@opengsd/gsd-pi 1.4.0 → 1.5.0

package/integrations/hermes/tests/test_new_milestone_command.py

@@ -0,0 +1,313 @@
+"""Tests for /gsd new-milestone command routing and the cross-command guards.
+
+Covers the issue #1162 design:
+- _cmd_new_milestone: input parsing (bare text, --file, empty, --auto rejected),
+  co-run guard (reject if auto RUNNING/BLOCKED), spawn + ack, help text.
+- _cmd_auto: symmetric co-run guard (reject if milestone run active).
+- _cmd_cancel: routes to cancel_milestone() when a milestone subprocess is active.
+- _cmd_reply: routes planning-blocker replies to client stdin when milestone
+  subprocess is active with a pending blocker.
+
+Async handlers are driven with asyncio.run, matching the convention in
+test_register.py.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import pytest
+
+from open_gsd_hermes.commands import GsdCommandRouter
+from open_gsd_hermes.config import GsdConfig
+from open_gsd_hermes.supervisor import SupervisorContext, SupervisorState
+from open_gsd_hermes.types import BindingContext
+
+
+def _make_router(
+    *,
+    project_dir: str | None = "/proj",
+    supervisor_state: SupervisorState = SupervisorState.IDLE,
+    milestone_active: bool = False,
+    milestone_blocker_id: str | None = None,
+) -> tuple[GsdCommandRouter, MagicMock]:
+    """Build a router with a MagicMock client + bind store for isolated testing."""
+    config = GsdConfig(default_project=project_dir)
+    client = MagicMock()
+    client.milestone_active.return_value = milestone_active
+    client.milestone_session_id.return_value = "S-1" if milestone_active else None
+    client.milestone_pending_blocker_id.return_value = milestone_blocker_id
+    bind_store = MagicMock()
+    supervisor = MagicMock()
+    notifications = MagicMock()
+
+    sup_ctx_holder: dict[str, SupervisorContext] = {
+        "ctx": SupervisorContext(
+            session_id=None,
+            project_dir=project_dir,
+            state=supervisor_state,
+        )
+    }
+
+    def get_session_key() -> str:
+        return "agent:main:cli:direct:local"
+
+    def get_binding_ctx() -> BindingContext:
+        return BindingContext(cwd=project_dir)
+
+    def get_supervisor_ctx() -> SupervisorContext:
+        return sup_ctx_holder["ctx"]
+
+    def set_supervisor_ctx(ctx: SupervisorContext) -> None:
+        sup_ctx_holder["ctx"] = ctx
+
+    def get_platform_channel() -> tuple[str | None, str | None]:
+        return "cli", "local"
+
+    router = GsdCommandRouter(
+        config,
+        client,
+        bind_store,
+        supervisor,
+        get_session_key,
+        get_binding_ctx,
+        get_supervisor_ctx,
+        set_supervisor_ctx,
+        get_platform_channel,
+        notifications,
+    )
+    return router, client
+
+
+@pytest.fixture
+def project(tmp_path: Path) -> Path:
+    """A directory that looks like a GSD project (.gsd/ present)."""
+    (tmp_path / ".gsd").mkdir()
+    return tmp_path
+
+
+def run(router: GsdCommandRouter, args: str) -> str:
+    return asyncio.run(router.handle(args))
+
+
+# ---------------------------------------------------------------------------
+# _cmd_new_milestone — input parsing & usage
+# ---------------------------------------------------------------------------
+
+
+def test_new_milestone_bare_text_passes_context_text(project: Path) -> None:
+    router, client = _make_router(project_dir=str(project))
+    result = run(router, "new-milestone Build a REST API with auth")
+    client.create_milestone.assert_called_once()
+    kwargs = client.create_milestone.call_args.kwargs
+    assert kwargs.get("context_text") == "Build a REST API with auth"
+    assert kwargs.get("context_file") is None
+    assert "started" in result.lower() or "S-1" in result
+
+
+def test_new_milestone_terminal_callback_clears_local_session_id(
+    project: Path,
+) -> None:
+    router, client = _make_router(project_dir=str(project))
+    client.create_milestone.return_value = "milestone-4242"
+
+    run(router, "new-milestone Build a REST API with auth")
+    ctx = router._get_supervisor_ctx()  # type: ignore[attr-defined]
+    ctx.pending_blocker_id = "blk-1"
+    assert ctx.session_id == "milestone-4242"
+
+    on_terminal = client.create_milestone.call_args.kwargs["on_terminal"]
+    on_terminal("complete")
+
+    ctx = router._get_supervisor_ctx()  # type: ignore[attr-defined]
+    assert ctx.state == SupervisorState.COMPLETE
+    assert ctx.session_id is None
+    assert ctx.pending_blocker_id is None
+    assert ctx.notified_terminal is True
+
+    result = run(router, "reply stale response")
+    client.resolve_blocker.assert_not_called()
+    assert "no active" in result.lower()
+
+
+def test_new_milestone_file_flag_passes_context_file(project: Path) -> None:
+    router, client = _make_router(project_dir=str(project))
+    spec = project / "spec.md"
+    spec.write_text("milestone spec", encoding="utf-8")
+    run(router, f"new-milestone --file {spec}")
+    kwargs = client.create_milestone.call_args.kwargs
+    assert kwargs.get("context_file") == str(spec)
+    assert kwargs.get("context_text") is None
+
+
+def test_new_milestone_file_flag_resolves_relative_path_from_project(
+    project: Path,
+) -> None:
+    router, client = _make_router(project_dir=str(project))
+    spec = project / "spec.md"
+    spec.write_text("milestone spec", encoding="utf-8")
+    run(router, "new-milestone --file spec.md")
+    kwargs = client.create_milestone.call_args.kwargs
+    assert kwargs.get("context_file") == str(spec)
+    assert kwargs.get("context_text") is None
+
+
+def test_new_milestone_file_flag_rejects_missing_file(project: Path) -> None:
+    router, client = _make_router(project_dir=str(project))
+    result = run(router, "new-milestone --file missing.md")
+    assert "not found" in result.lower()
+    client.create_milestone.assert_not_called()
+
+
+def test_new_milestone_empty_returns_usage(project: Path) -> None:
+    router, client = _make_router(project_dir=str(project))
+    result = run(router, "new-milestone")
+    assert "usage" in result.lower()
+    client.create_milestone.assert_not_called()
+
+
+def test_new_milestone_rejects_auto_flag(project: Path) -> None:
+    """--auto chaining is out of scope; execution stays with /gsd auto."""
+    router, client = _make_router(project_dir=str(project))
+    result = run(router, "new-milestone --auto some spec")
+    assert "auto" in result.lower()
+    client.create_milestone.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# Co-run guards (Q2 + Q9 symmetry)
+# ---------------------------------------------------------------------------
+
+
+def test_new_milestone_rejects_when_auto_running(project: Path) -> None:
+    """Co-run guard: refuse if an auto session is RUNNING or BLOCKED."""
+    router, client = _make_router(
+        project_dir=str(project),
+        supervisor_state=SupervisorState.RUNNING,
+    )
+    result = run(router, "new-milestone some spec")
+    assert "cancel" in result.lower() or "running" in result.lower()
+    client.create_milestone.assert_not_called()
+
+
+def test_new_milestone_rejects_when_auto_blocked(project: Path) -> None:
+    router, client = _make_router(
+        project_dir=str(project),
+        supervisor_state=SupervisorState.BLOCKED,
+    )
+    result = run(router, "new-milestone some spec")
+    assert "cancel" in result.lower() or "running" in result.lower()
+    client.create_milestone.assert_not_called()
+
+
+def test_new_milestone_prioritizes_milestone_guard_over_auto_state(
+    project: Path,
+) -> None:
+    """A duplicate milestone command should report the milestone guard."""
+    router, client = _make_router(
+        project_dir=str(project),
+        supervisor_state=SupervisorState.RUNNING,
+        milestone_active=True,
+    )
+    result = run(router, "new-milestone some spec")
+    assert "milestone creation is in progress" in result.lower()
+    assert "auto is running" not in result.lower()
+    client.create_milestone.assert_not_called()
+
+
+def test_new_milestone_allows_when_auto_complete(project: Path) -> None:
+    """A terminal auto state does not block milestone creation."""
+    router, client = _make_router(
+        project_dir=str(project),
+        supervisor_state=SupervisorState.COMPLETE,
+    )
+    run(router, "new-milestone some spec")
+    client.create_milestone.assert_called_once()
+
+
+def test_auto_rejects_when_milestone_active(project: Path) -> None:
+    """Symmetric guard: /gsd auto refuses if a milestone run is in progress."""
+    router, client = _make_router(
+        project_dir=str(project),
+        milestone_active=True,
+    )
+    result = run(router, "auto")
+    assert "cancel" in result.lower() or "milestone" in result.lower()
+    client.execute.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# _cmd_cancel — milestone branch
+# ---------------------------------------------------------------------------
+
+
+def test_cancel_routes_to_cancel_milestone_when_milestone_active(
+    project: Path,
+) -> None:
+    router, client = _make_router(
+        project_dir=str(project),
+        milestone_active=True,
+    )
+    run(router, "cancel")
+    client.cancel_milestone.assert_called_once()
+
+
+def test_cancel_routes_to_mcp_cancel_when_only_auto_active(project: Path) -> None:
+    """When no milestone proc is active, cancel falls back to the MCP path."""
+    router, client = _make_router(
+        project_dir=str(project),
+        supervisor_state=SupervisorState.RUNNING,
+    )
+    # Give the auto session an id so the MCP cancel-by-session path is taken
+    run(router, "cancel")
+    client.cancel_milestone.assert_not_called()
+    assert client.cancel.called or client.cancel_by_project.called
+
+
+# ---------------------------------------------------------------------------
+# _cmd_reply — milestone-blocker branch
+# ---------------------------------------------------------------------------
+
+
+def test_reply_routes_to_milestone_blocker_when_milestone_pending(
+    project: Path,
+) -> None:
+    router, client = _make_router(
+        project_dir=str(project),
+        milestone_active=True,
+        milestone_blocker_id="blk-9",
+    )
+    result = run(router, "reply use option B")
+    client.respond_to_milestone_blocker.assert_called_once_with("use option B")
+    assert "sent" in result.lower()
+
+
+def test_reply_does_not_fall_through_to_mcp_when_milestone_active_no_blocker(
+    project: Path,
+) -> None:
+    """Active milestone without a pending blocker must not hit MCP resolve_blocker."""
+    router, client = _make_router(
+        project_dir=str(project),
+        milestone_active=True,
+        milestone_blocker_id=None,
+    )
+    router._get_supervisor_ctx().session_id = "milestone-1"  # type: ignore[attr-defined]
+    result = run(router, "reply some answer")
+    client.respond_to_milestone_blocker.assert_not_called()
+    client.resolve_blocker.assert_not_called()
+    assert "no pending blocker" in result.lower()
+
+
+def test_reply_falls_back_to_mcp_when_no_milestone(project: Path) -> None:
+    """No milestone proc → existing MCP resolve_blocker path (needs a session)."""
+    router, client = _make_router(
+        project_dir=str(project),
+        supervisor_state=SupervisorState.BLOCKED,
+    )
+    # set a session id so the existing reply path doesn't short-circuit
+    router._get_supervisor_ctx().session_id = "auto-1"  # type: ignore[attr-defined]
+    run(router, "reply some answer")
+    client.respond_to_milestone_blocker.assert_not_called()
+    client.resolve_blocker.assert_called_once()

package/integrations/hermes/tests/test_supervisor_fsm.py

@@ -138,6 +138,7 @@ def test_auto_resets_session_specific_supervisor_context(tmp_path) -> None:
     )
     supervisor = MockSupervisor()
     client = MagicMock()
+    client.milestone_active.return_value = False
     client.execute.return_value = {"sessionId": "new-session"}
 
     router = GsdCommandRouter(
@@ -179,6 +180,7 @@ def test_status_returns_friendly_message_when_mcp_progress_fails(tmp_path) -> No
 def test_auto_returns_friendly_message_when_mcp_execute_fails(tmp_path) -> None:
     supervisor = MockSupervisor()
     client = MagicMock()
+    client.milestone_active.return_value = False
     client.execute.side_effect = McpProtocolError("sidecar unavailable")
     router, _project_dir, _supervisor, _ctx, _stored = build_router(
         tmp_path, client, supervisor=supervisor
@@ -193,6 +195,7 @@ def test_auto_returns_friendly_message_when_mcp_execute_fails(tmp_path) -> None:
 def test_auto_rejects_missing_session_id_in_mcp_response(tmp_path) -> None:
     supervisor = MockSupervisor()
     client = MagicMock()
+    client.milestone_active.return_value = False
     client.execute.return_value = {}
     router, _project_dir, _supervisor, ctx, _stored = build_router(
         tmp_path, client, supervisor=supervisor
@@ -209,6 +212,7 @@ def test_auto_rejects_missing_session_id_in_mcp_response(tmp_path) -> None:
 def test_cancel_stops_supervisor_when_mcp_cancel_fails(tmp_path) -> None:
     supervisor = MockSupervisor()
     client = MagicMock()
+    client.milestone_active.return_value = False
     client.cancel_by_project.side_effect = McpProtocolError("sidecar unavailable")
     router, _project_dir, _supervisor, ctx, stored = build_router(
         tmp_path, client, supervisor=supervisor
@@ -226,6 +230,7 @@ def test_cancel_sends_terminal_notification_after_successful_mcp_cancel(tmp_path
     supervisor = MockSupervisor()
     notifications = MagicMock()
     client = MagicMock()
+    client.milestone_active.return_value = False
     ctx = SupervisorContext(
         session_id="s1",
         state=SupervisorState.RUNNING,
@@ -261,6 +266,7 @@ def test_cancel_prefers_supervisor_project_for_active_session(tmp_path) -> None:
     (running_project / ".gsd").mkdir()
     supervisor = MockSupervisor()
     client = MagicMock()
+    client.milestone_active.return_value = False
     ctx = SupervisorContext(
         session_id="s1",
         project_dir=str(running_project),
@@ -291,6 +297,7 @@ def test_cancel_prefers_supervisor_project_for_active_session(tmp_path) -> None:
 def test_cancel_stops_supervisor_when_binding_resolution_fails(tmp_path) -> None:
     supervisor = MockSupervisor()
     client = MagicMock()
+    client.milestone_active.return_value = False
     ctx = SupervisorContext(
         session_id="s1",
         project_dir=str(tmp_path / "missing"),
@@ -323,6 +330,7 @@ def test_cancel_stops_supervisor_when_binding_resolution_fails(tmp_path) -> None
 
 def test_reply_returns_friendly_message_when_mcp_resolve_fails(tmp_path) -> None:
     client = MagicMock()
+    client.milestone_active.return_value = False
     client.resolve_blocker.side_effect = McpProtocolError("sidecar unavailable")
     ctx = SupervisorContext(session_id="s1", project_dir="/tmp/project")
     router, _project_dir, _supervisor, _ctx, _stored = build_router(
@@ -370,6 +378,38 @@ def test_supervisor_detects_blocker() -> None:
     assert any("blocker" in t.lower() or "Approve" in t for t in sent)
 
 
+def test_notify_blocker_prefers_title_over_generic_message() -> None:
+    sent: list[str] = []
+
+    def dispatch(_name: str, args: dict) -> None:
+        sent.append(args.get("text", ""))
+
+    notifications = NotificationService(
+        MagicMock(),
+        GsdConfig(),
+        lambda: DeliveryTarget("slack", "channel", "C123"),
+        dispatch=dispatch,
+    )
+
+    notifications.notify_blocker(
+        SessionStatus(
+            status="blocked",
+            pending_blocker={
+                "type": "extension_ui_request",
+                "method": "select",
+                "id": "sel-1",
+                "title": "Choose milestone scope",
+                "message": "Action required",
+                "options": ["A", "B"],
+            },
+        )
+    )
+
+    assert len(sent) == 1
+    assert "GSD blocker: Choose milestone scope" in sent[0]
+    assert "GSD blocker: Action required" not in sent[0]
+
+
 def test_supervisor_terminal_tick_updates_progress_before_stopping() -> None:
     ctx = SupervisorContext(
         session_id="s1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-pi",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "GSD Pi local-first coding agent",
   "license": "MIT",
   "repository": {
@@ -77,7 +77,7 @@
     "baseline:refactor:phase0": "pnpm run baseline:refactor:gate && node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/derive-state-db.test.ts src/resources/extensions/gsd/tests/single-writer-invariant.test.ts src/resources/extensions/gsd/tests/auto-recovery.test.ts src/resources/extensions/gsd/tests/auto-worktree-registry.test.ts",
     "legacy:cleanup:gate": "node scripts/legacy-cleanup-gate.mjs",
     "legacy:cleanup:evidence": "node scripts/legacy-cleanup-evidence.mjs",
-    "test:unit:compiled": "node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test-reporter=./scripts/test-reporter-compact.mjs --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
+    "test:unit:compiled": "node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test-reporter=./scripts/test-reporter-compact.mjs --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/cursor-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
     "test:unit": "pnpm run test:compile && pnpm run test:unit:compiled",
     "test:changed:src": "node scripts/verify-changed-src-tests.mjs",
     "test:packages": "pnpm run test:compile && pnpm run test:packages:compiled",
@@ -123,7 +123,7 @@
     "audit:test-gaps": "node scripts/audit-test-gaps.mjs",
     "audit:test-matrix": "node scripts/audit-test-matrix.mjs",
     "test:evaluation": "node scripts/run-test-evaluation.mjs",
-    "test:coverage:unit": "cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/unit --temp-directory=coverage/.tmp-unit --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --exclude=\"**/test/**\" --all node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
+    "test:coverage:unit": "cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/unit --temp-directory=coverage/.tmp-unit --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --exclude=\"**/test/**\" --all node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/cursor-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
     "test:coverage:integration": "pnpm exec playwright install chromium && cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/integration --temp-directory=coverage/.tmp-integration --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --all node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test --test-timeout=180000 \"src/tests/integration/*.test.ts\" \"src/resources/extensions/gsd/tests/integration/*.test.ts\" \"src/resources/extensions/async-jobs/*.test.ts\" \"src/resources/extensions/ollama/**/*.test.ts\" \"src/resources/extensions/ollama/*.test.ts\" \"src/resources/extensions/search-the-web/tests/*.test.ts\" \"src/resources/extensions/bg-shell/tests/*.test.ts\" \"src/resources/extensions/slash-commands/tests/*.test.ts\" \"src/resources/extensions/browser-tools/tests/*.test.mjs\"",
     "test:coverage:packages": "node scripts/run-coverage-packages.mjs",
     "test:coverage:merge": "node scripts/merge-coverage-reports.mjs",
@@ -210,11 +210,11 @@
   },
   "optionalDependencies": {
     "@mariozechner/clipboard": "0.3.6",
-    "@opengsd/engine-darwin-arm64": "1.4.0",
-    "@opengsd/engine-darwin-x64": "1.4.0",
-    "@opengsd/engine-linux-arm64-gnu": "1.4.0",
-    "@opengsd/engine-linux-x64-gnu": "1.4.0",
-    "@opengsd/engine-win32-x64-msvc": "1.4.0",
+    "@opengsd/engine-darwin-arm64": "1.5.0",
+    "@opengsd/engine-darwin-x64": "1.5.0",
+    "@opengsd/engine-linux-arm64-gnu": "1.5.0",
+    "@opengsd/engine-linux-x64-gnu": "1.5.0",
+    "@opengsd/engine-win32-x64-msvc": "1.5.0",
     "fsevents": "~2.3.3",
     "koffi": "^2.9.0"
   },

package/packages/cloud-mcp-gateway/dist/auth-store.d.ts

@@ -46,6 +46,7 @@ export declare class InMemoryAuthStore {
     revokeDeviceToken(deviceToken: string): boolean;
     snapshot(): AuthStoreSnapshot;
     protected afterMutation(): void;
+    private sweepExpiredPairingCodes;
     private loadSnapshot;
 }
 export declare class FileAuthStore extends InMemoryAuthStore {

package/packages/cloud-mcp-gateway/dist/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;IACtD,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;IAC1D,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,SAAS,CAAC,QAAQ,CAAC,UAAU,kDAAyD;IACtF,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;IAC1F,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;gBAE9E,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,CAAC,EAAE,iBAAiB;IAK3F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQjD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAO1D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI;IAOvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAiB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAS9F,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAkBzE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAQ/C,QAAQ,IAAI,iBAAiB;IAS7B,SAAS,CAAC,aAAa,IAAI,IAAI;IAI/B,OAAO,CAAC,YAAY;CAarB;AAED,qBAAa,aAAc,SAAQ,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGhC,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;cAQhC,aAAa,IAAI,IAAI;IAIxC,OAAO,CAAC,OAAO;CAMhB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,SAAkC,GAAG,gBAAgB,CAK/G"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;IACtD,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;IAC1D,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,SAAS,CAAC,QAAQ,CAAC,UAAU,kDAAyD;IACtF,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;IAC1F,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;gBAE9E,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,CAAC,EAAE,iBAAiB;IAK3F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQjD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAO1D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI;IAOvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAiB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAkB9F,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAmBzE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAQ/C,QAAQ,IAAI,iBAAiB;IAS7B,SAAS,CAAC,aAAa,IAAI,IAAI;IAO/B,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,YAAY;CAarB;AAED,qBAAa,aAAc,SAAQ,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGhC,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;cAQhC,aAAa,IAAI,IAAI;IAIxC,OAAO,CAAC,OAAO;CAMhB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,SAAkC,GAAG,gBAAgB,CAK/G"}

package/packages/cloud-mcp-gateway/dist/auth-store.js

@@ -36,7 +36,17 @@ export class InMemoryAuthStore {
         return record;
     }
     createPairingCode(userId, ttlMs = 10 * 60 * 1000) {
-        const code = randomBytes(4).toString("hex").toUpperCase();
+        this.sweepExpiredPairingCodes();
+        // One live pairing code per user: a new code invalidates any prior un-redeemed
+        // one, so the guessable set never grows beyond a single code per user (and the
+        // per-exchange scrypt cost stays bounded).
+        for (const [hash, record] of this.pairingCodes) {
+            if (record.userId === userId)
+                this.pairingCodes.delete(hash);
+        }
+        // 64 bits of entropy (16 hex chars). Endpoint-level request rate limiting is the
+        // complementary defense and belongs at the HTTP layer, not here.
+        const code = randomBytes(8).toString("hex").toUpperCase();
         const expiresAt = Date.now() + ttlMs;
         const key = deriveSecretHash(code);
         this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });
@@ -44,6 +54,7 @@ export class InMemoryAuthStore {
         return { code, expiresAt };
     }
     exchangePairingCode(code, runtimeName) {
+        this.sweepExpiredPairingCodes();
         const normalized = code.trim().toUpperCase();
         const codeEntry = findSecretEntry(this.pairingCodes, normalized);
         if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {
@@ -80,6 +91,15 @@ export class InMemoryAuthStore {
     afterMutation() {
         // Extension point for persistent stores.
     }
+    // Drop expired pairing codes so a long-lived gateway does not accumulate codes
+    // that were generated but never redeemed. Best-effort: callers persist via their
+    // own afterMutation() after the create/exchange that triggered the sweep.
+    sweepExpiredPairingCodes(now = Date.now()) {
+        for (const [hash, record] of this.pairingCodes) {
+            if (record.expiresAt < now)
+                this.pairingCodes.delete(hash);
+        }
+    }
     loadSnapshot(snapshot) {
         for (const record of snapshot.userTokens ?? []) {
             this.userTokens.set(record.secretHash, record);

package/packages/cloud-mcp-gateway/dist/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,MAAM,OAAO,iBAAiB;IACT,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE1F,YAAY,aAAiD,EAAE,QAA4B;QACzF,IAAI,QAAQ;YAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO;QAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,gBAAgB,CAAC,KAAyB;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,kBAAkB,CAAC,KAAyB;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,mBAAmB,CAAC,IAAY,EAAE,WAAoB;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,IAAI,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACpD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAES,aAAa;QACrB,yCAAyC;IAC3C,CAAC;IAEO,YAAY,CAAC,QAA2B;QAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,iBAAiB;IACjC,QAAQ,CAAS;IAElC,YACE,QAAgB,EAChB,aAAiD;QAEjD,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAChE,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEjF,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEzE,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM;QAC1C,UAAU,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC3F,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAA6B,OAAuB,EAAE,MAAc;IAC3F,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAA6B,OAAuB,EAAE,MAAc;IAC1F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAAwB,EAAE,MAAc;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA+B,CAAC;QACxF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAA6C,CAAC,CAAC,CAAC,EAAE;YACxG,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;YAChH,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;SACjH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\n\nexport interface UserTokenRecord {\n  userId: string;\n  revoked?: boolean;\n}\n\nexport interface DeviceTokenRecord {\n  userId: string;\n  runtimeId: string;\n  runtimeName?: string;\n  revoked?: boolean;\n}\n\nexport interface PairingCodeRecord {\n  userId: string;\n  expiresAt: number;\n}\n\nexport interface DeviceTokenIssue {\n  userId: string;\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport interface AuthStoreSnapshot {\n  version: 1;\n  userTokens: Array<UserTokenRecord & SecretHashRecord>;\n  deviceTokens: Array<DeviceTokenRecord & SecretHashRecord>;\n  pairingCodes: Array<PairingCodeRecord & SecretHashRecord>;\n}\n\nexport interface SecretHashRecord {\n  secretHash: string;\n  secretSalt: string;\n}\n\nexport class InMemoryAuthStore {\n  protected readonly userTokens = new Map<string, UserTokenRecord & SecretHashRecord>();\n  protected readonly deviceTokens = new Map<string, DeviceTokenRecord & SecretHashRecord>();\n  protected readonly pairingCodes = new Map<string, PairingCodeRecord & SecretHashRecord>();\n\n  constructor(seedUserToken?: { token: string; userId: string }, snapshot?: AuthStoreSnapshot) {\n    if (snapshot) this.loadSnapshot(snapshot);\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n  }\n\n  addUserToken(token: string, userId: string): void {\n    const existing = findSecretRecord(this.userTokens, token);\n    if (existing?.userId === userId && !existing.revoked) return;\n    const key = deriveSecretHash(token);\n    this.userTokens.set(key.secretHash, { ...key, userId });\n    this.afterMutation();\n  }\n\n  authenticateUser(token: string | undefined): string | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.userTokens, token);\n    if (!record || record.revoked) return null;\n    return record.userId;\n  }\n\n  authenticateDevice(token: string | undefined): DeviceTokenRecord | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.deviceTokens, token);\n    if (!record || record.revoked) return null;\n    return record;\n  }\n\n  createPairingCode(userId: string, ttlMs = 10 * 60 * 1000): { code: string; expiresAt: number } {\n    const code = randomBytes(4).toString(\"hex\").toUpperCase();\n    const expiresAt = Date.now() + ttlMs;\n    const key = deriveSecretHash(code);\n    this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });\n    this.afterMutation();\n    return { code, expiresAt };\n  }\n\n  exchangePairingCode(code: string, runtimeName?: string): DeviceTokenIssue {\n    const normalized = code.trim().toUpperCase();\n    const codeEntry = findSecretEntry(this.pairingCodes, normalized);\n    if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {\n      if (codeEntry) this.pairingCodes.delete(codeEntry[0]);\n      this.afterMutation();\n      throw new Error(\"Pairing code is invalid or expired\");\n    }\n    const [codeHash, record] = codeEntry;\n    this.pairingCodes.delete(codeHash);\n    const runtimeId = `rt_${randomUUID()}`;\n    const deviceToken = `gsd_dev_${randomBytes(32).toString(\"hex\")}`;\n    const key = deriveSecretHash(deviceToken);\n    this.deviceTokens.set(key.secretHash, { ...key, userId: record.userId, runtimeId, runtimeName });\n    this.afterMutation();\n    return { userId: record.userId, runtimeId, deviceToken };\n  }\n\n  revokeDeviceToken(deviceToken: string): boolean {\n    const record = findSecretRecord(this.deviceTokens, deviceToken);\n    if (!record) return false;\n    record.revoked = true;\n    this.afterMutation();\n    return true;\n  }\n\n  snapshot(): AuthStoreSnapshot {\n    return {\n      version: 1,\n      userTokens: Array.from(this.userTokens.values()),\n      deviceTokens: Array.from(this.deviceTokens.values()),\n      pairingCodes: Array.from(this.pairingCodes.values()),\n    };\n  }\n\n  protected afterMutation(): void {\n    // Extension point for persistent stores.\n  }\n\n  private loadSnapshot(snapshot: AuthStoreSnapshot): void {\n    for (const record of snapshot.userTokens ?? []) {\n      this.userTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.deviceTokens ?? []) {\n      this.deviceTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.pairingCodes ?? []) {\n      if (record.expiresAt >= Date.now()) {\n        this.pairingCodes.set(record.secretHash, record);\n      }\n    }\n  }\n}\n\nexport class FileAuthStore extends InMemoryAuthStore {\n  private readonly filePath: string;\n\n  constructor(\n    filePath: string,\n    seedUserToken?: { token: string; userId: string },\n  ) {\n    super(undefined, readSnapshot(filePath));\n    this.filePath = filePath;\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n    this.persist();\n  }\n\n  protected override afterMutation(): void {\n    this.persist();\n  }\n\n  private persist(): void {\n    mkdirSync(dirname(this.filePath), { recursive: true });\n    const tmp = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;\n    writeFileSync(tmp, `${JSON.stringify(this.snapshot(), null, 2)}\\n`, { encoding: \"utf8\", mode: 0o600 });\n    renameSync(tmp, this.filePath);\n  }\n}\n\nexport function extractBearerToken(header: string | string[] | undefined): string | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || value.length <= \"Bearer \".length) return undefined;\n  if (value.slice(0, \"Bearer\".length).toLowerCase() !== \"bearer\") return undefined;\n\n  const firstSeparator = value.charCodeAt(\"Bearer\".length);\n  if (firstSeparator !== 0x20 && firstSeparator !== 0x09) return undefined;\n\n  let tokenStart = \"Bearer\".length + 1;\n  while (tokenStart < value.length) {\n    const char = value.charCodeAt(tokenStart);\n    if (char !== 0x20 && char !== 0x09) break;\n    tokenStart += 1;\n  }\n\n  return tokenStart < value.length ? value.slice(tokenStart) : undefined;\n}\n\nexport function deriveSecretHash(secret: string, secretSalt = randomBytes(16).toString(\"hex\")): SecretHashRecord {\n  return {\n    secretHash: scryptSync(secret, secretSalt, 32).toString(\"hex\"),\n    secretSalt,\n  };\n}\n\nfunction findSecretRecord<T extends SecretHashRecord>(records: Map<string, T>, secret: string): T | undefined {\n  return findSecretEntry(records, secret)?.[1];\n}\n\nfunction findSecretEntry<T extends SecretHashRecord>(records: Map<string, T>, secret: string): [string, T] | undefined {\n  for (const entry of records) {\n    if (secretMatches(entry[1], secret)) return entry;\n  }\n  return undefined;\n}\n\nfunction secretMatches(record: SecretHashRecord, secret: string): boolean {\n  const candidate = Buffer.from(deriveSecretHash(secret, record.secretSalt).secretHash, \"hex\");\n  const expected = Buffer.from(record.secretHash, \"hex\");\n  return candidate.length === expected.length && timingSafeEqual(candidate, expected);\n}\n\nfunction readSnapshot(filePath: string): AuthStoreSnapshot | undefined {\n  try {\n    const parsed = JSON.parse(readFileSync(filePath, \"utf8\")) as Partial<AuthStoreSnapshot>;\n    if (parsed.version !== 1) return undefined;\n    return {\n      version: 1,\n      userTokens: Array.isArray(parsed.userTokens) ? parsed.userTokens as AuthStoreSnapshot[\"userTokens\"] : [],\n      deviceTokens: Array.isArray(parsed.deviceTokens) ? parsed.deviceTokens as AuthStoreSnapshot[\"deviceTokens\"] : [],\n      pairingCodes: Array.isArray(parsed.pairingCodes) ? parsed.pairingCodes as AuthStoreSnapshot[\"pairingCodes\"] : [],\n    };\n  } catch {\n    return undefined;\n  }\n}\n"]}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,MAAM,OAAO,iBAAiB;IACT,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE1F,YAAY,aAAiD,EAAE,QAA4B;QACzF,IAAI,QAAQ;YAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO;QAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,gBAAgB,CAAC,KAAyB;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,kBAAkB,CAAC,KAAyB;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACtD,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,+EAA+E;QAC/E,+EAA+E;QAC/E,2CAA2C;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,iFAAiF;QACjF,iEAAiE;QACjE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,mBAAmB,CAAC,IAAY,EAAE,WAAoB;QACpD,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,IAAI,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACpD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAES,aAAa;QACrB,yCAAyC;IAC3C,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,0EAA0E;IAClE,wBAAwB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAA2B;QAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,iBAAiB;IACjC,QAAQ,CAAS;IAElC,YACE,QAAgB,EAChB,aAAiD;QAEjD,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAChE,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEjF,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEzE,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM;QAC1C,UAAU,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC3F,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAA6B,OAAuB,EAAE,MAAc;IAC3F,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAA6B,OAAuB,EAAE,MAAc;IAC1F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAAwB,EAAE,MAAc;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA+B,CAAC;QACxF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAA6C,CAAC,CAAC,CAAC,EAAE;YACxG,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;YAChH,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;SACjH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\n\nexport interface UserTokenRecord {\n  userId: string;\n  revoked?: boolean;\n}\n\nexport interface DeviceTokenRecord {\n  userId: string;\n  runtimeId: string;\n  runtimeName?: string;\n  revoked?: boolean;\n}\n\nexport interface PairingCodeRecord {\n  userId: string;\n  expiresAt: number;\n}\n\nexport interface DeviceTokenIssue {\n  userId: string;\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport interface AuthStoreSnapshot {\n  version: 1;\n  userTokens: Array<UserTokenRecord & SecretHashRecord>;\n  deviceTokens: Array<DeviceTokenRecord & SecretHashRecord>;\n  pairingCodes: Array<PairingCodeRecord & SecretHashRecord>;\n}\n\nexport interface SecretHashRecord {\n  secretHash: string;\n  secretSalt: string;\n}\n\nexport class InMemoryAuthStore {\n  protected readonly userTokens = new Map<string, UserTokenRecord & SecretHashRecord>();\n  protected readonly deviceTokens = new Map<string, DeviceTokenRecord & SecretHashRecord>();\n  protected readonly pairingCodes = new Map<string, PairingCodeRecord & SecretHashRecord>();\n\n  constructor(seedUserToken?: { token: string; userId: string }, snapshot?: AuthStoreSnapshot) {\n    if (snapshot) this.loadSnapshot(snapshot);\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n  }\n\n  addUserToken(token: string, userId: string): void {\n    const existing = findSecretRecord(this.userTokens, token);\n    if (existing?.userId === userId && !existing.revoked) return;\n    const key = deriveSecretHash(token);\n    this.userTokens.set(key.secretHash, { ...key, userId });\n    this.afterMutation();\n  }\n\n  authenticateUser(token: string | undefined): string | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.userTokens, token);\n    if (!record || record.revoked) return null;\n    return record.userId;\n  }\n\n  authenticateDevice(token: string | undefined): DeviceTokenRecord | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.deviceTokens, token);\n    if (!record || record.revoked) return null;\n    return record;\n  }\n\n  createPairingCode(userId: string, ttlMs = 10 * 60 * 1000): { code: string; expiresAt: number } {\n    this.sweepExpiredPairingCodes();\n    // One live pairing code per user: a new code invalidates any prior un-redeemed\n    // one, so the guessable set never grows beyond a single code per user (and the\n    // per-exchange scrypt cost stays bounded).\n    for (const [hash, record] of this.pairingCodes) {\n      if (record.userId === userId) this.pairingCodes.delete(hash);\n    }\n    // 64 bits of entropy (16 hex chars). Endpoint-level request rate limiting is the\n    // complementary defense and belongs at the HTTP layer, not here.\n    const code = randomBytes(8).toString(\"hex\").toUpperCase();\n    const expiresAt = Date.now() + ttlMs;\n    const key = deriveSecretHash(code);\n    this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });\n    this.afterMutation();\n    return { code, expiresAt };\n  }\n\n  exchangePairingCode(code: string, runtimeName?: string): DeviceTokenIssue {\n    this.sweepExpiredPairingCodes();\n    const normalized = code.trim().toUpperCase();\n    const codeEntry = findSecretEntry(this.pairingCodes, normalized);\n    if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {\n      if (codeEntry) this.pairingCodes.delete(codeEntry[0]);\n      this.afterMutation();\n      throw new Error(\"Pairing code is invalid or expired\");\n    }\n    const [codeHash, record] = codeEntry;\n    this.pairingCodes.delete(codeHash);\n    const runtimeId = `rt_${randomUUID()}`;\n    const deviceToken = `gsd_dev_${randomBytes(32).toString(\"hex\")}`;\n    const key = deriveSecretHash(deviceToken);\n    this.deviceTokens.set(key.secretHash, { ...key, userId: record.userId, runtimeId, runtimeName });\n    this.afterMutation();\n    return { userId: record.userId, runtimeId, deviceToken };\n  }\n\n  revokeDeviceToken(deviceToken: string): boolean {\n    const record = findSecretRecord(this.deviceTokens, deviceToken);\n    if (!record) return false;\n    record.revoked = true;\n    this.afterMutation();\n    return true;\n  }\n\n  snapshot(): AuthStoreSnapshot {\n    return {\n      version: 1,\n      userTokens: Array.from(this.userTokens.values()),\n      deviceTokens: Array.from(this.deviceTokens.values()),\n      pairingCodes: Array.from(this.pairingCodes.values()),\n    };\n  }\n\n  protected afterMutation(): void {\n    // Extension point for persistent stores.\n  }\n\n  // Drop expired pairing codes so a long-lived gateway does not accumulate codes\n  // that were generated but never redeemed. Best-effort: callers persist via their\n  // own afterMutation() after the create/exchange that triggered the sweep.\n  private sweepExpiredPairingCodes(now = Date.now()): void {\n    for (const [hash, record] of this.pairingCodes) {\n      if (record.expiresAt < now) this.pairingCodes.delete(hash);\n    }\n  }\n\n  private loadSnapshot(snapshot: AuthStoreSnapshot): void {\n    for (const record of snapshot.userTokens ?? []) {\n      this.userTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.deviceTokens ?? []) {\n      this.deviceTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.pairingCodes ?? []) {\n      if (record.expiresAt >= Date.now()) {\n        this.pairingCodes.set(record.secretHash, record);\n      }\n    }\n  }\n}\n\nexport class FileAuthStore extends InMemoryAuthStore {\n  private readonly filePath: string;\n\n  constructor(\n    filePath: string,\n    seedUserToken?: { token: string; userId: string },\n  ) {\n    super(undefined, readSnapshot(filePath));\n    this.filePath = filePath;\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n    this.persist();\n  }\n\n  protected override afterMutation(): void {\n    this.persist();\n  }\n\n  private persist(): void {\n    mkdirSync(dirname(this.filePath), { recursive: true });\n    const tmp = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;\n    writeFileSync(tmp, `${JSON.stringify(this.snapshot(), null, 2)}\\n`, { encoding: \"utf8\", mode: 0o600 });\n    renameSync(tmp, this.filePath);\n  }\n}\n\nexport function extractBearerToken(header: string | string[] | undefined): string | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || value.length <= \"Bearer \".length) return undefined;\n  if (value.slice(0, \"Bearer\".length).toLowerCase() !== \"bearer\") return undefined;\n\n  const firstSeparator = value.charCodeAt(\"Bearer\".length);\n  if (firstSeparator !== 0x20 && firstSeparator !== 0x09) return undefined;\n\n  let tokenStart = \"Bearer\".length + 1;\n  while (tokenStart < value.length) {\n    const char = value.charCodeAt(tokenStart);\n    if (char !== 0x20 && char !== 0x09) break;\n    tokenStart += 1;\n  }\n\n  return tokenStart < value.length ? value.slice(tokenStart) : undefined;\n}\n\nexport function deriveSecretHash(secret: string, secretSalt = randomBytes(16).toString(\"hex\")): SecretHashRecord {\n  return {\n    secretHash: scryptSync(secret, secretSalt, 32).toString(\"hex\"),\n    secretSalt,\n  };\n}\n\nfunction findSecretRecord<T extends SecretHashRecord>(records: Map<string, T>, secret: string): T | undefined {\n  return findSecretEntry(records, secret)?.[1];\n}\n\nfunction findSecretEntry<T extends SecretHashRecord>(records: Map<string, T>, secret: string): [string, T] | undefined {\n  for (const entry of records) {\n    if (secretMatches(entry[1], secret)) return entry;\n  }\n  return undefined;\n}\n\nfunction secretMatches(record: SecretHashRecord, secret: string): boolean {\n  const candidate = Buffer.from(deriveSecretHash(secret, record.secretSalt).secretHash, \"hex\");\n  const expected = Buffer.from(record.secretHash, \"hex\");\n  return candidate.length === expected.length && timingSafeEqual(candidate, expected);\n}\n\nfunction readSnapshot(filePath: string): AuthStoreSnapshot | undefined {\n  try {\n    const parsed = JSON.parse(readFileSync(filePath, \"utf8\")) as Partial<AuthStoreSnapshot>;\n    if (parsed.version !== 1) return undefined;\n    return {\n      version: 1,\n      userTokens: Array.isArray(parsed.userTokens) ? parsed.userTokens as AuthStoreSnapshot[\"userTokens\"] : [],\n      deviceTokens: Array.isArray(parsed.deviceTokens) ? parsed.deviceTokens as AuthStoreSnapshot[\"deviceTokens\"] : [],\n      pairingCodes: Array.isArray(parsed.pairingCodes) ? parsed.pairingCodes as AuthStoreSnapshot[\"pairingCodes\"] : [],\n    };\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/packages/cloud-mcp-gateway/dist/auth-store.test.js

@@ -22,6 +22,40 @@ test("pairing code is one-time use", () => {
     auth.exchangePairingCode(code);
     assert.throws(() => auth.exchangePairingCode(code), /invalid or expired/);
 });
+test("pairing code has 64 bits of entropy (16 hex chars)", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    const { code } = auth.createPairingCode("u1");
+    assert.match(code, /^[0-9A-F]{16}$/);
+});
+test("a new pairing code invalidates the user's prior un-redeemed code", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    const { code: first } = auth.createPairingCode("u1");
+    const { code: second } = auth.createPairingCode("u1");
+    assert.notEqual(first, second);
+    assert.throws(() => auth.exchangePairingCode(first), /invalid or expired/);
+    // The newest code still works.
+    const issued = auth.exchangePairingCode(second);
+    assert.equal(typeof issued.deviceToken, "string");
+});
+test("codes for different users coexist", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    auth.addUserToken("user-token-2", "u2");
+    const { code: c1 } = auth.createPairingCode("u1");
+    const { code: c2 } = auth.createPairingCode("u2");
+    assert.equal(auth.exchangePairingCode(c1).userId, "u1");
+    assert.equal(auth.exchangePairingCode(c2).userId, "u2");
+});
+test("expired pairing codes are swept on the next create/exchange", () => {
+    const auth = new InMemoryAuthStore({ token: "user-token", userId: "u1" });
+    // Create an already-expired code for u2 (negative ttl), then a fresh code for u1.
+    auth.addUserToken("user-token-2", "u2");
+    const { code: stale } = auth.createPairingCode("u2", -1);
+    auth.createPairingCode("u1"); // triggers the sweep
+    const snapshot = auth.snapshot();
+    // Only u1's live code remains; the expired u2 code was swept.
+    assert.equal(snapshot.pairingCodes.length, 1);
+    assert.throws(() => auth.exchangePairingCode(stale), /invalid or expired/);
+});
 test("extractBearerToken parses bearer auth header", () => {
     assert.equal(extractBearerToken("Bearer abc"), "abc");
     assert.equal(extractBearerToken("bearer abc"), "abc");