-Dvisibility=default" "-Dnode_root_dir=/github/home/.cache/node-gyp/24.18.0" "-Dnode_gyp_dir=/github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp" "-Dnode_lib_file=/github/home/.cache/node-gyp/24.18.0/<(target_arch)/node.lib" "-Dmodule_root_dir=/__w/gsd-pi/gsd-pi/node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty" "-Dnode_engine=v8" "--depth=." "-Goutput_dir=." "--generator-output=build" -I/__w/gsd-pi/gsd-pi/node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/build/config.gypi -I/github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp/addon.gypi -I/github/home/.cache/node-gyp/24.18.0/include/node/common.gypi "--toplevel-dir=." binding.gyp
+Makefile: $(srcdir)/binding.gyp $(srcdir)/../../../../../../../../github/home/.cache/node-gyp/24.18.0/include/node/common.gypi $(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api/noexcept.gypi $(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api/node_addon_api.gyp $(srcdir)/build/config.gypi $(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api/except.gypi $(srcdir)/../../../../../../../../github/home/setup-pnpm/node_modules/.pnpm/pnpm@10.12.1/node_modules/pnpm/dist/node_modules/node-gyp/addon.gypi
 	$(call do_cmd,regen_makefile)
 
 # "all" is a concatenation of the "all" targets from all the included

package/dist/web/standalone/node_modules/node-pty/build/pty.target.mk

@@ -42,13 +42,13 @@ CFLAGS_CC_Debug := \
 	-std=gnu++20
 
 INCS_Debug := \
-	-I/github/home/.cache/node-gyp/24.17.0/include/node \
-	-I/github/home/.cache/node-gyp/24.17.0/src \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/openssl/config \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/openssl/openssl/include \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/uv/include \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/zlib \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/v8/include \
+	-I/github/home/.cache/node-gyp/24.18.0/include/node \
+	-I/github/home/.cache/node-gyp/24.18.0/src \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/openssl/config \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/openssl/openssl/include \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/uv/include \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/zlib \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/v8/include \
 	-I$(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api
 
 DEFS_Release := \
@@ -89,13 +89,13 @@ CFLAGS_CC_Release := \
 	-std=gnu++20
 
 INCS_Release := \
-	-I/github/home/.cache/node-gyp/24.17.0/include/node \
-	-I/github/home/.cache/node-gyp/24.17.0/src \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/openssl/config \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/openssl/openssl/include \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/uv/include \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/zlib \
-	-I/github/home/.cache/node-gyp/24.17.0/deps/v8/include \
+	-I/github/home/.cache/node-gyp/24.18.0/include/node \
+	-I/github/home/.cache/node-gyp/24.18.0/src \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/openssl/config \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/openssl/openssl/include \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/uv/include \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/zlib \
+	-I/github/home/.cache/node-gyp/24.18.0/deps/v8/include \
 	-I$(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api
 
 OBJS := \

package/dist/wizard.d.ts

@@ -1,4 +1,12 @@
 import type { AuthStorage } from '@gsd/pi-coding-agent';
+export type ApiKeyCredential = {
+    type?: string;
+    key?: string;
+};
+export declare function isStoredEnvCredential(cred: ApiKeyCredential): cred is ApiKeyCredential & {
+    type: 'api_key';
+    key: string;
+};
 /**
  * Hydrate process.env from stored auth.json credentials for optional tool keys.
  * Runs on every launch so extensions see Brave/Context7/Jina keys stored via the

package/dist/wizard.js

@@ -1,3 +1,9 @@
+export function isStoredEnvCredential(cred) {
+    return cred.type === 'api_key'
+        && typeof cred.key === 'string'
+        && cred.key.length > 0
+        && cred.key !== 'cli';
+}
 // ─── Env hydration ────────────────────────────────────────────────────────────
 /**
  * Hydrate process.env from stored auth.json credentials for optional tool keys.
@@ -19,13 +25,14 @@ export function loadStoredEnvKeys(authStorage) {
         ['minimax-cn', 'MINIMAX_CN_API_KEY'],
         ['ollama-cloud', 'OLLAMA_API_KEY'],
         ['custom-openai', 'CUSTOM_OPENAI_API_KEY'],
+        ['cursor-agent', 'CURSOR_API_KEY'],
     ];
     for (const [provider, envVar] of providers) {
         if (!process.env[envVar]) {
             // Use getCredentialsForProvider to skip empty-key entries at index 0
             // (left by legacy removeProviderToken which used set() with empty key)
             const creds = authStorage.getCredentialsForProvider(provider);
-            const cred = creds.find((c) => c.type === 'api_key' && typeof c.key === 'string' && c.key.length > 0);
+            const cred = creds.find(isStoredEnvCredential);
             if (cred?.type === 'api_key' && typeof cred.key === 'string') {
                 process.env[envVar] = cred.key;
             }

package/integrations/hermes/__init__.py

@@ -0,0 +1,31 @@
+"""open-gsd-hermes — Hermes Agent plugin directory-loader bridge."""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+from types import ModuleType
+
+
+def _load_package() -> ModuleType:
+    package_dir = Path(__file__).resolve().parent / "open_gsd_hermes"
+    init_file = package_dir / "__init__.py"
+    spec = importlib.util.spec_from_file_location(
+        "open_gsd_hermes",
+        init_file,
+        submodule_search_locations=[str(package_dir)],
+    )
+    if spec is None or spec.loader is None:
+        raise ImportError(f"Cannot load open_gsd_hermes from {init_file}")
+
+    module = importlib.util.module_from_spec(spec)
+    sys.modules["open_gsd_hermes"] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+_package = _load_package()
+register = _package.register
+
+__all__ = ["register"]

package/integrations/hermes/tests/test_directory_loader.py

@@ -0,0 +1,37 @@
+"""Directory-loader compatibility tests."""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+from types import ModuleType
+
+
+def load_plugin_directory(plugin_root: Path) -> ModuleType:
+    """Load the Hermes plugin the same way its directory loader does."""
+    init_file = plugin_root / "__init__.py"
+    if not init_file.exists():
+        raise FileNotFoundError(f"No __init__.py in {plugin_root}")
+
+    spec = importlib.util.spec_from_file_location(
+        "open_gsd_hermes_directory_loader",
+        init_file,
+        submodule_search_locations=[str(plugin_root)],
+    )
+    assert spec is not None
+    assert spec.loader is not None
+
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_plugin_root_supports_hermes_directory_loader() -> None:
+    plugin_root = Path(__file__).resolve().parents[1]
+
+    module = load_plugin_directory(plugin_root)
+
+    assert callable(module.register)
+    assert module.__all__ == ["register"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-pi",
-  "version": "1.3.0-dev.eed73bea",
+  "version": "1.4.0-dev.5fc22c6f",
   "description": "GSD Pi local-first coding agent",
   "license": "MIT",
   "repository": {
@@ -77,7 +77,7 @@
     "baseline:refactor:phase0": "pnpm run baseline:refactor:gate && node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/derive-state-db.test.ts src/resources/extensions/gsd/tests/single-writer-invariant.test.ts src/resources/extensions/gsd/tests/auto-recovery.test.ts src/resources/extensions/gsd/tests/auto-worktree-registry.test.ts",
     "legacy:cleanup:gate": "node scripts/legacy-cleanup-gate.mjs",
     "legacy:cleanup:evidence": "node scripts/legacy-cleanup-evidence.mjs",
-    "test:unit:compiled": "node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test-reporter=./scripts/test-reporter-compact.mjs --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
+    "test:unit:compiled": "node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test-reporter=./scripts/test-reporter-compact.mjs --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/cursor-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
     "test:unit": "pnpm run test:compile && pnpm run test:unit:compiled",
     "test:changed:src": "node scripts/verify-changed-src-tests.mjs",
     "test:packages": "pnpm run test:compile && pnpm run test:packages:compiled",
@@ -123,7 +123,7 @@
     "audit:test-gaps": "node scripts/audit-test-gaps.mjs",
     "audit:test-matrix": "node scripts/audit-test-matrix.mjs",
     "test:evaluation": "node scripts/run-test-evaluation.mjs",
-    "test:coverage:unit": "cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/unit --temp-directory=coverage/.tmp-unit --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --exclude=\"**/test/**\" --all node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
+    "test:coverage:unit": "cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/unit --temp-directory=coverage/.tmp-unit --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --exclude=\"**/test/**\" --all node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/cursor-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
     "test:coverage:integration": "pnpm exec playwright install chromium && cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/integration --temp-directory=coverage/.tmp-integration --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --all node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test --test-timeout=180000 \"src/tests/integration/*.test.ts\" \"src/resources/extensions/gsd/tests/integration/*.test.ts\" \"src/resources/extensions/async-jobs/*.test.ts\" \"src/resources/extensions/ollama/**/*.test.ts\" \"src/resources/extensions/ollama/*.test.ts\" \"src/resources/extensions/search-the-web/tests/*.test.ts\" \"src/resources/extensions/bg-shell/tests/*.test.ts\" \"src/resources/extensions/slash-commands/tests/*.test.ts\" \"src/resources/extensions/browser-tools/tests/*.test.mjs\"",
     "test:coverage:packages": "node scripts/run-coverage-packages.mjs",
     "test:coverage:merge": "node scripts/merge-coverage-reports.mjs",
@@ -210,11 +210,11 @@
   },
   "optionalDependencies": {
     "@mariozechner/clipboard": "0.3.6",
-    "@opengsd/engine-darwin-arm64": "1.3.0",
-    "@opengsd/engine-darwin-x64": "1.3.0",
-    "@opengsd/engine-linux-arm64-gnu": "1.3.0",
-    "@opengsd/engine-linux-x64-gnu": "1.3.0",
-    "@opengsd/engine-win32-x64-msvc": "1.3.0",
+    "@opengsd/engine-darwin-arm64": "1.4.0",
+    "@opengsd/engine-darwin-x64": "1.4.0",
+    "@opengsd/engine-linux-arm64-gnu": "1.4.0",
+    "@opengsd/engine-linux-x64-gnu": "1.4.0",
+    "@opengsd/engine-win32-x64-msvc": "1.4.0",
     "fsevents": "~2.3.3",
     "koffi": "^2.9.0"
   },

package/packages/cloud-mcp-gateway/dist/auth-store.d.ts

@@ -46,6 +46,7 @@ export declare class InMemoryAuthStore {
     revokeDeviceToken(deviceToken: string): boolean;
     snapshot(): AuthStoreSnapshot;
     protected afterMutation(): void;
+    private sweepExpiredPairingCodes;
     private loadSnapshot;
 }
 export declare class FileAuthStore extends InMemoryAuthStore {

package/packages/cloud-mcp-gateway/dist/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;IACtD,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;IAC1D,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,SAAS,CAAC,QAAQ,CAAC,UAAU,kDAAyD;IACtF,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;IAC1F,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;gBAE9E,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,CAAC,EAAE,iBAAiB;IAK3F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQjD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAO1D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI;IAOvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAiB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAS9F,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAkBzE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAQ/C,QAAQ,IAAI,iBAAiB;IAS7B,SAAS,CAAC,aAAa,IAAI,IAAI;IAI/B,OAAO,CAAC,YAAY;CAarB;AAED,qBAAa,aAAc,SAAQ,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGhC,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;cAQhC,aAAa,IAAI,IAAI;IAIxC,OAAO,CAAC,OAAO;CAMhB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,SAAkC,GAAG,gBAAgB,CAK/G"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;IACtD,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;IAC1D,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,SAAS,CAAC,QAAQ,CAAC,UAAU,kDAAyD;IACtF,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;IAC1F,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;gBAE9E,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,CAAC,EAAE,iBAAiB;IAK3F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQjD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAO1D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI;IAOvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAiB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAkB9F,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAmBzE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAQ/C,QAAQ,IAAI,iBAAiB;IAS7B,SAAS,CAAC,aAAa,IAAI,IAAI;IAO/B,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,YAAY;CAarB;AAED,qBAAa,aAAc,SAAQ,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGhC,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;cAQhC,aAAa,IAAI,IAAI;IAIxC,OAAO,CAAC,OAAO;CAMhB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,SAAkC,GAAG,gBAAgB,CAK/G"}

package/packages/cloud-mcp-gateway/dist/auth-store.js

@@ -36,7 +36,17 @@ export class InMemoryAuthStore {
         return record;
     }
     createPairingCode(userId, ttlMs = 10 * 60 * 1000) {
-        const code = randomBytes(4).toString("hex").toUpperCase();
+        this.sweepExpiredPairingCodes();
+        // One live pairing code per user: a new code invalidates any prior un-redeemed
+        // one, so the guessable set never grows beyond a single code per user (and the
+        // per-exchange scrypt cost stays bounded).
+        for (const [hash, record] of this.pairingCodes) {
+            if (record.userId === userId)
+                this.pairingCodes.delete(hash);
+        }
+        // 64 bits of entropy (16 hex chars). Endpoint-level request rate limiting is the
+        // complementary defense and belongs at the HTTP layer, not here.
+        const code = randomBytes(8).toString("hex").toUpperCase();
         const expiresAt = Date.now() + ttlMs;
         const key = deriveSecretHash(code);
         this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });
@@ -44,6 +54,7 @@ export class InMemoryAuthStore {
         return { code, expiresAt };
     }
     exchangePairingCode(code, runtimeName) {
+        this.sweepExpiredPairingCodes();
         const normalized = code.trim().toUpperCase();
         const codeEntry = findSecretEntry(this.pairingCodes, normalized);
         if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {
@@ -80,6 +91,15 @@ export class InMemoryAuthStore {
     afterMutation() {
         // Extension point for persistent stores.
     }
+    // Drop expired pairing codes so a long-lived gateway does not accumulate codes
+    // that were generated but never redeemed. Best-effort: callers persist via their
+    // own afterMutation() after the create/exchange that triggered the sweep.
+    sweepExpiredPairingCodes(now = Date.now()) {
+        for (const [hash, record] of this.pairingCodes) {
+            if (record.expiresAt < now)
+                this.pairingCodes.delete(hash);
+        }
+    }
     loadSnapshot(snapshot) {
         for (const record of snapshot.userTokens ?? []) {
             this.userTokens.set(record.secretHash, record);

package/packages/cloud-mcp-gateway/dist/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,MAAM,OAAO,iBAAiB;IACT,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE1F,YAAY,aAAiD,EAAE,QAA4B;QACzF,IAAI,QAAQ;YAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO;QAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,gBAAgB,CAAC,KAAyB;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,kBAAkB,CAAC,KAAyB;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,mBAAmB,CAAC,IAAY,EAAE,WAAoB;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,IAAI,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACpD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAES,aAAa;QACrB,yCAAyC;IAC3C,CAAC;IAEO,YAAY,CAAC,QAA2B;QAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,iBAAiB;IACjC,QAAQ,CAAS;IAElC,YACE,QAAgB,EAChB,aAAiD;QAEjD,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAChE,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEjF,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEzE,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM;QAC1C,UAAU,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC3F,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAA6B,OAAuB,EAAE,MAAc;IAC3F,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAA6B,OAAuB,EAAE,MAAc;IAC1F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAAwB,EAAE,MAAc;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA+B,CAAC;QACxF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAA6C,CAAC,CAAC,CAAC,EAAE;YACxG,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;YAChH,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;SACjH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\n\nexport interface UserTokenRecord {\n  userId: string;\n  revoked?: boolean;\n}\n\nexport interface DeviceTokenRecord {\n  userId: string;\n  runtimeId: string;\n  runtimeName?: string;\n  revoked?: boolean;\n}\n\nexport interface PairingCodeRecord {\n  userId: string;\n  expiresAt: number;\n}\n\nexport interface DeviceTokenIssue {\n  userId: string;\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport interface AuthStoreSnapshot {\n  version: 1;\n  userTokens: Array<UserTokenRecord & SecretHashRecord>;\n  deviceTokens: Array<DeviceTokenRecord & SecretHashRecord>;\n  pairingCodes: Array<PairingCodeRecord & SecretHashRecord>;\n}\n\nexport interface SecretHashRecord {\n  secretHash: string;\n  secretSalt: string;\n}\n\nexport class InMemoryAuthStore {\n  protected readonly userTokens = new Map<string, UserTokenRecord & SecretHashRecord>();\n  protected readonly deviceTokens = new Map<string, DeviceTokenRecord & SecretHashRecord>();\n  protected readonly pairingCodes = new Map<string, PairingCodeRecord & SecretHashRecord>();\n\n  constructor(seedUserToken?: { token: string; userId: string }, snapshot?: AuthStoreSnapshot) {\n    if (snapshot) this.loadSnapshot(snapshot);\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n  }\n\n  addUserToken(token: string, userId: string): void {\n    const existing = findSecretRecord(this.userTokens, token);\n    if (existing?.userId === userId && !existing.revoked) return;\n    const key = deriveSecretHash(token);\n    this.userTokens.set(key.secretHash, { ...key, userId });\n    this.afterMutation();\n  }\n\n  authenticateUser(token: string | undefined): string | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.userTokens, token);\n    if (!record || record.revoked) return null;\n    return record.userId;\n  }\n\n  authenticateDevice(token: string | undefined): DeviceTokenRecord | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.deviceTokens, token);\n    if (!record || record.revoked) return null;\n    return record;\n  }\n\n  createPairingCode(userId: string, ttlMs = 10 * 60 * 1000): { code: string; expiresAt: number } {\n    const code = randomBytes(4).toString(\"hex\").toUpperCase();\n    const expiresAt = Date.now() + ttlMs;\n    const key = deriveSecretHash(code);\n    this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });\n    this.afterMutation();\n    return { code, expiresAt };\n  }\n\n  exchangePairingCode(code: string, runtimeName?: string): DeviceTokenIssue {\n    const normalized = code.trim().toUpperCase();\n    const codeEntry = findSecretEntry(this.pairingCodes, normalized);\n    if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {\n      if (codeEntry) this.pairingCodes.delete(codeEntry[0]);\n      this.afterMutation();\n      throw new Error(\"Pairing code is invalid or expired\");\n    }\n    const [codeHash, record] = codeEntry;\n    this.pairingCodes.delete(codeHash);\n    const runtimeId = `rt_${randomUUID()}`;\n    const deviceToken = `gsd_dev_${randomBytes(32).toString(\"hex\")}`;\n    const key = deriveSecretHash(deviceToken);\n    this.deviceTokens.set(key.secretHash, { ...key, userId: record.userId, runtimeId, runtimeName });\n    this.afterMutation();\n    return { userId: record.userId, runtimeId, deviceToken };\n  }\n\n  revokeDeviceToken(deviceToken: string): boolean {\n    const record = findSecretRecord(this.deviceTokens, deviceToken);\n    if (!record) return false;\n    record.revoked = true;\n    this.afterMutation();\n    return true;\n  }\n\n  snapshot(): AuthStoreSnapshot {\n    return {\n      version: 1,\n      userTokens: Array.from(this.userTokens.values()),\n      deviceTokens: Array.from(this.deviceTokens.values()),\n      pairingCodes: Array.from(this.pairingCodes.values()),\n    };\n  }\n\n  protected afterMutation(): void {\n    // Extension point for persistent stores.\n  }\n\n  private loadSnapshot(snapshot: AuthStoreSnapshot): void {\n    for (const record of snapshot.userTokens ?? []) {\n      this.userTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.deviceTokens ?? []) {\n      this.deviceTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.pairingCodes ?? []) {\n      if (record.expiresAt >= Date.now()) {\n        this.pairingCodes.set(record.secretHash, record);\n      }\n    }\n  }\n}\n\nexport class FileAuthStore extends InMemoryAuthStore {\n  private readonly filePath: string;\n\n  constructor(\n    filePath: string,\n    seedUserToken?: { token: string; userId: string },\n  ) {\n    super(undefined, readSnapshot(filePath));\n    this.filePath = filePath;\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n    this.persist();\n  }\n\n  protected override afterMutation(): void {\n    this.persist();\n  }\n\n  private persist(): void {\n    mkdirSync(dirname(this.filePath), { recursive: true });\n    const tmp = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;\n    writeFileSync(tmp, `${JSON.stringify(this.snapshot(), null, 2)}\\n`, { encoding: \"utf8\", mode: 0o600 });\n    renameSync(tmp, this.filePath);\n  }\n}\n\nexport function extractBearerToken(header: string | string[] | undefined): string | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || value.length <= \"Bearer \".length) return undefined;\n  if (value.slice(0, \"Bearer\".length).toLowerCase() !== \"bearer\") return undefined;\n\n  const firstSeparator = value.charCodeAt(\"Bearer\".length);\n  if (firstSeparator !== 0x20 && firstSeparator !== 0x09) return undefined;\n\n  let tokenStart = \"Bearer\".length + 1;\n  while (tokenStart < value.length) {\n    const char = value.charCodeAt(tokenStart);\n    if (char !== 0x20 && char !== 0x09) break;\n    tokenStart += 1;\n  }\n\n  return tokenStart < value.length ? value.slice(tokenStart) : undefined;\n}\n\nexport function deriveSecretHash(secret: string, secretSalt = randomBytes(16).toString(\"hex\")): SecretHashRecord {\n  return {\n    secretHash: scryptSync(secret, secretSalt, 32).toString(\"hex\"),\n    secretSalt,\n  };\n}\n\nfunction findSecretRecord<T extends SecretHashRecord>(records: Map<string, T>, secret: string): T | undefined {\n  return findSecretEntry(records, secret)?.[1];\n}\n\nfunction findSecretEntry<T extends SecretHashRecord>(records: Map<string, T>, secret: string): [string, T] | undefined {\n  for (const entry of records) {\n    if (secretMatches(entry[1], secret)) return entry;\n  }\n  return undefined;\n}\n\nfunction secretMatches(record: SecretHashRecord, secret: string): boolean {\n  const candidate = Buffer.from(deriveSecretHash(secret, record.secretSalt).secretHash, \"hex\");\n  const expected = Buffer.from(record.secretHash, \"hex\");\n  return candidate.length === expected.length && timingSafeEqual(candidate, expected);\n}\n\nfunction readSnapshot(filePath: string): AuthStoreSnapshot | undefined {\n  try {\n    const parsed = JSON.parse(readFileSync(filePath, \"utf8\")) as Partial<AuthStoreSnapshot>;\n    if (parsed.version !== 1) return undefined;\n    return {\n      version: 1,\n      userTokens: Array.isArray(parsed.userTokens) ? parsed.userTokens as AuthStoreSnapshot[\"userTokens\"] : [],\n      deviceTokens: Array.isArray(parsed.deviceTokens) ? parsed.deviceTokens as AuthStoreSnapshot[\"deviceTokens\"] : [],\n      pairingCodes: Array.isArray(parsed.pairingCodes) ? parsed.pairingCodes as AuthStoreSnapshot[\"pairingCodes\"] : [],\n    };\n  } catch {\n    return undefined;\n  }\n}\n"]}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,MAAM,OAAO,iBAAiB;IACT,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE1F,YAAY,aAAiD,EAAE,QAA4B;QACzF,IAAI,QAAQ;YAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO;QAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,gBAAgB,CAAC,KAAyB;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,kBAAkB,CAAC,KAAyB;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACtD,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,+EAA+E;QAC/E,+EAA+E;QAC/E,2CAA2C;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,iFAAiF;QACjF,iEAAiE;QACjE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,mBAAmB,CAAC,IAAY,EAAE,WAAoB;QACpD,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,IAAI,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACpD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAES,aAAa;QACrB,yCAAyC;IAC3C,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,0EAA0E;IAClE,wBAAwB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAA2B;QAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,iBAAiB;IACjC,QAAQ,CAAS;IAElC,YACE,QAAgB,EAChB,aAAiD;QAEjD,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAChE,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEjF,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEzE,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM;QAC1C,UAAU,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC3F,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAA6B,OAAuB,EAAE,MAAc;IAC3F,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAA6B,OAAuB,EAAE,MAAc;IAC1F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAAwB,EAAE,MAAc;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA+B,CAAC;QACxF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAA6C,CAAC,CAAC,CAAC,EAAE;YACxG,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;YAChH,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;SACjH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\n\nexport interface UserTokenRecord {\n  userId: string;\n  revoked?: boolean;\n}\n\nexport interface DeviceTokenRecord {\n  userId: string;\n  runtimeId: string;\n  runtimeName?: string;\n  revoked?: boolean;\n}\n\nexport interface PairingCodeRecord {\n  userId: string;\n  expiresAt: number;\n}\n\nexport interface DeviceTokenIssue {\n  userId: string;\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport interface AuthStoreSnapshot {\n  version: 1;\n  userTokens: Array<UserTokenRecord & SecretHashRecord>;\n  deviceTokens: Array<DeviceTokenRecord & SecretHashRecord>;\n  pairingCodes: Array<PairingCodeRecord & SecretHashRecord>;\n}\n\nexport interface SecretHashRecord {\n  secretHash: string;\n  secretSalt: string;\n}\n\nexport class InMemoryAuthStore {\n  protected readonly userTokens = new Map<string, UserTokenRecord & SecretHashRecord>();\n  protected readonly deviceTokens = new Map<string, DeviceTokenRecord & SecretHashRecord>();\n  protected readonly pairingCodes = new Map<string, PairingCodeRecord & SecretHashRecord>();\n\n  constructor(seedUserToken?: { token: string; userId: string }, snapshot?: AuthStoreSnapshot) {\n    if (snapshot) this.loadSnapshot(snapshot);\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n  }\n\n  addUserToken(token: string, userId: string): void {\n    const existing = findSecretRecord(this.userTokens, token);\n    if (existing?.userId === userId && !existing.revoked) return;\n    const key = deriveSecretHash(token);\n    this.userTokens.set(key.secretHash, { ...key, userId });\n    this.afterMutation();\n  }\n\n  authenticateUser(token: string | undefined): string | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.userTokens, token);\n    if (!record || record.revoked) return null;\n    return record.userId;\n  }\n\n  authenticateDevice(token: string | undefined): DeviceTokenRecord | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.deviceTokens, token);\n    if (!record || record.revoked) return null;\n    return record;\n  }\n\n  createPairingCode(userId: string, ttlMs = 10 * 60 * 1000): { code: string; expiresAt: number } {\n    this.sweepExpiredPairingCodes();\n    // One live pairing code per user: a new code invalidates any prior un-redeemed\n    // one, so the guessable set never grows beyond a single code per user (and the\n    // per-exchange scrypt cost stays bounded).\n    for (const [hash, record] of this.pairingCodes) {\n      if (record.userId === userId) this.pairingCodes.delete(hash);\n    }\n    // 64 bits of entropy (16 hex chars). Endpoint-level request rate limiting is the\n    // complementary defense and belongs at the HTTP layer, not here.\n    const code = randomBytes(8).toString(\"hex\").toUpperCase();\n    const expiresAt = Date.now() + ttlMs;\n    const key = deriveSecretHash(code);\n    this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });\n    this.afterMutation();\n    return { code, expiresAt };\n  }\n\n  exchangePairingCode(code: string, runtimeName?: string): DeviceTokenIssue {\n    this.sweepExpiredPairingCodes();\n    const normalized = code.trim().toUpperCase();\n    const codeEntry = findSecretEntry(this.pairingCodes, normalized);\n    if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {\n      if (codeEntry) this.pairingCodes.delete(codeEntry[0]);\n      this.afterMutation();\n      throw new Error(\"Pairing code is invalid or expired\");\n    }\n    const [codeHash, record] = codeEntry;\n    this.pairingCodes.delete(codeHash);\n    const runtimeId = `rt_${randomUUID()}`;\n    const deviceToken = `gsd_dev_${randomBytes(32).toString(\"hex\")}`;\n    const key = deriveSecretHash(deviceToken);\n    this.deviceTokens.set(key.secretHash, { ...key, userId: record.userId, runtimeId, runtimeName });\n    this.afterMutation();\n    return { userId: record.userId, runtimeId, deviceToken };\n  }\n\n  revokeDeviceToken(deviceToken: string): boolean {\n    const record = findSecretRecord(this.deviceTokens, deviceToken);\n    if (!record) return false;\n    record.revoked = true;\n    this.afterMutation();\n    return true;\n  }\n\n  snapshot(): AuthStoreSnapshot {\n    return {\n      version: 1,\n      userTokens: Array.from(this.userTokens.values()),\n      deviceTokens: Array.from(this.deviceTokens.values()),\n      pairingCodes: Array.from(this.pairingCodes.values()),\n    };\n  }\n\n  protected afterMutation(): void {\n    // Extension point for persistent stores.\n  }\n\n  // Drop expired pairing codes so a long-lived gateway does not accumulate codes\n  // that were generated but never redeemed. Best-effort: callers persist via their\n  // own afterMutation() after the create/exchange that triggered the sweep.\n  private sweepExpiredPairingCodes(now = Date.now()): void {\n    for (const [hash, record] of this.pairingCodes) {\n      if (record.expiresAt < now) this.pairingCodes.delete(hash);\n    }\n  }\n\n  private loadSnapshot(snapshot: AuthStoreSnapshot): void {\n    for (const record of snapshot.userTokens ?? []) {\n      this.userTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.deviceTokens ?? []) {\n      this.deviceTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.pairingCodes ?? []) {\n      if (record.expiresAt >= Date.now()) {\n        this.pairingCodes.set(record.secretHash, record);\n      }\n    }\n  }\n}\n\nexport class FileAuthStore extends InMemoryAuthStore {\n  private readonly filePath: string;\n\n  constructor(\n    filePath: string,\n    seedUserToken?: { token: string; userId: string },\n  ) {\n    super(undefined, readSnapshot(filePath));\n    this.filePath = filePath;\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n    this.persist();\n  }\n\n  protected override afterMutation(): void {\n    this.persist();\n  }\n\n  private persist(): void {\n    mkdirSync(dirname(this.filePath), { recursive: true });\n    const tmp = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;\n    writeFileSync(tmp, `${JSON.stringify(this.snapshot(), null, 2)}\\n`, { encoding: \"utf8\", mode: 0o600 });\n    renameSync(tmp, this.filePath);\n  }\n}\n\nexport function extractBearerToken(header: string | string[] | undefined): string | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || value.length <= \"Bearer \".length) return undefined;\n  if (value.slice(0, \"Bearer\".length).toLowerCase() !== \"bearer\") return undefined;\n\n  const firstSeparator = value.charCodeAt(\"Bearer\".length);\n  if (firstSeparator !== 0x20 && firstSeparator !== 0x09) return undefined;\n\n  let tokenStart = \"Bearer\".length + 1;\n  while (tokenStart < value.length) {\n    const char = value.charCodeAt(tokenStart);\n    if (char !== 0x20 && char !== 0x09) break;\n    tokenStart += 1;\n  }\n\n  return tokenStart < value.length ? value.slice(tokenStart) : undefined;\n}\n\nexport function deriveSecretHash(secret: string, secretSalt = randomBytes(16).toString(\"hex\")): SecretHashRecord {\n  return {\n    secretHash: scryptSync(secret, secretSalt, 32).toString(\"hex\"),\n    secretSalt,\n  };\n}\n\nfunction findSecretRecord<T extends SecretHashRecord>(records: Map<string, T>, secret: string): T | undefined {\n  return findSecretEntry(records, secret)?.[1];\n}\n\nfunction findSecretEntry<T extends SecretHashRecord>(records: Map<string, T>, secret: string): [string, T] | undefined {\n  for (const entry of records) {\n    if (secretMatches(entry[1], secret)) return entry;\n  }\n  return undefined;\n}\n\nfunction secretMatches(record: SecretHashRecord, secret: string): boolean {\n  const candidate = Buffer.from(deriveSecretHash(secret, record.secretSalt).secretHash, \"hex\");\n  const expected = Buffer.from(record.secretHash, \"hex\");\n  return candidate.length === expected.length && timingSafeEqual(candidate, expected);\n}\n\nfunction readSnapshot(filePath: string): AuthStoreSnapshot | undefined {\n  try {\n    const parsed = JSON.parse(readFileSync(filePath, \"utf8\")) as Partial<AuthStoreSnapshot>;\n    if (parsed.version !== 1) return undefined;\n    return {\n      version: 1,\n      userTokens: Array.isArray(parsed.userTokens) ? parsed.userTokens as AuthStoreSnapshot[\"userTokens\"] : [],\n      deviceTokens: Array.isArray(parsed.deviceTokens) ? parsed.deviceTokens as AuthStoreSnapshot[\"deviceTokens\"] : [],\n      pairingCodes: Array.isArray(parsed.pairingCodes) ? parsed.pairingCodes as AuthStoreSnapshot[\"pairingCodes\"] : [],\n    };\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/packages/cloud-mcp-gateway/dist/auth-store.test.js

@@ -22,6 +22,40 @@ test("pairing code is one-time use", () => {
     auth.exchangePairingCode(code);
     assert.throws(() => auth.exchangePairingCode(code), /invalid or expired/);
 });
+test("pairing code has 64 bits of entropy (16 hex chars)", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    const { code } = auth.createPairingCode("u1");
+    assert.match(code, /^[0-9A-F]{16}$/);
+});
+test("a new pairing code invalidates the user's prior un-redeemed code", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    const { code: first } = auth.createPairingCode("u1");
+    const { code: second } = auth.createPairingCode("u1");
+    assert.notEqual(first, second);
+    assert.throws(() => auth.exchangePairingCode(first), /invalid or expired/);
+    // The newest code still works.
+    const issued = auth.exchangePairingCode(second);
+    assert.equal(typeof issued.deviceToken, "string");
+});
+test("codes for different users coexist", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    auth.addUserToken("user-token-2", "u2");
+    const { code: c1 } = auth.createPairingCode("u1");
+    const { code: c2 } = auth.createPairingCode("u2");
+    assert.equal(auth.exchangePairingCode(c1).userId, "u1");
+    assert.equal(auth.exchangePairingCode(c2).userId, "u2");
+});
+test("expired pairing codes are swept on the next create/exchange", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    // Create an already-expired code for u2 (negative ttl), then a fresh code for u1.
+    auth.addUserToken("user-token-2", "u2");
+    const { code: stale } = auth.createPairingCode("u2", -1);
+    auth.createPairingCode("u1"); // triggers the sweep
+    const snapshot = auth.snapshot();
+    // Only u1's live code remains; the expired u2 code was swept.
+    assert.equal(snapshot.pairingCodes.length, 1);
+    assert.throws(() => auth.exchangePairingCode(stale), /invalid or expired/);
+});
 test("extractBearerToken parses bearer auth header", () => {
     assert.equal(extractBearerToken("Bearer abc"), "abc");
     assert.equal(extractBearerToken("bearer abc"), "abc");

package/packages/cloud-mcp-gateway/dist/auth-store.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.test.js","sourceRoot":"","sources":["../src/auth-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEvF,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAExD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE;IACxC,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;IACxD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAEzD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmD,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAEzF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC","sourcesContent":["import assert from \"node:assert/strict\";\nimport { mkdtempSync, readFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { test } from \"node:test\";\nimport { FileAuthStore, InMemoryAuthStore, extractBearerToken } from \"./auth-store.js\";\n\ntest(\"auth rejects missing, invalid, and revoked device tokens\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  assert.equal(auth.authenticateUser(undefined), null);\n  assert.equal(auth.authenticateUser(\"bad\"), null);\n  assert.equal(auth.authenticateUser(\"user-token\"), \"u1\");\n\n  const { code } = auth.createPairingCode(\"u1\");\n  const issued = auth.exchangePairingCode(code, \"MacBook\");\n  assert.equal(auth.authenticateDevice(\"bad\"), null);\n  assert.equal(auth.authenticateDevice(issued.deviceToken)?.runtimeId, issued.runtimeId);\n  assert.equal(auth.revokeDeviceToken(issued.deviceToken), true);\n  assert.equal(auth.authenticateDevice(issued.deviceToken), null);\n});\n\ntest(\"pairing code is one-time use\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  const { code } = auth.createPairingCode(\"u1\");\n  auth.exchangePairingCode(code);\n  assert.throws(() => auth.exchangePairingCode(code), /invalid or expired/);\n});\n\ntest(\"extractBearerToken parses bearer auth header\", () => {\n  assert.equal(extractBearerToken(\"Bearer abc\"), \"abc\");\n  assert.equal(extractBearerToken(\"bearer abc\"), \"abc\");\n  assert.equal(extractBearerToken(\"Bearer\\t\\tabc\"), \"abc\");\n  assert.equal(extractBearerToken(\"Basic abc\"), undefined);\n  assert.equal(extractBearerToken(`bearer\\t${\"\\t\".repeat(10_000)}`), undefined);\n});\n\ntest(\"file auth store persists user and device auth without raw tokens\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-auth-\"));\n  const storePath = join(dir, \"auth.json\");\n  const first = new FileAuthStore(storePath, { token: \"user-token\", userId: \"u1\" });\n  assert.equal(first.authenticateUser(\"user-token\"), \"u1\");\n\n  const { code } = first.createPairingCode(\"u1\");\n  const issued = first.exchangePairingCode(code, \"Laptop\");\n  assert.equal(first.authenticateDevice(issued.deviceToken)?.runtimeName, \"Laptop\");\n\n  const raw = readFileSync(storePath, \"utf8\");\n  assert.doesNotMatch(raw, /user-token/);\n  assert.doesNotMatch(raw, new RegExp(issued.deviceToken));\n  assert.doesNotMatch(raw, new RegExp(code));\n  const snapshot = JSON.parse(raw) as { userTokens: Array<Record<string, unknown>> };\n  assert.equal(typeof snapshot.userTokens[0]?.secretSalt, \"string\");\n  assert.equal(typeof snapshot.userTokens[0]?.secretHash, \"string\");\n  assert.equal(snapshot.userTokens[0]?.tokenHash, undefined);\n\n  const second = new FileAuthStore(storePath);\n  assert.equal(second.authenticateUser(\"user-token\"), \"u1\");\n  assert.equal(second.authenticateDevice(issued.deviceToken)?.runtimeId, issued.runtimeId);\n\n  assert.equal(second.revokeDeviceToken(issued.deviceToken), true);\n  const third = new FileAuthStore(storePath);\n  assert.equal(third.authenticateDevice(issued.deviceToken), null);\n});\n\ntest(\"file auth store preserves unexchanged pairing codes across restart\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-pairing-\"));\n  const storePath = join(dir, \"auth.json\");\n  const first = new FileAuthStore(storePath, { token: \"user-token\", userId: \"u1\" });\n  const { code } = first.createPairingCode(\"u1\");\n\n  const second = new FileAuthStore(storePath);\n  const issued = second.exchangePairingCode(code, \"Laptop\");\n  assert.equal(second.authenticateDevice(issued.deviceToken)?.runtimeName, \"Laptop\");\n});\n"]}
+{"version":3,"file":"auth-store.test.js","sourceRoot":"","sources":["../src/auth-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEvF,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAExD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE;IACxC,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC3E,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAC7C,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,kFAAkF;IAClF,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACjC,8DAA8D;IAC9D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;IACxD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAEzD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmD,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAEzF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC","sourcesContent":["import assert from \"node:assert/strict\";\nimport { mkdtempSync, readFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { test } from \"node:test\";\nimport { FileAuthStore, InMemoryAuthStore, extractBearerToken } from \"./auth-store.js\";\n\ntest(\"auth rejects missing, invalid, and revoked device tokens\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  assert.equal(auth.authenticateUser(undefined), null);\n  assert.equal(auth.authenticateUser(\"bad\"), null);\n  assert.equal(auth.authenticateUser(\"user-token\"), \"u1\");\n\n  const { code } = auth.createPairingCode(\"u1\");\n  const issued = auth.exchangePairingCode(code, \"MacBook\");\n  assert.equal(auth.authenticateDevice(\"bad\"), null);\n  assert.equal(auth.authenticateDevice(issued.deviceToken)?.runtimeId, issued.runtimeId);\n  assert.equal(auth.revokeDeviceToken(issued.deviceToken), true);\n  assert.equal(auth.authenticateDevice(issued.deviceToken), null);\n});\n\ntest(\"pairing code is one-time use\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  const { code } = auth.createPairingCode(\"u1\");\n  auth.exchangePairingCode(code);\n  assert.throws(() => auth.exchangePairingCode(code), /invalid or expired/);\n});\n\ntest(\"pairing code has 64 bits of entropy (16 hex chars)\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  const { code } = auth.createPairingCode(\"u1\");\n  assert.match(code, /^[0-9A-F]{16}$/);\n});\n\ntest(\"a new pairing code invalidates the user's prior un-redeemed code\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  const { code: first } = auth.createPairingCode(\"u1\");\n  const { code: second } = auth.createPairingCode(\"u1\");\n  assert.notEqual(first, second);\n  assert.throws(() => auth.exchangePairingCode(first), /invalid or expired/);\n  // The newest code still works.\n  const issued = auth.exchangePairingCode(second);\n  assert.equal(typeof issued.deviceToken, \"string\");\n});\n\ntest(\"codes for different users coexist\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  auth.addUserToken(\"user-token-2\", \"u2\");\n  const { code: c1 } = auth.createPairingCode(\"u1\");\n  const { code: c2 } = auth.createPairingCode(\"u2\");\n  assert.equal(auth.exchangePairingCode(c1).userId, \"u1\");\n  assert.equal(auth.exchangePairingCode(c2).userId, \"u2\");\n});\n\ntest(\"expired pairing codes are swept on the next create/exchange\", () => {\n  const auth = new InMemoryAuthStore({ token: \"user-token\", userId: \"u1\" });\n  // Create an already-expired code for u2 (negative ttl), then a fresh code for u1.\n  auth.addUserToken(\"user-token-2\", \"u2\");\n  const { code: stale } = auth.createPairingCode(\"u2\", -1);\n  auth.createPairingCode(\"u1\"); // triggers the sweep\n  const snapshot = auth.snapshot();\n  // Only u1's live code remains; the expired u2 code was swept.\n  assert.equal(snapshot.pairingCodes.length, 1);\n  assert.throws(() => auth.exchangePairingCode(stale), /invalid or expired/);\n});\n\ntest(\"extractBearerToken parses bearer auth header\", () => {\n  assert.equal(extractBearerToken(\"Bearer abc\"), \"abc\");\n  assert.equal(extractBearerToken(\"bearer abc\"), \"abc\");\n  assert.equal(extractBearerToken(\"Bearer\\t\\tabc\"), \"abc\");\n  assert.equal(extractBearerToken(\"Basic abc\"), undefined);\n  assert.equal(extractBearerToken(`bearer\\t${\"\\t\".repeat(10_000)}`), undefined);\n});\n\ntest(\"file auth store persists user and device auth without raw tokens\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-auth-\"));\n  const storePath = join(dir, \"auth.json\");\n  const first = new FileAuthStore(storePath, { token: \"user-token\", userId: \"u1\" });\n  assert.equal(first.authenticateUser(\"user-token\"), \"u1\");\n\n  const { code } = first.createPairingCode(\"u1\");\n  const issued = first.exchangePairingCode(code, \"Laptop\");\n  assert.equal(first.authenticateDevice(issued.deviceToken)?.runtimeName, \"Laptop\");\n\n  const raw = readFileSync(storePath, \"utf8\");\n  assert.doesNotMatch(raw, /user-token/);\n  assert.doesNotMatch(raw, new RegExp(issued.deviceToken));\n  assert.doesNotMatch(raw, new RegExp(code));\n  const snapshot = JSON.parse(raw) as { userTokens: Array<Record<string, unknown>> };\n  assert.equal(typeof snapshot.userTokens[0]?.secretSalt, \"string\");\n  assert.equal(typeof snapshot.userTokens[0]?.secretHash, \"string\");\n  assert.equal(snapshot.userTokens[0]?.tokenHash, undefined);\n\n  const second = new FileAuthStore(storePath);\n  assert.equal(second.authenticateUser(\"user-token\"), \"u1\");\n  assert.equal(second.authenticateDevice(issued.deviceToken)?.runtimeId, issued.runtimeId);\n\n  assert.equal(second.revokeDeviceToken(issued.deviceToken), true);\n  const third = new FileAuthStore(storePath);\n  assert.equal(third.authenticateDevice(issued.deviceToken), null);\n});\n\ntest(\"file auth store preserves unexchanged pairing codes across restart\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-pairing-\"));\n  const storePath = join(dir, \"auth.json\");\n  const first = new FileAuthStore(storePath, { token: \"user-token\", userId: \"u1\" });\n  const { code } = first.createPairingCode(\"u1\");\n\n  const second = new FileAuthStore(storePath);\n  const issued = second.exchangePairingCode(code, \"Laptop\");\n  assert.equal(second.authenticateDevice(issued.deviceToken)?.runtimeName, \"Laptop\");\n});\n"]}

package/packages/cloud-mcp-gateway/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/cloud-mcp-gateway",
-  "version": "1.3.0-dev.eed73bea",
+  "version": "1.4.0-dev.5fc22c6f",
   "description": "Cloud MCP gateway for brokering remote MCP clients to local GSD runtimes",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@opengsd/mcp-server": "^1.3.0-dev.eed73bea",
+    "@opengsd/mcp-server": "^1.4.0-dev.5fc22c6f",
     "ws": "^8.20.0",
     "zod": "^4.0.0"
   },

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/contracts",
-  "version": "1.3.0-dev.eed73bea",
+  "version": "1.4.0-dev.5fc22c6f",
   "description": "Shared public contracts for GSD workspace boundaries",
   "license": "MIT",
   "gsd": {

package/packages/daemon/dist/cloud-runtime.d.ts

@@ -5,10 +5,12 @@ export declare class CloudRuntime {
     private readonly cloud;
     private readonly executor;
     private readonly logger;
+    private static readonly MAX_OUTBOX;
     private socket;
     private heartbeat;
     private reconnect;
     private readonly inFlight;
+    private outbox;
     private stopped;
     constructor(cloud: NonNullable<DaemonConfig["cloud"]>, executor: LocalToolExecutor, logger: Logger);
     start(): void;

package/packages/daemon/dist/cloud-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-runtime.d.ts","sourceRoot":"","sources":["../src/cloud-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAWlE,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAA6C;IAC9D,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,OAAO,CAAS;gBAGL,KAAK,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EACzC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,MAAM;IAGjC,KAAK,IAAI,IAAI;IAKb,IAAI,IAAI,IAAI;IAYZ,OAAO,CAAC,OAAO;IAgDf,OAAO,CAAC,gBAAgB;YAQV,mBAAmB;IAKjC,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;YAKX,iBAAiB;YAUjB,aAAa;YA6Bb,cAAc;IAqB5B,OAAO,CAAC,IAAI;CAKb"}
+{"version":3,"file":"cloud-runtime.d.ts","sourceRoot":"","sources":["../src/cloud-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAWlE,qBAAa,YAAY;IAUrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAO;IACzC,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAA6C;IAC9D,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAS;gBAGL,KAAK,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EACzC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,MAAM;IAGjC,KAAK,IAAI,IAAI;IAKb,IAAI,IAAI,IAAI;IAaZ,OAAO,CAAC,OAAO;IAgDf,OAAO,CAAC,gBAAgB;YAkBV,mBAAmB;IAKjC,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;YAKX,iBAAiB;YAUjB,aAAa;YA6Bb,cAAc;IAqB5B,OAAO,CAAC,IAAI;CAcb"}