@opengsd/gsd-pi 1.8.1 → 1.9.0

package/dist/web/standalone/node_modules/node-pty/build/pty.target.mk

@@ -42,13 +42,13 @@ CFLAGS_CC_Debug := \
 	-std=gnu++20
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/24.13.0/include/node \
-	-I/home/runner/.cache/node-gyp/24.13.0/src \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/zlib \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/v8/include \
+	-I/home/runner/.cache/node-gyp/24.18.0/include/node \
+	-I/home/runner/.cache/node-gyp/24.18.0/src \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/zlib \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/v8/include \
 	-I$(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api
 
 DEFS_Release := \
@@ -89,13 +89,13 @@ CFLAGS_CC_Release := \
 	-std=gnu++20
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/24.13.0/include/node \
-	-I/home/runner/.cache/node-gyp/24.13.0/src \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/zlib \
-	-I/home/runner/.cache/node-gyp/24.13.0/deps/v8/include \
+	-I/home/runner/.cache/node-gyp/24.18.0/include/node \
+	-I/home/runner/.cache/node-gyp/24.18.0/src \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/zlib \
+	-I/home/runner/.cache/node-gyp/24.18.0/deps/v8/include \
 	-I$(srcdir)/../../../node-addon-api@7.1.1/node_modules/node-addon-api
 
 OBJS := \

package/dist/web/standalone/package.json

@@ -65,7 +65,6 @@
     "react-hook-form": "^7.54.1",
     "react-markdown": "^10.1.0",
     "react-resizable-panels": "^2.1.7",
-    "recharts": "2.15.0",
     "remark-gfm": "^4.0.1",
     "shiki": "^4.0.2",
     "sonner": "^1.7.1",

package/dist/web-mode.js

@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 import { execFile, spawn } from 'node:child_process';
 import { closeSync, existsSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { request as httpRequest } from 'node:http';
-import { createServer } from 'node:net';
+import { createServer, isIP } from 'node:net';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -250,6 +250,10 @@ function emitLaunchStatus(stderr, status) {
 function isWebNoAuthEnabled(env) {
     return env.GSD_WEB_NO_AUTH === '1';
 }
+function isLoopbackHost(host) {
+    const h = host.trim().toLowerCase();
+    return h === '127.0.0.1' || h === 'localhost' || h === '::1' || h === '[::1]' || (isIP(h) === 4 && h.startsWith('127.'));
+}
 function buildSpawnSpec(resolution, host, port, platform, execPath) {
     if (resolution.kind === 'packaged-standalone') {
         return {
@@ -452,13 +456,37 @@ export async function launchWebMode(options, deps = {}) {
         return failure;
     }
     stderr.write(`[gsd] Starting web mode…\n`);
+    const baseEnv = deps.env ?? process.env;
+    const noAuth = options.noAuth ?? isWebNoAuthEnabled(baseEnv);
+    if (noAuth && !isLoopbackHost(host) && baseEnv.GSD_WEB_ALLOW_UNAUTHENTICATED_LAN !== '1') {
+        const failure = {
+            mode: 'web',
+            ok: false,
+            cwd: options.cwd,
+            projectSessionsDir: options.projectSessionsDir,
+            host,
+            port: null,
+            url: null,
+            hostKind: 'unresolved',
+            hostPath: null,
+            hostRoot: null,
+            failureReason: `refusing to disable auth on non-loopback host ${host}: this exposes terminal and file APIs to the network. Bind to 127.0.0.1, keep token auth on, or set GSD_WEB_ALLOW_UNAUTHENTICATED_LAN=1 to override.`,
+            candidates: [],
+        };
+        emitLaunchStatus(stderr, failure);
+        return failure;
+    }
     // Kill any stale server instance for this project before reserving a port.
     // This prevents EADDRINUSE when the previous `gsd --web` was terminated
     // without a clean shutdown (e.g. terminal closed, crash).
+    //
+    // Keep this AFTER the no-auth interlock above: cleanup kills and unregisters
+    // the existing web server for this cwd, so running it before a refused launch
+    // would tear down a healthy server and leave the project with none. The
+    // interlock must have no side effects. (regression guard: see the "refusal
+    // does not clean up an existing instance" test)
     cleanupStaleInstance(options.cwd, stderr, deps.registryPath);
     const port = options.port ?? await (deps.resolvePort ?? reserveWebPort)(host);
-    const baseEnv = deps.env ?? process.env;
-    const noAuth = options.noAuth ?? isWebNoAuthEnabled(baseEnv);
     const authToken = noAuth ? null : randomBytes(32).toString('hex');
     const url = `http://${host}:${port}`;
     const env = {

package/integrations/hermes/open_gsd_hermes/gsd_client.py

@@ -215,7 +215,7 @@ class GsdMcpClient:
                 "params": {
                     "protocolVersion": "2024-11-05",
                     "capabilities": {},
-                    "clientInfo": {"name": "open-gsd-hermes", "version": "1.8.1"},
+                    "clientInfo": {"name": "open-gsd-hermes", "version": "1.9.0"},
                 },
             }
         )

package/integrations/hermes/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "open-gsd-hermes"
-version = "1.8.1"
+version = "1.9.0"
 description = "Hermes Agent plugin — GSD structured delivery engine integration"
 readme = "README.md"
 license = { text = "MIT" }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-pi",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "GSD Pi local-first coding agent",
   "license": "MIT",
   "repository": {
@@ -62,7 +62,8 @@
     "build:mcp-server": "pnpm --filter @opengsd/mcp-server run build",
     "build:daemon": "pnpm --filter @opengsd/daemon run build",
     "build:cloud-mcp-gateway": "pnpm --filter @opengsd/cloud-mcp-gateway run build",
-    "build:core": "pnpm run build:contracts && pnpm run build:pi && pnpm run build:rpc-client && pnpm run build:mcp-server && pnpm run build:daemon && pnpm run build:cloud-mcp-gateway && tsc && pnpm run copy-resources && pnpm run copy-themes && pnpm run copy-export-html",
+    "build:gsd-cloud": "pnpm --filter @opengsd/gsd-cloud run build",
+    "build:core": "pnpm run build:contracts && pnpm run build:pi && pnpm run build:rpc-client && pnpm run build:mcp-server && pnpm run build:daemon && pnpm run build:cloud-mcp-gateway && pnpm run build:gsd-cloud && tsc && pnpm run copy-resources && pnpm run copy-themes && pnpm run copy-export-html",
     "build": "pnpm run build:core && node scripts/build-web-if-stale.cjs",
     "stage:web-host": "node scripts/stage-web-standalone.cjs",
     "build:web-host": "cross-env NODE_ENV=production pnpm --filter gsd-web run build && pnpm run stage:web-host",
@@ -82,13 +83,14 @@
     "test:changed:src": "node scripts/verify-changed-src-tests.mjs",
     "test:packages": "pnpm run test:compile && pnpm run test:packages:compiled",
     "test:packages:compiled": "node scripts/run-package-tests.cjs",
+    "test:cloud-packages": "pnpm --filter @opengsd/gsd-cloud run test && pnpm --filter @opengsd/cloud-mcp-gateway run test && pnpm --filter @opengsd/daemon run test",
     "verify:workspace-coverage": "node scripts/verify-workspace-coverage.cjs",
     "verify:pi-boundary": "node scripts/verify-pi-boundary.cjs && bash scripts/check-mcp-bridge-boundary.sh",
     "verify:pi-patches": "node scripts/verify-pi-patches.cjs",
     "test:pi-claude-schemas": "pnpm exec vitest run packages/pi-ai/test/google-shared-convert-tools.test.ts && node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/claude-tool-schema-golden.test.ts",
     "test:marketplace": "node scripts/with-env.mjs GSD_TEST_CLONE_MARKETPLACES=1 -- node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/resources/extensions/gsd/tests/claude-import-tui.test.ts src/resources/extensions/gsd/tests/plugin-importer-live.test.ts src/tests/marketplace-discovery.test.ts",
     "test:coverage": "cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=text --reporter=lcov --exclude=\"src/resources/extensions/gsd/tests/**\" --exclude=\"src/tests/**\" --exclude=\"scripts/**\" --exclude=\"native/**\" --exclude=\"node_modules/**\" --check-coverage --statements=40 --lines=40 --branches=20 --functions=20 node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --experimental-test-isolation=process --test src/resources/extensions/gsd/tests/*.test.ts src/resources/extensions/gsd/tests/*.test.mjs src/tests/*.test.ts src/resources/extensions/shared/tests/*.test.ts",
-    "test:integration": "node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test --test-timeout=180000 \"src/tests/integration/*.test.ts\" \"src/resources/extensions/gsd/tests/integration/*.test.ts\" \"src/resources/extensions/async-jobs/*.test.ts\" \"src/resources/extensions/ollama/**/*.test.ts\" \"src/resources/extensions/ollama/*.test.ts\" \"src/resources/extensions/search-the-web/tests/*.test.ts\" \"src/resources/extensions/bg-shell/tests/*.test.ts\" \"src/resources/extensions/slash-commands/tests/*.test.ts\" \"src/resources/extensions/browser-tools/tests/*.test.mjs\"",
+    "test:integration": "node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test --test-timeout=180000 \"src/tests/integration/*.test.ts\" \"src/resources/extensions/gsd/tests/integration/*.test.ts\" \"src/resources/extensions/async-jobs/*.test.ts\" \"src/resources/extensions/ollama/**/*.test.ts\" \"src/resources/extensions/ollama/*.test.ts\" \"src/resources/extensions/search-the-web/tests/*.test.ts\" \"src/resources/extensions/bg-shell/tests/*.test.ts\" \"src/resources/extensions/slash-commands/tests/*.test.ts\" \"src/resources/extensions/browser-tools/tests/*.test.mjs\" \"src/resources/extensions/mac-tools/tests/*.test.cjs\"",
     "pretest": "pnpm run typecheck:extensions",
     "test": "pnpm run test:unit && pnpm run test:integration && pnpm run test:packages",
     "test:smoke": "node --experimental-strip-types tests/smoke/run.ts",
@@ -124,7 +126,7 @@
     "audit:test-matrix": "node scripts/audit-test-matrix.mjs",
     "test:evaluation": "node scripts/run-test-evaluation.mjs",
     "test:coverage:unit": "cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/unit --temp-directory=coverage/.tmp-unit --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --exclude=\"**/test/**\" --all node --import ./scripts/dist-test-resolve.mjs --experimental-test-isolation=process --test \"dist-test/src/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.js\" \"dist-test/src/resources/extensions/gsd/tests/*.test.mjs\" \"dist-test/src/resources/extensions/shared/tests/*.test.js\" \"dist-test/src/resources/extensions/subagent/tests/*.test.js\" \"dist-test/src/resources/extensions/claude-code-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/cursor-cli/tests/*.test.js\" \"dist-test/src/resources/extensions/github-sync/tests/*.test.js\" \"dist-test/src/resources/extensions/universal-config/tests/*.test.js\" \"dist-test/src/resources/extensions/visual-brief/tests/*.test.js\" \"dist-test/src/resources/extensions/voice/tests/*.test.js\" \"dist-test/src/resources/extensions/mcp-client/tests/*.test.js\" \"dist-test/src/resources/extensions/remote-questions/tests/*.test.js\"",
-    "test:coverage:integration": "pnpm exec playwright install chromium && cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/integration --temp-directory=coverage/.tmp-integration --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --all node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test --test-timeout=180000 \"src/tests/integration/*.test.ts\" \"src/resources/extensions/gsd/tests/integration/*.test.ts\" \"src/resources/extensions/async-jobs/*.test.ts\" \"src/resources/extensions/ollama/**/*.test.ts\" \"src/resources/extensions/ollama/*.test.ts\" \"src/resources/extensions/search-the-web/tests/*.test.ts\" \"src/resources/extensions/bg-shell/tests/*.test.ts\" \"src/resources/extensions/slash-commands/tests/*.test.ts\" \"src/resources/extensions/browser-tools/tests/*.test.mjs\"",
+    "test:coverage:integration": "pnpm exec playwright install chromium && cross-env NODE_OPTIONS=--max-old-space-size=8192 c8 --reporter=lcovonly --report-dir=coverage/integration --temp-directory=coverage/.tmp-integration --exclude=\"**/*.test.*\" --exclude=\"**/tests/**\" --all node --import ./src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test --test-timeout=180000 \"src/tests/integration/*.test.ts\" \"src/resources/extensions/gsd/tests/integration/*.test.ts\" \"src/resources/extensions/async-jobs/*.test.ts\" \"src/resources/extensions/ollama/**/*.test.ts\" \"src/resources/extensions/ollama/*.test.ts\" \"src/resources/extensions/search-the-web/tests/*.test.ts\" \"src/resources/extensions/bg-shell/tests/*.test.ts\" \"src/resources/extensions/slash-commands/tests/*.test.ts\" \"src/resources/extensions/browser-tools/tests/*.test.mjs\" \"src/resources/extensions/mac-tools/tests/*.test.cjs\"",
     "test:coverage:packages": "node scripts/run-coverage-packages.mjs",
     "test:coverage:merge": "node scripts/merge-coverage-reports.mjs",
     "test:coverage:full": "pnpm run test:compile && pnpm run test:coverage:unit && pnpm run test:coverage:integration && pnpm run test:coverage:packages && pnpm run test:coverage:merge",
@@ -161,7 +163,6 @@
     "@sinclair/typebox": "^0.34.41",
     "@smithy/node-http-handler": "^4.7.3",
     "ajv": "^8.17.1",
-    "ajv-formats": "^3.0.1",
     "balanced-match": "^4.0.2",
     "brace-expansion": "^5.0.5",
     "chalk": "^5.6.2",
@@ -202,6 +203,7 @@
     "@types/node": "^24.12.0",
     "@types/picomatch": "^4.0.2",
     "@types/proper-lockfile": "^4.1.4",
+    "ajv-formats": "^3.0.1",
     "c8": "^11.0.0",
     "cross-env": "^7.0.3",
     "esbuild": "^0.28.1",
@@ -210,11 +212,11 @@
   },
   "optionalDependencies": {
     "@mariozechner/clipboard": "0.3.6",
-    "@opengsd/engine-darwin-arm64": "1.8.1",
-    "@opengsd/engine-darwin-x64": "1.8.1",
-    "@opengsd/engine-linux-arm64-gnu": "1.8.1",
-    "@opengsd/engine-linux-x64-gnu": "1.8.1",
-    "@opengsd/engine-win32-x64-msvc": "1.8.1",
+    "@opengsd/engine-darwin-arm64": "1.9.0",
+    "@opengsd/engine-darwin-x64": "1.9.0",
+    "@opengsd/engine-linux-arm64-gnu": "1.9.0",
+    "@opengsd/engine-linux-x64-gnu": "1.9.0",
+    "@opengsd/engine-win32-x64-msvc": "1.9.0",
     "fsevents": "~2.3.3",
     "koffi": "^2.9.0"
   },

package/packages/cloud-mcp-gateway/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/cloud-mcp-gateway",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "Cloud MCP gateway for brokering remote MCP clients to local GSD runtimes",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@opengsd/mcp-server": "^1.8.1",
+    "@opengsd/mcp-server": "^1.9.0",
     "ws": "^8.20.0",
     "zod": "^4.0.0"
   },

package/packages/contracts/dist/workflow.d.ts

@@ -64,6 +64,20 @@ export declare const WORKFLOW_TOOL_CONTRACTS: readonly [{
     readonly executorId: "executeReplanSlice";
     readonly writePolicy: "write";
     readonly auditEvent: "workflow.slice.replan";
+}, {
+    readonly canonicalName: "gsd_replan_task";
+    readonly aliases: readonly [];
+    readonly schemaId: "workflow.task.replan";
+    readonly executorId: "executeReplanTask";
+    readonly writePolicy: "write";
+    readonly auditEvent: "workflow.task.replan";
+}, {
+    readonly canonicalName: "gsd_rework_brief_save";
+    readonly aliases: readonly [];
+    readonly schemaId: "workflow.rework_brief.save";
+    readonly executorId: "executeReworkBriefSave";
+    readonly writePolicy: "write";
+    readonly auditEvent: "workflow.rework_brief.save";
 }, {
     readonly canonicalName: "gsd_slice_complete";
     readonly aliases: readonly ["gsd_complete_slice"];

package/packages/contracts/dist/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,uBAAuB,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACnB;AAGD,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiPwB,CAAC;AAE7D,mJAAmJ;AACnJ,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAElG,4DAA4D;AAC5D,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhG,eAAO,MAAM,mBAAmB,EAG1B,SAAS,MAAM,EAAE,CAAC;AAExB,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,EAErC,SAAS,MAAM,EAAE,CAAC;AAEvB;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAEjC,SAAS,MAAM,EAAE,CAAC"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,uBAAuB,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACnB;AAGD,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiQwB,CAAC;AAE7D,mJAAmJ;AACnJ,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAElG,4DAA4D;AAC5D,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhG,eAAO,MAAM,mBAAmB,EAG1B,SAAS,MAAM,EAAE,CAAC;AAExB,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,EAErC,SAAS,MAAM,EAAE,CAAC;AAEvB;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAEjC,SAAS,MAAM,EAAE,CAAC"}

package/packages/contracts/dist/workflow.js

@@ -67,6 +67,22 @@ export const WORKFLOW_TOOL_CONTRACTS = [
         writePolicy: "write",
         auditEvent: "workflow.slice.replan",
     },
+    {
+        canonicalName: "gsd_replan_task",
+        aliases: [],
+        schemaId: "workflow.task.replan",
+        executorId: "executeReplanTask",
+        writePolicy: "write",
+        auditEvent: "workflow.task.replan",
+    },
+    {
+        canonicalName: "gsd_rework_brief_save",
+        aliases: [],
+        schemaId: "workflow.rework_brief.save",
+        executorId: "executeReworkBriefSave",
+        writePolicy: "write",
+        auditEvent: "workflow.rework_brief.save",
+    },
     {
         canonicalName: "gsd_slice_complete",
         aliases: ["gsd_complete_slice"],

package/packages/contracts/dist/workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,sBAAsB;AACtB,uFAAuF;AAavF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,QAAQ,EAAE,wBAAwB;QAClC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,wBAAwB;KACpC;IACD;QACC,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,QAAQ,EAAE,6BAA6B;QACvC,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,6BAA6B;KACzC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,2BAA2B;QAC1C,OAAO,EAAE,CAAC,2BAA2B,CAAC;QACtC,QAAQ,EAAE,gCAAgC;QAC1C,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,gCAAgC;KAC5C;IACD;QACC,aAAa,EAAE,oBAAoB;QACnC,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,QAAQ,EAAE,yBAAyB;QACnC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,yBAAyB;KACrC;IACD;QACC,aAAa,EAAE,gBAAgB;QAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,qBAAqB;QAC/B,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,qBAAqB;KACjC;IACD;QACC,aAAa,EAAE,eAAe;QAC9B,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,oBAAoB;KAChC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,oBAAoB;QACnC,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,QAAQ,EAAE,yBAAyB;QACnC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,yBAAyB;KACrC;IACD;QACC,aAAa,EAAE,gBAAgB;QAC/B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,qBAAqB;QAC/B,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,qBAAqB;KACjC;IACD;QACC,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,QAAQ,EAAE,6BAA6B;QACvC,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,6BAA6B;KACzC;IACD;QACC,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,QAAQ,EAAE,6BAA6B;QACvC,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,6BAA6B;KACzC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,qBAAqB;QACpC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,0BAA0B;QACpC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,0BAA0B;KACtC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,QAAQ,EAAE,wBAAwB;QAClC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,wBAAwB;KACpC;IACD;QACC,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,sBAAsB;KAClC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,8BAA8B;QACxC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,8BAA8B;KAC1C;IACD;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,wBAAwB;QAClC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,wBAAwB;KACpC;IACD;QACC,aAAa,EAAE,cAAc;QAC7B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,mBAAmB;QAC7B,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,mBAAmB;KAC/B;IACD;QACC,aAAa,EAAE,UAAU;QACzB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,mBAAmB;QAC7B,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,mBAAmB;KAC/B;IACD;QACC,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,sBAAsB;QAChC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,sBAAsB;KAClC;IACD;QACC,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,iBAAiB;QAC3B,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,iBAAiB;KAC7B;IACD;QACC,aAAa,EAAE,qBAAqB;QACpC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,iCAAiC;QAC3C,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,iCAAiC;KAC7C;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,uBAAuB;KACnC;CAC0D,CAAC;AAQ7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa;IAClB,GAAG,IAAI,CAAC,OAAO;CACf,CAAsB,CAAC;AAExB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC,GAAG,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CACP,CAAC;AAEvB;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,OAAO,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CACD,CAAC","sourcesContent":["// Project/App: gsd-pi\n// File Purpose: Canonical workflow MCP tool metadata shared across package boundaries.\n\nexport type WorkflowToolWritePolicy = \"read\" | \"write\";\n\nexport interface WorkflowToolContractMetadata {\n\tcanonicalName: string;\n\taliases: readonly string[];\n\tschemaId: string;\n\texecutorId: string;\n\twritePolicy: WorkflowToolWritePolicy;\n\tauditEvent: string;\n}\n\n// Bounds single streamed tool arguments so large artifacts are saved incrementally.\nexport const SUMMARY_SAVE_CONTENT_MAX_LENGTH = 50_000;\n\nexport const WORKFLOW_TOOL_CONTRACTS = [\n\t{\n\t\tcanonicalName: \"gsd_decision_save\",\n\t\taliases: [\"gsd_save_decision\"],\n\t\tschemaId: \"workflow.decision.save\",\n\t\texecutorId: \"executeDecisionSave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.decision.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_requirement_update\",\n\t\taliases: [\"gsd_update_requirement\"],\n\t\tschemaId: \"workflow.requirement.update\",\n\t\texecutorId: \"executeRequirementUpdate\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.requirement.update\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_requirement_save\",\n\t\taliases: [\"gsd_save_requirement\"],\n\t\tschemaId: \"workflow.requirement.save\",\n\t\texecutorId: \"executeRequirementSave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.requirement.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_milestone_generate_id\",\n\t\taliases: [\"gsd_generate_milestone_id\"],\n\t\tschemaId: \"workflow.milestone.generate_id\",\n\t\texecutorId: \"executeMilestoneGenerateId\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.milestone.generate_id\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_plan_milestone\",\n\t\taliases: [\"gsd_milestone_plan\"],\n\t\tschemaId: \"workflow.milestone.plan\",\n\t\texecutorId: \"executePlanMilestone\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.plan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_plan_slice\",\n\t\taliases: [\"gsd_slice_plan\"],\n\t\tschemaId: \"workflow.slice.plan\",\n\t\texecutorId: \"executePlanSlice\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.plan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_plan_task\",\n\t\taliases: [\"gsd_task_plan\"],\n\t\tschemaId: \"workflow.task.plan\",\n\t\texecutorId: \"executePlanTask\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.task.plan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_replan_slice\",\n\t\taliases: [\"gsd_slice_replan\"],\n\t\tschemaId: \"workflow.slice.replan\",\n\t\texecutorId: \"executeReplanSlice\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.replan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_slice_complete\",\n\t\taliases: [\"gsd_complete_slice\"],\n\t\tschemaId: \"workflow.slice.complete\",\n\t\texecutorId: \"executeSliceComplete\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.complete\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_skip_slice\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.slice.skip\",\n\t\texecutorId: \"executeSkipSlice\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.skip\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_complete_milestone\",\n\t\taliases: [\"gsd_milestone_complete\"],\n\t\tschemaId: \"workflow.milestone.complete\",\n\t\texecutorId: \"executeCompleteMilestone\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.complete\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_validate_milestone\",\n\t\taliases: [\"gsd_milestone_validate\"],\n\t\tschemaId: \"workflow.milestone.validate\",\n\t\texecutorId: \"executeValidateMilestone\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.validate\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_reassess_roadmap\",\n\t\taliases: [\"gsd_roadmap_reassess\"],\n\t\tschemaId: \"workflow.roadmap.reassess\",\n\t\texecutorId: \"executeReassessRoadmap\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.roadmap.reassess\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_save_gate_result\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.gate.save_result\",\n\t\texecutorId: \"executeSaveGateResult\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.gate.save_result\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_uat_result_save\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.uat.result.save\",\n\t\texecutorId: \"executeUatResultSave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.uat.result.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_summary_save\",\n\t\taliases: [\"gsd_save_summary\"],\n\t\tschemaId: \"workflow.summary.save\",\n\t\texecutorId: \"executeSummarySave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.summary.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_task_complete\",\n\t\taliases: [\"gsd_complete_task\"],\n\t\tschemaId: \"workflow.task.complete\",\n\t\texecutorId: \"executeTaskComplete\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.task.complete\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_task_reopen\",\n\t\taliases: [\"gsd_reopen_task\"],\n\t\tschemaId: \"workflow.task.reopen\",\n\t\texecutorId: \"executeTaskReopen\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.task.reopen\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_slice_reopen\",\n\t\taliases: [\"gsd_reopen_slice\"],\n\t\tschemaId: \"workflow.slice.reopen\",\n\t\texecutorId: \"executeSliceReopen\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.reopen\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_milestone_reopen\",\n\t\taliases: [\"gsd_reopen_milestone\"],\n\t\tschemaId: \"workflow.milestone.reopen\",\n\t\texecutorId: \"executeMilestoneReopen\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.reopen\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_milestone_status\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.milestone.status\",\n\t\texecutorId: \"executeMilestoneStatus\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.milestone.status\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_checkpoint_db\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.database.checkpoint\",\n\t\texecutorId: \"executeCheckpointDb\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.database.checkpoint\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_journal_query\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.journal.query\",\n\t\texecutorId: \"executeJournalQuery\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.journal.query\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_uat_exec\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.uat.exec\",\n\t\texecutorId: \"executeUatExec\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.uat.exec\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_exec\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.exec.run\",\n\t\texecutorId: \"executeGsdExec\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.exec.run\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_exec_search\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.exec.search\",\n\t\texecutorId: \"executeGsdExecSearch\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.exec.search\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_resume\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.resume\",\n\t\texecutorId: \"executeGsdResume\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.resume\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_capture_thought\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.memory.capture_thought\",\n\t\texecutorId: \"executeCaptureThought\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.memory.capture_thought\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_memory_query\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.memory.query\",\n\t\texecutorId: \"executeMemoryQuery\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.memory.query\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_memory_graph\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.memory.graph\",\n\t\texecutorId: \"executeMemoryGraph\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.memory.graph\",\n\t},\n] as const satisfies readonly WorkflowToolContractMetadata[];\n\n/** Literal union of canonical workflow tool names. Typing a name list with this union makes drift from WORKFLOW_TOOL_CONTRACTS a compile error. */\nexport type CanonicalWorkflowToolName = (typeof WORKFLOW_TOOL_CONTRACTS)[number][\"canonicalName\"];\n\n/** Literal union of backwards-compatibility alias names. */\nexport type WorkflowToolAliasName = (typeof WORKFLOW_TOOL_CONTRACTS)[number][\"aliases\"][number];\n\nexport const WORKFLOW_TOOL_NAMES = WORKFLOW_TOOL_CONTRACTS.flatMap((tool) => [\n\ttool.canonicalName,\n\t...tool.aliases,\n]) as readonly string[];\n\n/** Canonical tool names only (excludes backwards-compatibility aliases). */\nexport const CANONICAL_WORKFLOW_TOOL_NAMES = WORKFLOW_TOOL_CONTRACTS.map(\n\t(tool) => tool.canonicalName,\n) as readonly string[];\n\n/**\n * Backwards-compatibility alias names (each forwards to a canonical twin).\n * Callers may exclude these from an advertised tool surface to save tokens —\n * see registerWorkflowTools({ advertiseAliases }).\n */\nexport const WORKFLOW_TOOL_ALIAS_NAMES = WORKFLOW_TOOL_CONTRACTS.flatMap(\n\t(tool) => tool.aliases,\n) as readonly string[];\n"]}
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,sBAAsB;AACtB,uFAAuF;AAavF,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,QAAQ,EAAE,wBAAwB;QAClC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,wBAAwB;KACpC;IACD;QACC,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,QAAQ,EAAE,6BAA6B;QACvC,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,6BAA6B;KACzC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,2BAA2B;QAC1C,OAAO,EAAE,CAAC,2BAA2B,CAAC;QACtC,QAAQ,EAAE,gCAAgC;QAC1C,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,gCAAgC;KAC5C;IACD;QACC,aAAa,EAAE,oBAAoB;QACnC,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,QAAQ,EAAE,yBAAyB;QACnC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,yBAAyB;KACrC;IACD;QACC,aAAa,EAAE,gBAAgB;QAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,qBAAqB;QAC/B,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,qBAAqB;KACjC;IACD;QACC,aAAa,EAAE,eAAe;QAC9B,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,oBAAoB;KAChC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,sBAAsB;QAChC,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,sBAAsB;KAClC;IACD;QACC,aAAa,EAAE,uBAAuB;QACtC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,4BAA4B;QACtC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,4BAA4B;KACxC;IACD;QACC,aAAa,EAAE,oBAAoB;QACnC,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,QAAQ,EAAE,yBAAyB;QACnC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,yBAAyB;KACrC;IACD;QACC,aAAa,EAAE,gBAAgB;QAC/B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,qBAAqB;QAC/B,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,qBAAqB;KACjC;IACD;QACC,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,QAAQ,EAAE,6BAA6B;QACvC,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,6BAA6B;KACzC;IACD;QACC,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,QAAQ,EAAE,6BAA6B;QACvC,UAAU,EAAE,0BAA0B;QACtC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,6BAA6B;KACzC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,qBAAqB;QACpC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,0BAA0B;QACpC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,0BAA0B;KACtC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,QAAQ,EAAE,wBAAwB;QAClC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,wBAAwB;KACpC;IACD;QACC,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,sBAAsB;KAClC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,sBAAsB;QACrC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,2BAA2B;QACrC,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,2BAA2B;KACvC;IACD;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,8BAA8B;QACxC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,8BAA8B;KAC1C;IACD;QACC,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,wBAAwB;QAClC,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,wBAAwB;KACpC;IACD;QACC,aAAa,EAAE,cAAc;QAC7B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,mBAAmB;QAC7B,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,mBAAmB;KAC/B;IACD;QACC,aAAa,EAAE,UAAU;QACzB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,mBAAmB;QAC7B,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,mBAAmB;KAC/B;IACD;QACC,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,sBAAsB;QAChC,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,sBAAsB;KAClC;IACD;QACC,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,iBAAiB;QAC3B,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,iBAAiB;KAC7B;IACD;QACC,aAAa,EAAE,qBAAqB;QACpC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,iCAAiC;QAC3C,UAAU,EAAE,uBAAuB;QACnC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,iCAAiC;KAC7C;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,uBAAuB;KACnC;IACD;QACC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,uBAAuB;QACjC,UAAU,EAAE,oBAAoB;QAChC,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,uBAAuB;KACnC;CAC0D,CAAC;AAQ7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa;IAClB,GAAG,IAAI,CAAC,OAAO;CACf,CAAsB,CAAC;AAExB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC,GAAG,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CACP,CAAC;AAEvB;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,OAAO,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CACD,CAAC","sourcesContent":["// Project/App: gsd-pi\n// File Purpose: Canonical workflow MCP tool metadata shared across package boundaries.\n\nexport type WorkflowToolWritePolicy = \"read\" | \"write\";\n\nexport interface WorkflowToolContractMetadata {\n\tcanonicalName: string;\n\taliases: readonly string[];\n\tschemaId: string;\n\texecutorId: string;\n\twritePolicy: WorkflowToolWritePolicy;\n\tauditEvent: string;\n}\n\n// Bounds single streamed tool arguments so large artifacts are saved incrementally.\nexport const SUMMARY_SAVE_CONTENT_MAX_LENGTH = 50_000;\n\nexport const WORKFLOW_TOOL_CONTRACTS = [\n\t{\n\t\tcanonicalName: \"gsd_decision_save\",\n\t\taliases: [\"gsd_save_decision\"],\n\t\tschemaId: \"workflow.decision.save\",\n\t\texecutorId: \"executeDecisionSave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.decision.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_requirement_update\",\n\t\taliases: [\"gsd_update_requirement\"],\n\t\tschemaId: \"workflow.requirement.update\",\n\t\texecutorId: \"executeRequirementUpdate\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.requirement.update\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_requirement_save\",\n\t\taliases: [\"gsd_save_requirement\"],\n\t\tschemaId: \"workflow.requirement.save\",\n\t\texecutorId: \"executeRequirementSave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.requirement.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_milestone_generate_id\",\n\t\taliases: [\"gsd_generate_milestone_id\"],\n\t\tschemaId: \"workflow.milestone.generate_id\",\n\t\texecutorId: \"executeMilestoneGenerateId\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.milestone.generate_id\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_plan_milestone\",\n\t\taliases: [\"gsd_milestone_plan\"],\n\t\tschemaId: \"workflow.milestone.plan\",\n\t\texecutorId: \"executePlanMilestone\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.plan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_plan_slice\",\n\t\taliases: [\"gsd_slice_plan\"],\n\t\tschemaId: \"workflow.slice.plan\",\n\t\texecutorId: \"executePlanSlice\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.plan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_plan_task\",\n\t\taliases: [\"gsd_task_plan\"],\n\t\tschemaId: \"workflow.task.plan\",\n\t\texecutorId: \"executePlanTask\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.task.plan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_replan_slice\",\n\t\taliases: [\"gsd_slice_replan\"],\n\t\tschemaId: \"workflow.slice.replan\",\n\t\texecutorId: \"executeReplanSlice\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.replan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_replan_task\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.task.replan\",\n\t\texecutorId: \"executeReplanTask\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.task.replan\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_rework_brief_save\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.rework_brief.save\",\n\t\texecutorId: \"executeReworkBriefSave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.rework_brief.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_slice_complete\",\n\t\taliases: [\"gsd_complete_slice\"],\n\t\tschemaId: \"workflow.slice.complete\",\n\t\texecutorId: \"executeSliceComplete\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.complete\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_skip_slice\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.slice.skip\",\n\t\texecutorId: \"executeSkipSlice\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.skip\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_complete_milestone\",\n\t\taliases: [\"gsd_milestone_complete\"],\n\t\tschemaId: \"workflow.milestone.complete\",\n\t\texecutorId: \"executeCompleteMilestone\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.complete\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_validate_milestone\",\n\t\taliases: [\"gsd_milestone_validate\"],\n\t\tschemaId: \"workflow.milestone.validate\",\n\t\texecutorId: \"executeValidateMilestone\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.validate\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_reassess_roadmap\",\n\t\taliases: [\"gsd_roadmap_reassess\"],\n\t\tschemaId: \"workflow.roadmap.reassess\",\n\t\texecutorId: \"executeReassessRoadmap\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.roadmap.reassess\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_save_gate_result\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.gate.save_result\",\n\t\texecutorId: \"executeSaveGateResult\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.gate.save_result\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_uat_result_save\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.uat.result.save\",\n\t\texecutorId: \"executeUatResultSave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.uat.result.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_summary_save\",\n\t\taliases: [\"gsd_save_summary\"],\n\t\tschemaId: \"workflow.summary.save\",\n\t\texecutorId: \"executeSummarySave\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.summary.save\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_task_complete\",\n\t\taliases: [\"gsd_complete_task\"],\n\t\tschemaId: \"workflow.task.complete\",\n\t\texecutorId: \"executeTaskComplete\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.task.complete\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_task_reopen\",\n\t\taliases: [\"gsd_reopen_task\"],\n\t\tschemaId: \"workflow.task.reopen\",\n\t\texecutorId: \"executeTaskReopen\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.task.reopen\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_slice_reopen\",\n\t\taliases: [\"gsd_reopen_slice\"],\n\t\tschemaId: \"workflow.slice.reopen\",\n\t\texecutorId: \"executeSliceReopen\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.slice.reopen\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_milestone_reopen\",\n\t\taliases: [\"gsd_reopen_milestone\"],\n\t\tschemaId: \"workflow.milestone.reopen\",\n\t\texecutorId: \"executeMilestoneReopen\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.milestone.reopen\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_milestone_status\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.milestone.status\",\n\t\texecutorId: \"executeMilestoneStatus\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.milestone.status\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_checkpoint_db\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.database.checkpoint\",\n\t\texecutorId: \"executeCheckpointDb\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.database.checkpoint\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_journal_query\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.journal.query\",\n\t\texecutorId: \"executeJournalQuery\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.journal.query\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_uat_exec\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.uat.exec\",\n\t\texecutorId: \"executeUatExec\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.uat.exec\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_exec\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.exec.run\",\n\t\texecutorId: \"executeGsdExec\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.exec.run\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_exec_search\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.exec.search\",\n\t\texecutorId: \"executeGsdExecSearch\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.exec.search\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_resume\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.resume\",\n\t\texecutorId: \"executeGsdResume\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.resume\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_capture_thought\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.memory.capture_thought\",\n\t\texecutorId: \"executeCaptureThought\",\n\t\twritePolicy: \"write\",\n\t\tauditEvent: \"workflow.memory.capture_thought\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_memory_query\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.memory.query\",\n\t\texecutorId: \"executeMemoryQuery\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.memory.query\",\n\t},\n\t{\n\t\tcanonicalName: \"gsd_memory_graph\",\n\t\taliases: [],\n\t\tschemaId: \"workflow.memory.graph\",\n\t\texecutorId: \"executeMemoryGraph\",\n\t\twritePolicy: \"read\",\n\t\tauditEvent: \"workflow.memory.graph\",\n\t},\n] as const satisfies readonly WorkflowToolContractMetadata[];\n\n/** Literal union of canonical workflow tool names. Typing a name list with this union makes drift from WORKFLOW_TOOL_CONTRACTS a compile error. */\nexport type CanonicalWorkflowToolName = (typeof WORKFLOW_TOOL_CONTRACTS)[number][\"canonicalName\"];\n\n/** Literal union of backwards-compatibility alias names. */\nexport type WorkflowToolAliasName = (typeof WORKFLOW_TOOL_CONTRACTS)[number][\"aliases\"][number];\n\nexport const WORKFLOW_TOOL_NAMES = WORKFLOW_TOOL_CONTRACTS.flatMap((tool) => [\n\ttool.canonicalName,\n\t...tool.aliases,\n]) as readonly string[];\n\n/** Canonical tool names only (excludes backwards-compatibility aliases). */\nexport const CANONICAL_WORKFLOW_TOOL_NAMES = WORKFLOW_TOOL_CONTRACTS.map(\n\t(tool) => tool.canonicalName,\n) as readonly string[];\n\n/**\n * Backwards-compatibility alias names (each forwards to a canonical twin).\n * Callers may exclude these from an advertised tool surface to save tokens —\n * see registerWorkflowTools({ advertiseAliases }).\n */\nexport const WORKFLOW_TOOL_ALIAS_NAMES = WORKFLOW_TOOL_CONTRACTS.flatMap(\n\t(tool) => tool.aliases,\n) as readonly string[];\n"]}

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/contracts",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "Shared public contracts for GSD workspace boundaries",
   "license": "MIT",
   "gsd": {

package/packages/daemon/dist/cloud-config.d.ts

@@ -15,5 +15,5 @@ export declare function clearCloudConfig(configPath: string): DaemonConfig;
 export declare function redactedCloudStatus(config: DaemonConfig): Record<string, unknown>;
 export declare function validateGatewayNetworkTarget(url: URL): void;
 export declare function createGatewayLookup(url: URL): LookupFunction;
-export declare function postJsonToValidatedGateway(url: URL, payload: Record<string, unknown>): Promise<Record<string, unknown>>;
+export declare function postJsonToValidatedGateway(url: URL, payload: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
 //# sourceMappingURL=cloud-config.d.ts.map

package/packages/daemon/dist/cloud-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAUjC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CA2BvD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,YAAY,CAgB/G;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAWjE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWjF;AAeD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAK3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAkC5D;AA+BD,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmCvH"}
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAUjC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CA2BvD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,YAAY,CAgB/G;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAWjE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWjF;AAeD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAK3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAkC5D;AAiCD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,GAAE,MAAmC,GAC7C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsClC"}

package/packages/daemon/dist/cloud-config.js

@@ -179,7 +179,8 @@ function writeConfigFile(configPath, contents) {
     writeFileSync(configPath, contents, { encoding: "utf-8", mode: 0o600 });
     chmodSync(configPath, 0o600);
 }
-export function postJsonToValidatedGateway(url, payload) {
+const GATEWAY_REQUEST_TIMEOUT_MS = 30_000;
+export function postJsonToValidatedGateway(url, payload, timeoutMs = GATEWAY_REQUEST_TIMEOUT_MS) {
     validateGatewayNetworkTarget(url);
     const body = JSON.stringify(payload);
     const requestImpl = url.protocol === "https:" ? httpsRequest : httpRequest;
@@ -209,6 +210,9 @@ export function postJsonToValidatedGateway(url, payload) {
                 resolve(parsed);
             });
         });
+        req.setTimeout(timeoutMs, () => {
+            req.destroy(new Error(`Gateway request timed out after ${timeoutMs}ms`));
+        });
         req.on("error", reject);
         req.end(body);
     });

package/packages/daemon/dist/cloud-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQ3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAIzC;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAA6C;IAC/F,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1D,GAAG,CAAC,KAAK,GAAG;QACV,GAAG,KAAK;QACR,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;QACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACjB,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAQ;IACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAW,EAAE,CAC5C,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,OAAO,CAAC,CAAC,QAAgB,EAAE,OAAgB,EAAE,QAAsC,EAAE,EAAE;QACrF,MAAM,QAAQ,GACZ,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAK,OAAyB,CAAC,GAAG,KAAK,IAAI,CAAC;QAC7F,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAI,OAAyB,EAAE,CAAC;QACxF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBAC1D,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,SAAuD,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAClE,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;gBAC5F,CAAC;gBACD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7G,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAA8B,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,IAAI;WACf,IAAI,KAAK,KAAK;WACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;WACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAgB;IAC3D,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAQ,EAAE,OAAgC;IACnF,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;aAC1C;YACD,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9G,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { lookup } from \"node:dns\";\nimport type { LookupOptions } from \"node:dns\";\nimport { request as httpRequest } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP } from \"node:net\";\nimport type { LookupFunction } from \"node:net\";\nimport { dirname } from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { loadConfig } from \"./config.js\";\nimport { protectCloudDeviceToken } from \"./cloud-token.js\";\nimport type { DaemonConfig } from \"./types.js\";\n\nexport interface PairingExchangeResult {\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport async function exchangePairingCode(params: {\n  gatewayUrl: string;\n  code: string;\n  runtimeName?: string;\n}): Promise<PairingExchangeResult> {\n  const pairingUrl = new URL(\"/pairing/exchange\", parseCloudGatewayUrl(params.gatewayUrl));\n  const body = await postJsonToValidatedGateway(pairingUrl, {\n    code: params.code,\n    runtimeName: params.runtimeName,\n  });\n  if (typeof body.runtimeId !== \"string\" || typeof body.deviceToken !== \"string\") {\n    throw new Error(\"Pairing response did not include runtimeId and deviceToken\");\n  }\n  return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };\n}\n\nexport function parseCloudGatewayUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Cloud gateway URL must be an absolute HTTP(S) URL\");\n  }\n\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"Cloud gateway URL must use http or https\");\n  }\n  if (url.username || url.password) {\n    throw new Error(\"Cloud gateway URL must not include credentials\");\n  }\n  if (url.hash) {\n    throw new Error(\"Cloud gateway URL must not include a fragment\");\n  }\n  if (url.protocol === \"http:\" && !isLoopbackHost(url.hostname)) {\n    throw new Error(\"Plain HTTP cloud gateway URLs are only allowed for localhost\");\n  }\n  if (url.protocol === \"https:\" && isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n\n  url.pathname = url.pathname.replace(/\\/+$/, \"\");\n  url.search = \"\";\n  return url;\n}\n\nexport function saveCloudConfig(configPath: string, nextCloud: NonNullable<DaemonConfig[\"cloud\"]>): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  const { device_token: deviceToken, ...cloud } = nextCloud;\n  raw.cloud = {\n    ...cloud,\n    gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),\n    ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),\n  };\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function clearCloudConfig(configPath: string): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  delete raw.cloud;\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function redactedCloudStatus(config: DaemonConfig): Record<string, unknown> {\n  const cloud = config.cloud;\n  if (!cloud) return { configured: false };\n  return {\n    configured: true,\n    enabled: cloud.enabled ?? true,\n    gateway_url: cloud.gateway_url,\n    runtime_id: cloud.runtime_id ?? null,\n    runtime_name: cloud.runtime_name ?? null,\n    [\"device_\" + \"token\"]: cloud.device_token ? \"[redacted]\" : null,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase();\n  return host === \"localhost\" || host === \"127.0.0.1\" || host === \"::1\" || host === \"[::1]\";\n}\n\nfunction isPrivateIpHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host === \"localhost\") return true;\n  if (isIP(host) === 4) return isPrivateIpv4(host);\n  if (isIP(host) === 6) return isPrivateIpv6(host);\n  return false;\n}\n\nexport function validateGatewayNetworkTarget(url: URL): void {\n  if (url.protocol === \"http:\" && isLoopbackHost(url.hostname)) return;\n  if (isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n}\n\nexport function createGatewayLookup(url: URL): LookupFunction {\n  const allowLoopback = url.protocol === \"http:\" && isLoopbackHost(url.hostname);\n  const rejected = (address: string): boolean =>\n    !address || (!allowLoopback && isPrivateIpHost(address));\n  // Node's socket connect (autoSelectFamily / Happy Eyeballs, default-on since\n  // Node 20) calls a custom lookup with `all: true` and expects an ARRAY\n  // callback. Forcing `all: false` + a scalar callback made every real gateway\n  // request throw \"Invalid IP address: undefined\". Honor both forms; the SSRF\n  // guard is applied to every resolved address (reject the whole lookup if any\n  // is private/loopback — an attacker-controlled resolver must not slip one in).\n  return ((hostname: string, options: unknown, callback: (...args: unknown[]) => void) => {\n    const wantsAll =\n      typeof options === \"object\" && options !== null && (options as LookupOptions).all === true;\n    const base: LookupOptions =\n      typeof options === \"number\" ? { family: options } : { ...(options as LookupOptions) };\n    if (wantsAll) {\n      lookup(hostname, { ...base, all: true }, (err, addresses) => {\n        if (err) return callback(err);\n        const list = addresses as Array<{ address: string; family: number }>;\n        if (!list.length || list.some((entry) => rejected(entry.address))) {\n          return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"));\n        }\n        callback(null, list);\n      });\n      return;\n    }\n    lookup(hostname, { ...base, all: false }, (err, address, family) => {\n      if (err) return callback(err, address, family);\n      if (rejected(address)) {\n        return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"), address, family);\n      }\n      callback(null, address, family);\n    });\n  }) as unknown as LookupFunction;\n}\n\nfunction isPrivateIpv4(host: string): boolean {\n  const octets = host.split(\".\").map((part) => Number(part));\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;\n  const [a, b] = octets;\n  if (a === 10 || a === 127 || a === 0) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv6(host: string): boolean {\n  return host === \"::\"\n    || host === \"::1\"\n    || host.startsWith(\"fc\")\n    || host.startsWith(\"fd\")\n    || host.startsWith(\"fe80:\")\n    || host.startsWith(\"2001:db8:\");\n}\n\nfunction writeConfigFile(configPath: string, contents: string): void {\n  writeFileSync(configPath, contents, { encoding: \"utf-8\", mode: 0o600 });\n  chmodSync(configPath, 0o600);\n}\n\nexport function postJsonToValidatedGateway(url: URL, payload: Record<string, unknown>): Promise<Record<string, unknown>> {\n  validateGatewayNetworkTarget(url);\n  const body = JSON.stringify(payload);\n  const requestImpl = url.protocol === \"https:\" ? httpsRequest : httpRequest;\n\n  return new Promise((resolve, reject) => {\n    const req = requestImpl({\n      protocol: url.protocol,\n      hostname: url.hostname,\n      port: url.port,\n      path: `${url.pathname}${url.search}`,\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        \"content-length\": Buffer.byteLength(body),\n      },\n      lookup: createGatewayLookup(url),\n    }, (res) => {\n      const statusCode = res.statusCode ?? 0;\n      const chunks: Buffer[] = [];\n      res.on(\"data\", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));\n      res.on(\"end\", () => {\n        const responseText = Buffer.concat(chunks).toString(\"utf-8\");\n        const parsed = parseJsonObject(responseText);\n        if (statusCode < 200 || statusCode >= 300) {\n          reject(new Error(typeof parsed.error === \"string\" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));\n          return;\n        }\n        resolve(parsed);\n      });\n    });\n\n    req.on(\"error\", reject);\n    req.end(body);\n  });\n}\n\nfunction parseJsonObject(value: string): Record<string, unknown> {\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}
+{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQ3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAIzC;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAA6C;IAC/F,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1D,GAAG,CAAC,KAAK,GAAG;QACV,GAAG,KAAK;QACR,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;QACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACjB,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAQ;IACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAW,EAAE,CAC5C,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,OAAO,CAAC,CAAC,QAAgB,EAAE,OAAgB,EAAE,QAAsC,EAAE,EAAE;QACrF,MAAM,QAAQ,GACZ,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAK,OAAyB,CAAC,GAAG,KAAK,IAAI,CAAC;QAC7F,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAI,OAAyB,EAAE,CAAC;QACxF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBAC1D,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,SAAuD,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAClE,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;gBAC5F,CAAC;gBACD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7G,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAA8B,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,IAAI;WACf,IAAI,KAAK,KAAK;WACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;WACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAgB;IAC3D,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,MAAM,UAAU,0BAA0B,CACxC,GAAQ,EACR,OAAgC,EAChC,YAAoB,0BAA0B;IAE9C,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;aAC1C;YACD,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9G,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,SAAS,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { lookup } from \"node:dns\";\nimport type { LookupOptions } from \"node:dns\";\nimport { request as httpRequest } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP } from \"node:net\";\nimport type { LookupFunction } from \"node:net\";\nimport { dirname } from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { loadConfig } from \"./config.js\";\nimport { protectCloudDeviceToken } from \"./cloud-token.js\";\nimport type { DaemonConfig } from \"./types.js\";\n\nexport interface PairingExchangeResult {\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport async function exchangePairingCode(params: {\n  gatewayUrl: string;\n  code: string;\n  runtimeName?: string;\n}): Promise<PairingExchangeResult> {\n  const pairingUrl = new URL(\"/pairing/exchange\", parseCloudGatewayUrl(params.gatewayUrl));\n  const body = await postJsonToValidatedGateway(pairingUrl, {\n    code: params.code,\n    runtimeName: params.runtimeName,\n  });\n  if (typeof body.runtimeId !== \"string\" || typeof body.deviceToken !== \"string\") {\n    throw new Error(\"Pairing response did not include runtimeId and deviceToken\");\n  }\n  return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };\n}\n\nexport function parseCloudGatewayUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Cloud gateway URL must be an absolute HTTP(S) URL\");\n  }\n\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"Cloud gateway URL must use http or https\");\n  }\n  if (url.username || url.password) {\n    throw new Error(\"Cloud gateway URL must not include credentials\");\n  }\n  if (url.hash) {\n    throw new Error(\"Cloud gateway URL must not include a fragment\");\n  }\n  if (url.protocol === \"http:\" && !isLoopbackHost(url.hostname)) {\n    throw new Error(\"Plain HTTP cloud gateway URLs are only allowed for localhost\");\n  }\n  if (url.protocol === \"https:\" && isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n\n  url.pathname = url.pathname.replace(/\\/+$/, \"\");\n  url.search = \"\";\n  return url;\n}\n\nexport function saveCloudConfig(configPath: string, nextCloud: NonNullable<DaemonConfig[\"cloud\"]>): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  const { device_token: deviceToken, ...cloud } = nextCloud;\n  raw.cloud = {\n    ...cloud,\n    gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),\n    ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),\n  };\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function clearCloudConfig(configPath: string): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  delete raw.cloud;\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function redactedCloudStatus(config: DaemonConfig): Record<string, unknown> {\n  const cloud = config.cloud;\n  if (!cloud) return { configured: false };\n  return {\n    configured: true,\n    enabled: cloud.enabled ?? true,\n    gateway_url: cloud.gateway_url,\n    runtime_id: cloud.runtime_id ?? null,\n    runtime_name: cloud.runtime_name ?? null,\n    [\"device_\" + \"token\"]: cloud.device_token ? \"[redacted]\" : null,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase();\n  return host === \"localhost\" || host === \"127.0.0.1\" || host === \"::1\" || host === \"[::1]\";\n}\n\nfunction isPrivateIpHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host === \"localhost\") return true;\n  if (isIP(host) === 4) return isPrivateIpv4(host);\n  if (isIP(host) === 6) return isPrivateIpv6(host);\n  return false;\n}\n\nexport function validateGatewayNetworkTarget(url: URL): void {\n  if (url.protocol === \"http:\" && isLoopbackHost(url.hostname)) return;\n  if (isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n}\n\nexport function createGatewayLookup(url: URL): LookupFunction {\n  const allowLoopback = url.protocol === \"http:\" && isLoopbackHost(url.hostname);\n  const rejected = (address: string): boolean =>\n    !address || (!allowLoopback && isPrivateIpHost(address));\n  // Node's socket connect (autoSelectFamily / Happy Eyeballs, default-on since\n  // Node 20) calls a custom lookup with `all: true` and expects an ARRAY\n  // callback. Forcing `all: false` + a scalar callback made every real gateway\n  // request throw \"Invalid IP address: undefined\". Honor both forms; the SSRF\n  // guard is applied to every resolved address (reject the whole lookup if any\n  // is private/loopback — an attacker-controlled resolver must not slip one in).\n  return ((hostname: string, options: unknown, callback: (...args: unknown[]) => void) => {\n    const wantsAll =\n      typeof options === \"object\" && options !== null && (options as LookupOptions).all === true;\n    const base: LookupOptions =\n      typeof options === \"number\" ? { family: options } : { ...(options as LookupOptions) };\n    if (wantsAll) {\n      lookup(hostname, { ...base, all: true }, (err, addresses) => {\n        if (err) return callback(err);\n        const list = addresses as Array<{ address: string; family: number }>;\n        if (!list.length || list.some((entry) => rejected(entry.address))) {\n          return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"));\n        }\n        callback(null, list);\n      });\n      return;\n    }\n    lookup(hostname, { ...base, all: false }, (err, address, family) => {\n      if (err) return callback(err, address, family);\n      if (rejected(address)) {\n        return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"), address, family);\n      }\n      callback(null, address, family);\n    });\n  }) as unknown as LookupFunction;\n}\n\nfunction isPrivateIpv4(host: string): boolean {\n  const octets = host.split(\".\").map((part) => Number(part));\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;\n  const [a, b] = octets;\n  if (a === 10 || a === 127 || a === 0) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv6(host: string): boolean {\n  return host === \"::\"\n    || host === \"::1\"\n    || host.startsWith(\"fc\")\n    || host.startsWith(\"fd\")\n    || host.startsWith(\"fe80:\")\n    || host.startsWith(\"2001:db8:\");\n}\n\nfunction writeConfigFile(configPath: string, contents: string): void {\n  writeFileSync(configPath, contents, { encoding: \"utf-8\", mode: 0o600 });\n  chmodSync(configPath, 0o600);\n}\n\nconst GATEWAY_REQUEST_TIMEOUT_MS = 30_000;\n\nexport function postJsonToValidatedGateway(\n  url: URL,\n  payload: Record<string, unknown>,\n  timeoutMs: number = GATEWAY_REQUEST_TIMEOUT_MS,\n): Promise<Record<string, unknown>> {\n  validateGatewayNetworkTarget(url);\n  const body = JSON.stringify(payload);\n  const requestImpl = url.protocol === \"https:\" ? httpsRequest : httpRequest;\n\n  return new Promise((resolve, reject) => {\n    const req = requestImpl({\n      protocol: url.protocol,\n      hostname: url.hostname,\n      port: url.port,\n      path: `${url.pathname}${url.search}`,\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        \"content-length\": Buffer.byteLength(body),\n      },\n      lookup: createGatewayLookup(url),\n    }, (res) => {\n      const statusCode = res.statusCode ?? 0;\n      const chunks: Buffer[] = [];\n      res.on(\"data\", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));\n      res.on(\"end\", () => {\n        const responseText = Buffer.concat(chunks).toString(\"utf-8\");\n        const parsed = parseJsonObject(responseText);\n        if (statusCode < 200 || statusCode >= 300) {\n          reject(new Error(typeof parsed.error === \"string\" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));\n          return;\n        }\n        resolve(parsed);\n      });\n    });\n\n    req.setTimeout(timeoutMs, () => {\n      req.destroy(new Error(`Gateway request timed out after ${timeoutMs}ms`));\n    });\n    req.on(\"error\", reject);\n    req.end(body);\n  });\n}\n\nfunction parseJsonObject(value: string): Record<string, unknown> {\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/packages/daemon/dist/cloud-config.test.js

@@ -5,7 +5,30 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
 import { loadConfig } from "./config.js";
-import { createGatewayLookup, exchangePairingCode, parseCloudGatewayUrl, redactedCloudStatus, saveCloudConfig } from "./cloud-config.js";
+import { createGatewayLookup, exchangePairingCode, parseCloudGatewayUrl, postJsonToValidatedGateway, redactedCloudStatus, saveCloudConfig } from "./cloud-config.js";
+// Start a loopback server, returning its base URL; skips the test under sandbox EPERM.
+async function listenLoopback(t, handler) {
+    const server = createServer(handler);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return null;
+        }
+        throw err;
+    }
+    const address = server.address();
+    assert.ok(address && typeof address === "object");
+    return {
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        close: () => new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve())),
+    };
+}
 // Invoke a gateway lookup and capture (err, result) from its Node-style callback.
 function runGatewayLookup(url, options) {
     const lookup = createGatewayLookup(new URL(url));
@@ -100,6 +123,33 @@ test("pairing exchange rejects unsafe gateway URLs before making requests", asyn
         globalThis.fetch = originalFetch;
     }
 });
+test("postJsonToValidatedGateway rejects when the gateway never responds", async (t) => {
+    // Handler that accepts the request but never sends a response — the hung-server case.
+    const server = await listenLoopback(t, () => { });
+    if (!server)
+        return;
+    try {
+        await assert.rejects(postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200), /timed out after 200ms/);
+    }
+    finally {
+        await server.close();
+    }
+});
+test("postJsonToValidatedGateway resolves a fast healthy response before the timeout", async (t) => {
+    const server = await listenLoopback(t, (_req, res) => {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end("{}");
+    });
+    if (!server)
+        return;
+    try {
+        const body = await postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200);
+        assert.deepEqual(body, {});
+    }
+    finally {
+        await server.close();
+    }
+});
 test("pairing exchange posts to a validated gateway URL", async (t) => {
     let requestedUrl = "";
     let requestBody = "";