@privos_ai/app-server 0.10.2 → 0.11.0

package/dist/cli/commands/lint.d.ts

@@ -2,7 +2,10 @@
  * `privos-app lint [manifestPath]` — identical behavior to the original
  * `privos-app-lint` binary (byte-identical stdout/stderr and exit code).
  * `src/manifest-lint-cli.ts` delegates here so the compatibility alias never
- * drifts from this implementation.
+ * drifts from this implementation. Runs the base manifest lint plus, when
+ * the manifest declares `executionMode: "INSTANT"`, the Phase 11 INSTANT
+ * rule set (`manifest-lint-instant.ts`) — dispatched here, the single call
+ * site both bins share, so the alias can never drift out of sync with it.
  */
 export declare function runLint(argv: readonly string[]): number;
 //# sourceMappingURL=lint.d.ts.map

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAavD"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAuBvD"}

package/dist/cli/commands/lint.js

@@ -1,11 +1,15 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { lintInstantManifest } from '../../manifest-lint-instant.js';
 import { lintManifest } from '../../manifest-tools.js';
 /**
  * `privos-app lint [manifestPath]` — identical behavior to the original
  * `privos-app-lint` binary (byte-identical stdout/stderr and exit code).
  * `src/manifest-lint-cli.ts` delegates here so the compatibility alias never
- * drifts from this implementation.
+ * drifts from this implementation. Runs the base manifest lint plus, when
+ * the manifest declares `executionMode: "INSTANT"`, the Phase 11 INSTANT
+ * rule set (`manifest-lint-instant.ts`) — dispatched here, the single call
+ * site both bins share, so the alias can never drift out of sync with it.
  */
 export function runLint(argv) {
     const manifestPath = path.resolve(argv[0] || 'privos-app.json');
@@ -17,8 +21,18 @@ export function runLint(argv) {
         console.error(JSON.stringify({ valid: false, errors: [`Unable to read valid JSON from ${manifestPath}`] }, null, 2));
         return 1;
     }
-    const result = lintManifest(manifest);
-    console.log(JSON.stringify({ manifestPath, ...result }, null, 2));
-    return result.valid ? 0 : 1;
+    const base = lintManifest(manifest);
+    const instant = lintInstantManifest(manifest, { manifestDir: path.dirname(manifestPath) });
+    const errors = [...base.errors, ...instant.errors];
+    const valid = base.valid && instant.errors.length === 0;
+    const output = {
+        manifestPath,
+        ...base,
+        errors,
+        valid,
+        ...(instant.warnings.length ? { warnings: instant.warnings } : {}),
+    };
+    console.log(JSON.stringify(output, null, 2));
+    return valid ? 0 : 1;
 }
 //# sourceMappingURL=lint.js.map

package/dist/cli/commands/lint.js.map

@@ -1 +1 @@
-{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAuB;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAChE,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,kCAAkC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,IAAuB;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAChE,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,kCAAkC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG;QACd,YAAY;QACZ,GAAG,IAAI;QACP,MAAM;QACN,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -37,6 +37,8 @@ export { serveApp, DEFAULT_SERVE_APP_PORT } from './serve-app.js';
 export type { ServeAppOptions, ServeAppHandle, ServeAppHandlerContext, ServeAppTransportOverride, ServeAppTestSeams, } from './serve-app.js';
 export { resolveRuntimeMode, RuntimeModeError } from './runtime-mode.js';
 export type { RuntimeMode, RuntimeModeResolution, RuntimeModeErrorCode, ResolveRuntimeModeOptions, } from './runtime-mode.js';
+export { RUNTIME_V3_SECURITY_MODE_ENV_KEY, RUNTIME_V3_TRUST_ENV_KEY, RUNTIME_V3_ALLOW_UNSIGNED_READINESS_ENV_KEY, isRuntimeV3SecurityModeEnv, parseRuntimeV3Env, } from './runtime-v3-env.js';
+export type { RuntimeV3EnvConfig } from './runtime-v3-env.js';
 export { DEFAULT_WORKLOAD_SOCKET, WorkloadIdentityClient, WorkloadIdentityError, WorkloadPermissionDeniedError, RoomBoundWorkloadClient, getWorkloadIdentityClient, } from './workload/workload-identity.js';
 export type { EffectiveCapabilities, WorkloadBinding, WorkloadBrokerContext, WorkloadBrokerResponse, WorkloadFetchInit, RoomBoundWorkloadFetchInit, WorkloadIdentityClientOptions, WorkloadIdentityErrorCode, } from './workload/workload-identity.js';
 export { dispatchRejectionCode, dispatchRejectionReason, BoundedRuntimeDispatchReplayConsumerV3, assertRuntimeDispatchRelayAffinityV3, assertRuntimeDispatchTrustConfigurationV3, extractRuntimeDispatchRelayEnvelopeV3, isExactRuntimeReadinessRpcV3, isUnsignedRuntimeReadinessRpcV3, parseRuntimeDispatchTrustV3Json, sha256RuntimeDispatchBodyV3, verifyClusterDispatchAssertionV3, verifyDispatchAssertion, verifyRuntimeDispatchAssertionV3, } from './workload/dispatch-assertion.js';
@@ -45,6 +47,8 @@ export { createPinnedPortalJwksResolverV3, createPublisherRuntimeTrustProvisioni
 export type { PublisherPortalJwksResolutionV3, PublisherPortalJwksResolverV3, PublisherRuntimeTrustActiveEvidenceV3, PublisherRuntimeTrustDurableStoreV3, PublisherRuntimeTrustEvidenceV3, PublisherRuntimeTrustOperationV3, PublisherRuntimeTrustPreparedEvidenceV3, PublisherRuntimeTrustProvisioningRequestV3, PublisherRuntimeTrustProvisioningRouterOptionsV3, PublisherRuntimeTrustStoreMutationV3, } from './workload/publisher-runtime-trust.js';
 export { canonicalJson, canonicalJsonValue, lintManifest, lintManifestV2, sha256CanonicalJson, SUPPORTED_MANIFEST_SCHEMA_VERSIONS, } from './manifest-tools.js';
 export type { ManifestLintResult } from './manifest-tools.js';
+export { INSTANT_EXECUTION_MODE, INSTANT_UI_ENTRY_POINT_SLOTS, lintInstantManifest, } from './manifest-lint-instant.js';
+export type { InstantManifestAgent, InstantManifestLintResult, InstantManifestUi, InstantUiEntryPoint, InstantUiEntryPointSlot, } from './manifest-lint-instant.js';
 export { serveBuiltUi } from './ui/serve-built-ui.js';
 export type { ServeBuiltUi, ServeBuiltUiOptions } from './ui/serve-built-ui.js';
 export { MCP_UI_ASSET_FILENAME_RE, MCP_UI_ASSET_EXTENSIONS, deriveAssetUriPrefix, } from './ui/asset-filename-rule.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACxE,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,eAAe,GACf,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,qBAAqB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACX,SAAS,EACT,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACX,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,+BAA+B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,8BAA8B,EAC9B,kBAAkB,EAClB,WAAW,GACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,OAAO,EACN,gCAAgC,EAChC,wCAAwC,EACxC,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,EAC7B,oCAAoC,EACpC,wCAAwC,GACxC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACX,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACX,+BAA+B,EAC/B,iCAAiC,EACjC,wCAAwC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACN,4BAA4B,EAC5B,yBAAyB,EACzB,yCAAyC,EACzC,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,sCAAsC,GACtC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EACN,uBAAuB,EACvB,2CAA2C,EAC3C,oCAAoC,EACpC,6BAA6B,EAC7B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EACX,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACX,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACX,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,kCAAkC,EAClC,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,8BAA8B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,gCAAgC,EAChC,uCAAuC,EACvC,0CAA0C,EAC1C,gDAAgD,EAChD,oCAAoC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EACN,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACxE,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,eAAe,GACf,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,qBAAqB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACX,SAAS,EACT,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACX,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,+BAA+B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,8BAA8B,EAC9B,kBAAkB,EAClB,WAAW,GACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,OAAO,EACN,gCAAgC,EAChC,wCAAwC,EACxC,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,EAC7B,oCAAoC,EACpC,wCAAwC,GACxC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACX,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACX,+BAA+B,EAC/B,iCAAiC,EACjC,wCAAwC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACN,4BAA4B,EAC5B,yBAAyB,EACzB,yCAAyC,EACzC,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,sCAAsC,GACtC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EACN,uBAAuB,EACvB,2CAA2C,EAC3C,oCAAoC,EACpC,6BAA6B,EAC7B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EACX,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACX,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,gCAAgC,EAChC,wBAAwB,EACxB,2CAA2C,EAC3C,0BAA0B,EAC1B,iBAAiB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACX,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,kCAAkC,EAClC,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,8BAA8B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,gCAAgC,EAChC,uCAAuC,EACvC,0CAA0C,EAC1C,gDAAgD,EAChD,oCAAoC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACX,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,GACvB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EACN,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -19,10 +19,12 @@ export { AGENT_BOT_CREDENTIAL_ENV_KEY, AGENT_BOT_USER_ID_ENV_KEY, AGENT_BOT_CRED
 export { createAgentBotHubClient, createAgentBotHubClientFromWorkloadIdentity, createAgentBotHubClientFromHubOrigin, AgentBotCredentialAbsentError, AgentBotHubUnreachableError, } from './relay/hub-rest-as-bot-client.js';
 export { serveApp, DEFAULT_SERVE_APP_PORT } from './serve-app.js';
 export { resolveRuntimeMode, RuntimeModeError } from './runtime-mode.js';
+export { RUNTIME_V3_SECURITY_MODE_ENV_KEY, RUNTIME_V3_TRUST_ENV_KEY, RUNTIME_V3_ALLOW_UNSIGNED_READINESS_ENV_KEY, isRuntimeV3SecurityModeEnv, parseRuntimeV3Env, } from './runtime-v3-env.js';
 export { DEFAULT_WORKLOAD_SOCKET, WorkloadIdentityClient, WorkloadIdentityError, WorkloadPermissionDeniedError, RoomBoundWorkloadClient, getWorkloadIdentityClient, } from './workload/workload-identity.js';
 export { dispatchRejectionCode, dispatchRejectionReason, BoundedRuntimeDispatchReplayConsumerV3, assertRuntimeDispatchRelayAffinityV3, assertRuntimeDispatchTrustConfigurationV3, extractRuntimeDispatchRelayEnvelopeV3, isExactRuntimeReadinessRpcV3, isUnsignedRuntimeReadinessRpcV3, parseRuntimeDispatchTrustV3Json, sha256RuntimeDispatchBodyV3, verifyClusterDispatchAssertionV3, verifyDispatchAssertion, verifyRuntimeDispatchAssertionV3, } from './workload/dispatch-assertion.js';
 export { createPinnedPortalJwksResolverV3, createPublisherRuntimeTrustProvisioningRouterV3, SingleProcessFilePublisherRuntimeTrustStoreV3, } from './workload/publisher-runtime-trust.js';
 export { canonicalJson, canonicalJsonValue, lintManifest, lintManifestV2, sha256CanonicalJson, SUPPORTED_MANIFEST_SCHEMA_VERSIONS, } from './manifest-tools.js';
+export { INSTANT_EXECUTION_MODE, INSTANT_UI_ENTRY_POINT_SLOTS, lintInstantManifest, } from './manifest-lint-instant.js';
 export { serveBuiltUi } from './ui/serve-built-ui.js';
 export { MCP_UI_ASSET_FILENAME_RE, MCP_UI_ASSET_EXTENSIONS, deriveAssetUriPrefix, } from './ui/asset-filename-rule.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQxE,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AASlC,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AAYjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACN,gCAAgC,EAChC,wCAAwC,EACxC,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,EAC7B,oCAAoC,EACpC,wCAAwC,GACxC,MAAM,gCAAgC,CAAC;AAQxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACN,4BAA4B,EAC5B,yBAAyB,EACzB,yCAAyC,EACzC,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,sCAAsC,GACtC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACN,uBAAuB,EACvB,2CAA2C,EAC3C,oCAAoC,EACpC,6BAA6B,EAC7B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAC;AAO3C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AASlE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQzE,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAWzC,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAmB1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAc/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EACN,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQxE,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AASlC,OAAO,EACN,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AAYjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACN,gCAAgC,EAChC,wCAAwC,EACxC,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,EAC7B,oCAAoC,EACpC,wCAAwC,GACxC,MAAM,gCAAgC,CAAC;AAQxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACN,4BAA4B,EAC5B,yBAAyB,EACzB,yCAAyC,EACzC,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,sCAAsC,GACtC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACN,uBAAuB,EACvB,2CAA2C,EAC3C,oCAAoC,EACpC,6BAA6B,EAC7B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAC;AAO3C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AASlE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQzE,OAAO,EACN,gCAAgC,EAChC,wBAAwB,EACxB,2CAA2C,EAC3C,0BAA0B,EAC1B,iBAAiB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAWzC,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAmB1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAc/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AASpC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EACN,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,6BAA6B,CAAC"}

package/dist/manifest-lint-cli.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 // Compatibility alias for `privos-app lint`: kept as its own bin entry
 // (`privos-app-lint`) with byte-identical output and exit code, delegating
-// to the same implementation so the two can never drift.
+// to the same implementation so the two can never drift. That includes the
+// Phase 11 executionMode: "INSTANT" rule set — `runLint` (cli/commands/lint.ts)
+// dispatches to `lintInstantManifest` (manifest-lint-instant.ts), so both this
+// alias and the `privos-app lint` subcommand pick it up identically.
 import { runLint } from './cli/commands/lint.js';
 process.exit(runLint(process.argv.slice(2)));
 //# sourceMappingURL=manifest-lint-cli.js.map

package/dist/manifest-lint-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-lint-cli.js","sourceRoot":"","sources":["../src/manifest-lint-cli.ts"],"names":[],"mappings":";AACA,uEAAuE;AACvE,2EAA2E;AAC3E,yDAAyD;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEjD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"manifest-lint-cli.js","sourceRoot":"","sources":["../src/manifest-lint-cli.ts"],"names":[],"mappings":";AACA,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,qEAAqE;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEjD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/manifest-lint-instant.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Lint rules for `executionMode: "INSTANT"` manifests — frontend-only PrivOS
+ * apps with no runtime (Phase 11: "Instant MCP Apps"). Every check here is
+ * enforced only when the manifest declares `executionMode: "INSTANT"`; any
+ * other manifest is untouched by this module.
+ *
+ * The optional `agent` section caps mirror the size caps privos-hub's
+ * `sanitizeAgentData` enforces server-side
+ * (`server/services/agent-export-import/sanitize-agent-data.ts`), which
+ * *truncates* silently. Here a cap breach is a publish-time lint error naming
+ * the field instead — a publisher should never discover a truncated persona
+ * only after install. The two repos do not share a package, so the numbers
+ * below are kept in sync by hand.
+ */
+export declare const INSTANT_EXECUTION_MODE: "INSTANT";
+/** The three room surfaces the Hub models a UI-only entry point for. */
+export declare const INSTANT_UI_ENTRY_POINT_SLOTS: readonly ["roomTab", "sidebar", "standalone"];
+export type InstantUiEntryPointSlot = (typeof INSTANT_UI_ENTRY_POINT_SLOTS)[number];
+export type InstantUiEntryPoint = Readonly<{
+    title: string;
+    /** `ui://<appId>/<file>.html` — `<appId>` must equal the manifest's `name`. */
+    resourceUri: string;
+}>;
+export type InstantManifestUi = Readonly<{
+    entryPoints: Readonly<Partial<Record<InstantUiEntryPointSlot, InstantUiEntryPoint>>>;
+}>;
+export type InstantManifestAgent = Readonly<{
+    purpose: string;
+    instructions?: string;
+    personality?: string;
+    knowledge?: readonly string[];
+    /**
+     * Bounded at install time by the Hub against the workspace's bot
+     * permission catalog (`buildBotKeyCatalogPatterns`) minus
+     * `BOT_BEARER_DENIED_V1_PREFIXES` — a manifest can only narrow. Not part
+     * of `sanitizeAgentData`'s fixed field set, so no length cap applies here.
+     */
+    hubTools?: readonly string[];
+}>;
+export type InstantManifestLintResult = Readonly<{
+    errors: readonly string[];
+    warnings: readonly string[];
+}>;
+/**
+ * Lints the INSTANT-only rules on top of `lintManifest`'s base checks. A
+ * no-op (empty errors/warnings) for any manifest that does not declare
+ * `executionMode: "INSTANT"`. `options.manifestDir` — the directory holding
+ * `privos-app.json` — enables the Dockerfile-presence warning; omit it to
+ * skip that check (e.g. when linting an in-memory manifest with no project
+ * directory on disk).
+ */
+export declare function lintInstantManifest(manifest: unknown, options?: {
+    manifestDir?: string;
+}): InstantManifestLintResult;
+//# sourceMappingURL=manifest-lint-instant.d.ts.map

package/dist/manifest-lint-instant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-lint-instant.d.ts","sourceRoot":"","sources":["../src/manifest-lint-instant.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,sBAAsB,EAAG,SAAkB,CAAC;AAEzD,wEAAwE;AACxE,eAAO,MAAM,4BAA4B,+CAAgD,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACxC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;CACrF,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AA4IH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,yBAAyB,CAYxH"}

package/dist/manifest-lint-instant.js

@@ -0,0 +1,174 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * Lint rules for `executionMode: "INSTANT"` manifests — frontend-only PrivOS
+ * apps with no runtime (Phase 11: "Instant MCP Apps"). Every check here is
+ * enforced only when the manifest declares `executionMode: "INSTANT"`; any
+ * other manifest is untouched by this module.
+ *
+ * The optional `agent` section caps mirror the size caps privos-hub's
+ * `sanitizeAgentData` enforces server-side
+ * (`server/services/agent-export-import/sanitize-agent-data.ts`), which
+ * *truncates* silently. Here a cap breach is a publish-time lint error naming
+ * the field instead — a publisher should never discover a truncated persona
+ * only after install. The two repos do not share a package, so the numbers
+ * below are kept in sync by hand.
+ */
+export const INSTANT_EXECUTION_MODE = 'INSTANT';
+/** The three room surfaces the Hub models a UI-only entry point for. */
+export const INSTANT_UI_ENTRY_POINT_SLOTS = ['roomTab', 'sidebar', 'standalone'];
+/**
+ * Fields a runtime app may declare that an INSTANT app never may — there is
+ * no container, no relay, no OCI image, so nothing configures one.
+ */
+const FORBIDDEN_INSTANT_FIELDS = [
+    'tools',
+    'serverUrl',
+    'runtimeTrustProvisioningUrl',
+    'port',
+    'resources',
+    'volumes',
+    'stateless',
+];
+// Kept identical to privos-hub's sanitizeAgentData caps by hand (see module
+// doc comment above) — a lint pass here must reject exactly what the Hub
+// would otherwise truncate silently.
+const AGENT_PURPOSE_MAX_LEN = 2000;
+const AGENT_PERSONALITY_MAX_LEN = 2000;
+const AGENT_INSTRUCTIONS_MAX_LEN = 5000;
+const AGENT_KNOWLEDGE_MAX_ITEMS = 20;
+const AGENT_KNOWLEDGE_ITEM_MAX_LEN = 500;
+const ENTRY_POINT_RESOURCE_URI_RE = /^ui:\/\/([A-Za-z0-9][A-Za-z0-9._-]*)\/([A-Za-z0-9][A-Za-z0-9._-]*\.html)$/;
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function collectForbiddenFieldErrors(manifest) {
+    return FORBIDDEN_INSTANT_FIELDS
+        .filter((field) => manifest[field] !== undefined)
+        .map((field) => `${field} is forbidden for executionMode: "INSTANT" (frontend-only apps have no runtime to configure)`);
+}
+function collectUiEntryPointErrors(manifest) {
+    const errors = [];
+    const ui = manifest.ui;
+    const entryPointsRaw = isRecord(ui) ? ui.entryPoints : undefined;
+    if (!isRecord(entryPointsRaw)) {
+        errors.push('ui.entryPoints is required for executionMode: "INSTANT"');
+        return errors;
+    }
+    const entryPoints = entryPointsRaw;
+    if (entryPoints.roomTab === undefined) {
+        errors.push('ui.entryPoints.roomTab is required for executionMode: "INSTANT"');
+    }
+    const appId = typeof manifest.name === 'string' && manifest.name.trim() ? manifest.name : undefined;
+    for (const [slot, rawSlot] of Object.entries(entryPoints)) {
+        if (!INSTANT_UI_ENTRY_POINT_SLOTS.includes(slot)) {
+            errors.push(`ui.entryPoints.${slot} is not a supported slot (expected one of ${INSTANT_UI_ENTRY_POINT_SLOTS.join(', ')})`);
+            continue;
+        }
+        if (!isRecord(rawSlot)) {
+            errors.push(`ui.entryPoints.${slot} must be an object`);
+            continue;
+        }
+        if (typeof rawSlot.title !== 'string' || !rawSlot.title.trim()) {
+            errors.push(`ui.entryPoints.${slot}.title must be a non-empty string`);
+        }
+        const resourceUri = rawSlot.resourceUri;
+        const match = typeof resourceUri === 'string' ? ENTRY_POINT_RESOURCE_URI_RE.exec(resourceUri) : null;
+        if (!match) {
+            errors.push(`ui.entryPoints.${slot}.resourceUri must match "ui://<appId>/<file>.html"`);
+        }
+        else if (appId && match[1] !== appId) {
+            errors.push(`ui.entryPoints.${slot}.resourceUri must be namespaced under this manifest's "name" (expected host "${appId}")`);
+        }
+    }
+    return errors;
+}
+function collectAgentSectionErrors(manifest) {
+    const agent = manifest.agent;
+    if (agent === undefined)
+        return [];
+    if (!isRecord(agent))
+        return ['agent must be an object'];
+    const errors = [];
+    const purpose = agent.purpose;
+    if (typeof purpose !== 'string' || !purpose.trim()) {
+        errors.push('agent.purpose must be a non-empty string');
+    }
+    else if (purpose.length > AGENT_PURPOSE_MAX_LEN) {
+        errors.push(`agent.purpose exceeds the maximum length of ${AGENT_PURPOSE_MAX_LEN} characters`);
+    }
+    const instructions = agent.instructions;
+    if (instructions !== undefined) {
+        if (typeof instructions !== 'string')
+            errors.push('agent.instructions must be a string');
+        else if (instructions.length > AGENT_INSTRUCTIONS_MAX_LEN) {
+            errors.push(`agent.instructions exceeds the maximum length of ${AGENT_INSTRUCTIONS_MAX_LEN} characters`);
+        }
+    }
+    const personality = agent.personality;
+    if (personality !== undefined) {
+        if (typeof personality !== 'string')
+            errors.push('agent.personality must be a string');
+        else if (personality.length > AGENT_PERSONALITY_MAX_LEN) {
+            errors.push(`agent.personality exceeds the maximum length of ${AGENT_PERSONALITY_MAX_LEN} characters`);
+        }
+    }
+    const knowledge = agent.knowledge;
+    if (knowledge !== undefined) {
+        if (!Array.isArray(knowledge) || knowledge.some((item) => typeof item !== 'string')) {
+            errors.push('agent.knowledge must be an array of strings');
+        }
+        else {
+            if (knowledge.length > AGENT_KNOWLEDGE_MAX_ITEMS) {
+                errors.push(`agent.knowledge exceeds the maximum of ${AGENT_KNOWLEDGE_MAX_ITEMS} items`);
+            }
+            knowledge.forEach((item, index) => {
+                if (item.length > AGENT_KNOWLEDGE_ITEM_MAX_LEN) {
+                    errors.push(`agent.knowledge[${index}] exceeds the maximum length of ${AGENT_KNOWLEDGE_ITEM_MAX_LEN} characters`);
+                }
+            });
+        }
+    }
+    const hubTools = agent.hubTools;
+    if (hubTools !== undefined) {
+        if (!Array.isArray(hubTools) || hubTools.some((item) => typeof item !== 'string' || !item.trim())) {
+            errors.push('agent.hubTools must be an array of non-empty strings');
+        }
+    }
+    return errors;
+}
+function collectDockerfileWarning(manifestDir) {
+    if (!manifestDir)
+        return [];
+    try {
+        if (fs.existsSync(path.join(manifestDir, 'Dockerfile'))) {
+            return ['Dockerfile is present alongside executionMode: "INSTANT" — it is ignored (no image is ever built for a frontend-only app)'];
+        }
+    }
+    catch {
+        // Best-effort only; an unreadable directory must not fail the lint.
+    }
+    return [];
+}
+/**
+ * Lints the INSTANT-only rules on top of `lintManifest`'s base checks. A
+ * no-op (empty errors/warnings) for any manifest that does not declare
+ * `executionMode: "INSTANT"`. `options.manifestDir` — the directory holding
+ * `privos-app.json` — enables the Dockerfile-presence warning; omit it to
+ * skip that check (e.g. when linting an in-memory manifest with no project
+ * directory on disk).
+ */
+export function lintInstantManifest(manifest, options = {}) {
+    const value = isRecord(manifest) ? manifest : {};
+    if (value.executionMode !== INSTANT_EXECUTION_MODE) {
+        return Object.freeze({ errors: Object.freeze([]), warnings: Object.freeze([]) });
+    }
+    const errors = [
+        ...collectForbiddenFieldErrors(value),
+        ...collectUiEntryPointErrors(value),
+        ...collectAgentSectionErrors(value),
+    ];
+    const warnings = collectDockerfileWarning(options.manifestDir);
+    return Object.freeze({ errors: Object.freeze(errors), warnings: Object.freeze(warnings) });
+}
+//# sourceMappingURL=manifest-lint-instant.js.map

package/dist/manifest-lint-instant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-lint-instant.js","sourceRoot":"","sources":["../src/manifest-lint-instant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAkB,CAAC;AAEzD,wEAAwE;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAgC1F;;;GAGG;AACH,MAAM,wBAAwB,GAAG;IAChC,OAAO;IACP,WAAW;IACX,6BAA6B;IAC7B,MAAM;IACN,WAAW;IACX,SAAS;IACT,WAAW;CACF,CAAC;AAEX,4EAA4E;AAC5E,yEAAyE;AACzE,qCAAqC;AACrC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AACvC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC,MAAM,2BAA2B,GAAG,2EAA2E,CAAC;AAEhH,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAiC;IACrE,OAAO,wBAAwB;SAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;SAChD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,8FAA8F,CAAC,CAAC;AAC1H,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAiC;IACnE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,MAAM,cAAc,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC;IACnC,IAAI,WAAW,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAE,4BAAkD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,6CAA6C,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3H,SAAS;QACV,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,oBAAoB,CAAC,CAAC;YACxD,SAAS;QACV,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,mCAAmC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrG,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,oDAAoD,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,gFAAgF,KAAK,IAAI,CAAC,CAAC;QAC9H,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAiC;IACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,+CAA+C,qBAAqB,aAAa,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;aACpF,IAAI,YAAY,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,oDAAoD,0BAA0B,aAAa,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;aAClF,IAAI,WAAW,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,mDAAmD,yBAAyB,aAAa,CAAC,CAAC;QACxG,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACP,IAAI,SAAS,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,0CAA0C,yBAAyB,QAAQ,CAAC,CAAC;YAC1F,CAAC;YACD,SAAS,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;gBACjD,IAAI,IAAI,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;oBAChD,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,mCAAmC,4BAA4B,aAAa,CAAC,CAAC;gBACnH,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,WAA+B;IAChE,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC;QACJ,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,2HAA2H,CAAC,CAAC;QACtI,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAiB,EAAE,UAAoC,EAAE;IAC5F,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,aAAa,KAAK,sBAAsB,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG;QACd,GAAG,2BAA2B,CAAC,KAAK,CAAC;QACrC,GAAG,yBAAyB,CAAC,KAAK,CAAC;QACnC,GAAG,yBAAyB,CAAC,KAAK,CAAC;KACnC,CAAC;IACF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC"}

package/dist/runtime-mode.d.ts

@@ -1,11 +1,14 @@
-export type RuntimeMode = 'managed' | 'standalone-production' | 'development';
+import { type RuntimeV3EnvConfig } from './runtime-v3-env.js';
+export type RuntimeMode = 'managed' | 'runtime-v3' | 'standalone-production' | 'development';
 export type RuntimeModeResolution = Readonly<{
     mode: RuntimeMode;
     reason: string;
     workloadSocketPath: string;
     standaloneIdentityFilePath: string;
+    /** Present only when `mode === 'runtime-v3'`: the driver's parsed dispatch trust + unsigned-readiness posture. */
+    runtimeV3?: RuntimeV3EnvConfig;
 }>;
-export type RuntimeModeErrorCode = 'AMBIGUOUS_RUNTIME_IDENTITY' | 'PRODUCTION_WITHOUT_IDENTITY' | 'TRANSPORT_OVERRIDE_NOT_ALLOWED';
+export type RuntimeModeErrorCode = 'AMBIGUOUS_RUNTIME_IDENTITY' | 'PRODUCTION_WITHOUT_IDENTITY' | 'TRANSPORT_OVERRIDE_NOT_ALLOWED' | 'RUNTIME_V3_TRUST_INVALID';
 export declare class RuntimeModeError extends Error {
     readonly code: RuntimeModeErrorCode;
     constructor(code: RuntimeModeErrorCode, message: string);

package/dist/runtime-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-mode.d.ts","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAE9E,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0BAA0B,EAAE,MAAM,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAC7B,4BAA4B,GAC5B,6BAA6B,GAC7B,gCAAgC,CAAC;AAEpC,qBAAa,gBAAiB,SAAQ,KAAK;aAEzB,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EAC1C,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD,CAAC,CAAC;AAEH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,qBAAqB,CAuDjG"}
+{"version":3,"file":"runtime-mode.d.ts","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAiD,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7G,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,YAAY,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAE7F,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0BAA0B,EAAE,MAAM,CAAC;IACnC,kHAAkH;IAClH,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAC7B,4BAA4B,GAC5B,6BAA6B,GAC7B,gCAAgC,GAChC,0BAA0B,CAAC;AAE9B,qBAAa,gBAAiB,SAAQ,KAAK;aAEzB,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EAC1C,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD,CAAC,CAAC;AAEH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,qBAAqB,CA4EjG"}

package/dist/runtime-mode.js

@@ -1,24 +1,37 @@
 /**
- * Resolves exactly one of the three supported runtime modes so an app never
+ * Resolves exactly one of the four supported runtime modes so an app never
  * has to hand-roll the decision (or silently default into the wrong one):
  *
  * - `managed`   — a workload identity socket is present (current production
  *                 cluster-routed path).
+ * - `runtime-v3` — the local-runtime driver's env selects it
+ *                 (`PRIVOS_RUNTIME_SECURITY_MODE=runtime-v3` +
+ *                 `PRIVOS_RUNTIME_DISPATCH_TRUST_V3`); inbound dispatch is the
+ *                 Hub-signed runtime-v3 assertion (+ the unsigned
+ *                 pre-activation readiness triple when the driver allows it),
+ *                 outbound identity is the MANAGED broker socket when present.
  * - `standalone-production` — a paired standalone identity file is present
  *                 (phase 3); Relay transport with mandatory assertion
  *                 verification, `NODE_ENV=production` allowed.
- * - `development` — neither is present; only permitted when `NODE_ENV` is
- *                 not `production` (the current, unchanged legacy behavior).
+ * - `development` — none of the above is present; only permitted when
+ *                 `NODE_ENV` is not `production` (the current, unchanged
+ *                 legacy behavior).
  *
- * Precedence is managed > standalone-production > development. Both a
- * workload socket AND a standalone identity file present is a configuration
- * error, never a silent pick — running both at once means either stale
- * leftover state from a prior deployment mode, or a misconfigured host, and
- * guessing which one the operator meant would be unsafe.
+ * Precedence: the driver env (`runtime-v3`) is checked first — a standalone
+ * identity file present alongside it is an `AMBIGUOUS_RUNTIME_IDENTITY`
+ * configuration error, but the MANAGED workload socket may coexist (it is
+ * runtime-v3's outbound identity, not a competing inbound mode). Absent the
+ * driver env, precedence is unchanged: managed > standalone-production >
+ * development, and a workload socket AND a standalone identity file both
+ * present is likewise a configuration error, never a silent pick — running
+ * both at once means either stale leftover state from a prior deployment
+ * mode, or a misconfigured host, and guessing which one the operator meant
+ * would be unsafe.
  */
 import fsSync from 'node:fs';
 import { DEFAULT_WORKLOAD_SOCKET } from './workload/workload-identity.js';
 import { DEFAULT_STANDALONE_IDENTITY_FILE, standaloneIdentityFileExists } from './relay/standalone-identity.js';
+import { isRuntimeV3SecurityModeEnv, parseRuntimeV3Env } from './runtime-v3-env.js';
 export class RuntimeModeError extends Error {
     code;
     constructor(code, message) {
@@ -35,6 +48,23 @@ export function resolveRuntimeMode(options = {}) {
     const standaloneIdentityExists = options.standaloneIdentityExists ?? ((path) => standaloneIdentityFileExists({ filePath: path }));
     const managedPresent = workloadSocketExists(workloadSocketPath);
     const standalonePresent = standaloneIdentityExists(standaloneIdentityFilePath);
+    if (isRuntimeV3SecurityModeEnv(env)) {
+        if (standalonePresent) {
+            throw new RuntimeModeError('AMBIGUOUS_RUNTIME_IDENTITY', `Both PRIVOS_RUNTIME_SECURITY_MODE=runtime-v3 and a standalone identity file (${standaloneIdentityFilePath}) ` +
+                'are present. Refusing to silently pick a runtime mode — remove whichever one does not apply to this ' +
+                'deployment (stale leftover state from a prior mode is the usual cause).');
+        }
+        const runtimeV3 = parseRuntimeV3Env(env);
+        return Object.freeze({
+            mode: 'runtime-v3',
+            reason: managedPresent
+                ? `PRIVOS_RUNTIME_SECURITY_MODE=runtime-v3, with a workload identity socket present at ${workloadSocketPath} for outbound Hub calls`
+                : 'PRIVOS_RUNTIME_SECURITY_MODE=runtime-v3',
+            workloadSocketPath,
+            standaloneIdentityFilePath,
+            runtimeV3,
+        });
+    }
     if (managedPresent && standalonePresent) {
         throw new RuntimeModeError('AMBIGUOUS_RUNTIME_IDENTITY', `Both a managed workload identity socket (${workloadSocketPath}) and a standalone identity file ` +
             `(${standaloneIdentityFilePath}) are present. Refusing to silently pick a runtime mode — remove ` +

package/dist/runtime-mode.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-mode.js","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAgBhH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEzB;IADjB,YACiB,IAA0B,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAsB;QAI1C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAcD,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC;IAC/G,MAAM,0BAA0B,GAC/B,OAAO,CAAC,0BAA0B,IAAI,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC;IAC/G,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,wBAAwB,GAC7B,OAAO,CAAC,wBAAwB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1G,MAAM,cAAc,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;IAE/E,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,gBAAgB,CACzB,4BAA4B,EAC5B,4CAA4C,kBAAkB,mCAAmC;YAChG,IAAI,0BAA0B,mEAAmE;YACjG,8GAA8G,CAC/G,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,uCAAuC,kBAAkB,EAAE;YACnE,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,uCAAuC,0BAA0B,EAAE;YAC3E,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CACzB,6BAA6B,EAC7B,yEAAyE;YACxE,IAAI,kBAAkB,2CAA2C,0BAA0B,KAAK;YAChG,gGAAgG;YAChG,0EAA0E,CAC3E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,gGAAgG;QACxG,kBAAkB;QAClB,0BAA0B;KAC1B,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runtime-mode.js","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAChH,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAmB7G,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEzB;IADjB,YACiB,IAA0B,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAsB;QAI1C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAcD,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC;IAC/G,MAAM,0BAA0B,GAC/B,OAAO,CAAC,0BAA0B,IAAI,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC;IAC/G,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,wBAAwB,GAC7B,OAAO,CAAC,wBAAwB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1G,MAAM,cAAc,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;IAE/E,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CACzB,4BAA4B,EAC5B,gFAAgF,0BAA0B,IAAI;gBAC7G,sGAAsG;gBACtG,yEAAyE,CAC1E,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,cAAc;gBACrB,CAAC,CAAC,uFAAuF,kBAAkB,yBAAyB;gBACpI,CAAC,CAAC,yCAAyC;YAC5C,kBAAkB;YAClB,0BAA0B;YAC1B,SAAS;SACT,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,gBAAgB,CACzB,4BAA4B,EAC5B,4CAA4C,kBAAkB,mCAAmC;YAChG,IAAI,0BAA0B,mEAAmE;YACjG,8GAA8G,CAC/G,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,uCAAuC,kBAAkB,EAAE;YACnE,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,uCAAuC,0BAA0B,EAAE;YAC3E,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CACzB,6BAA6B,EAC7B,yEAAyE;YACxE,IAAI,kBAAkB,2CAA2C,0BAA0B,KAAK;YAChG,gGAAgG;YAChG,0EAA0E,CAC3E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,gGAAgG;QACxG,kBAAkB;QAClB,0BAA0B;KAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/runtime-v3-env.d.ts

@@ -0,0 +1,18 @@
+import { type RuntimeDispatchTrustV3 } from './workload/dispatch-assertion.js';
+export declare const RUNTIME_V3_SECURITY_MODE_ENV_KEY = "PRIVOS_RUNTIME_SECURITY_MODE";
+export declare const RUNTIME_V3_TRUST_ENV_KEY = "PRIVOS_RUNTIME_DISPATCH_TRUST_V3";
+export declare const RUNTIME_V3_ALLOW_UNSIGNED_READINESS_ENV_KEY = "PRIVOS_RUNTIME_ALLOW_UNSIGNED_PREACTIVATION_READINESS";
+export type RuntimeV3EnvConfig = Readonly<{
+    trust: RuntimeDispatchTrustV3;
+    allowUnsignedPreactivationReadiness: boolean;
+}>;
+/** True only when the driver has selected `runtime-v3` as the inbound dispatch mode. */
+export declare function isRuntimeV3SecurityModeEnv(env: NodeJS.ProcessEnv): boolean;
+/**
+ * Parses `PRIVOS_RUNTIME_DISPATCH_TRUST_V3` and the unsigned-readiness flag.
+ * Throws `RuntimeModeError('RUNTIME_V3_TRUST_INVALID')` when the trust env var
+ * is missing/unparseable, a required affinity key is missing, or `hubKid` does
+ * not match the JWK's own thumbprint.
+ */
+export declare function parseRuntimeV3Env(env: NodeJS.ProcessEnv): RuntimeV3EnvConfig;
+//# sourceMappingURL=runtime-v3-env.d.ts.map

package/dist/runtime-v3-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-v3-env.d.ts","sourceRoot":"","sources":["../src/runtime-v3-env.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAmC,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAEhH,eAAO,MAAM,gCAAgC,iCAAiC,CAAC;AAC/E,eAAO,MAAM,wBAAwB,qCAAqC,CAAC;AAC3E,eAAO,MAAM,2CAA2C,0DAA0D,CAAC;AAEnH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,mCAAmC,EAAE,OAAO,CAAC;CAC7C,CAAC,CAAC;AAEH,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,CAqB5E"}

package/dist/runtime-v3-env.js

@@ -0,0 +1,48 @@
+/**
+ * Parses and validates the local-runtime driver's `runtime-v3` dispatch env
+ * contract — the exact three variables `runtime-service.ts`'s
+ * `dispatchTrustEnv` emits into the container:
+ *
+ *   - `PRIVOS_RUNTIME_SECURITY_MODE=runtime-v3`
+ *   - `PRIVOS_RUNTIME_DISPATCH_TRUST_V3={hubKid,hubPublicJwk,affinity{…}}`
+ *   - `PRIVOS_RUNTIME_ALLOW_UNSIGNED_PREACTIVATION_READINESS=true|false`
+ *
+ * This module only decides whether the env is present and well-formed enough
+ * to hand to `resolveRuntimeMode`. The actual trust shape rules — required
+ * affinity keys, `hubKid` equal to the JWK's own thumbprint — are the SDK's
+ * existing `assertRuntimeDispatchTrustConfigurationV3`, reused unchanged
+ * through `parseRuntimeDispatchTrustV3Json`. Nothing here re-derives them.
+ */
+import { RuntimeModeError } from './runtime-mode.js';
+import { parseRuntimeDispatchTrustV3Json } from './workload/dispatch-assertion.js';
+export const RUNTIME_V3_SECURITY_MODE_ENV_KEY = 'PRIVOS_RUNTIME_SECURITY_MODE';
+export const RUNTIME_V3_TRUST_ENV_KEY = 'PRIVOS_RUNTIME_DISPATCH_TRUST_V3';
+export const RUNTIME_V3_ALLOW_UNSIGNED_READINESS_ENV_KEY = 'PRIVOS_RUNTIME_ALLOW_UNSIGNED_PREACTIVATION_READINESS';
+/** True only when the driver has selected `runtime-v3` as the inbound dispatch mode. */
+export function isRuntimeV3SecurityModeEnv(env) {
+    return env[RUNTIME_V3_SECURITY_MODE_ENV_KEY] === 'runtime-v3';
+}
+/**
+ * Parses `PRIVOS_RUNTIME_DISPATCH_TRUST_V3` and the unsigned-readiness flag.
+ * Throws `RuntimeModeError('RUNTIME_V3_TRUST_INVALID')` when the trust env var
+ * is missing/unparseable, a required affinity key is missing, or `hubKid` does
+ * not match the JWK's own thumbprint.
+ */
+export function parseRuntimeV3Env(env) {
+    const raw = env[RUNTIME_V3_TRUST_ENV_KEY];
+    if (typeof raw !== 'string' || raw.trim() === '') {
+        throw new RuntimeModeError('RUNTIME_V3_TRUST_INVALID', `${RUNTIME_V3_SECURITY_MODE_ENV_KEY}=runtime-v3 requires ${RUNTIME_V3_TRUST_ENV_KEY} to carry the driver's dispatch trust JSON.`);
+    }
+    let trust;
+    try {
+        trust = parseRuntimeDispatchTrustV3Json(raw);
+    }
+    catch (error) {
+        throw new RuntimeModeError('RUNTIME_V3_TRUST_INVALID', `${RUNTIME_V3_TRUST_ENV_KEY} is not a valid runtime dispatch trust configuration: ${error.message}`);
+    }
+    return Object.freeze({
+        trust,
+        allowUnsignedPreactivationReadiness: env[RUNTIME_V3_ALLOW_UNSIGNED_READINESS_ENV_KEY] === 'true',
+    });
+}
+//# sourceMappingURL=runtime-v3-env.js.map

package/dist/runtime-v3-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-v3-env.js","sourceRoot":"","sources":["../src/runtime-v3-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,+BAA+B,EAA+B,MAAM,kCAAkC,CAAC;AAEhH,MAAM,CAAC,MAAM,gCAAgC,GAAG,8BAA8B,CAAC;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAC3E,MAAM,CAAC,MAAM,2CAA2C,GAAG,uDAAuD,CAAC;AAOnH,wFAAwF;AACxF,MAAM,UAAU,0BAA0B,CAAC,GAAsB;IAChE,OAAO,GAAG,CAAC,gCAAgC,CAAC,KAAK,YAAY,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACvD,MAAM,GAAG,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CACzB,0BAA0B,EAC1B,GAAG,gCAAgC,wBAAwB,wBAAwB,6CAA6C,CAChI,CAAC;IACH,CAAC;IACD,IAAI,KAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,KAAK,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CACzB,0BAA0B,EAC1B,GAAG,wBAAwB,yDAA0D,KAAe,CAAC,OAAO,EAAE,CAC9G,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,KAAK;QACL,mCAAmC,EAAE,GAAG,CAAC,2CAA2C,CAAC,KAAK,MAAM;KAChG,CAAC,CAAC;AACJ,CAAC"}

package/dist/serve-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-app.d.ts","sourceRoot":"","sources":["../src/serve-app.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAEhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAA4B,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAIN,KAAK,kBAAkB,EACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACN,uCAAuC,EAEvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,sBAAsB,EAEtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAoB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EACN,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,MAAM,iCAAiC,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,mFAAmF;AACnF,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,CAAC;IAChC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC/B,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,qEAAqE;IACrE,aAAa,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3F,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,oGAAoG;IACpG,eAAe,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAClE,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,sGAAsG;AACtG,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,yBAAyB,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAC7D,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,uCAAuC,CAAC,EAAE,OAAO,uCAAuC,CAAC;IACzF,YAAY,CAAC,EAAE,OAAO,YAAY,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,uDAAuD;IACvD,SAAS,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAgBD,2KAA2K;AAC3K,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAiNhF"}
+{"version":3,"file":"serve-app.d.ts","sourceRoot":"","sources":["../src/serve-app.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAEhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAA4B,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAIN,KAAK,kBAAkB,EACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACN,uCAAuC,EAEvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,sBAAsB,EAEtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAoB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EACN,yBAAyB,EAEzB,KAAK,sBAAsB,EAC3B,MAAM,iCAAiC,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,mFAAmF;AACnF,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,CAAC;IAChC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC/B,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,qEAAqE;IACrE,aAAa,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3F,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,oGAAoG;IACpG,eAAe,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAClE,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,sGAAsG;AACtG,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,yBAAyB,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAC7D,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,uCAAuC,CAAC,EAAE,OAAO,uCAAuC,CAAC;IACzF,YAAY,CAAC,EAAE,OAAO,YAAY,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,uDAAuD;IACvD,SAAS,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAgBD,2KAA2K;AAC3K,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA4PhF"}

package/dist/serve-app.js

@@ -28,6 +28,14 @@
  *    + the standalone identity controller + agent-bot hub from the paired Hub
  *    origin + `connectRelay` (MCP rides the Relay WebSocket, not HTTP) + the
  *    SDK readiness check. Any persisted agent-bot credential is adopted at boot.
+ *  - runtime-v3: a Direct HTTP router mounted with `runtimeDispatchV3` built
+ *    from the driver's env (inbound: Hub-signed dispatch assertion, or the
+ *    unsigned pre-activation readiness triple when the driver allows it) and
+ *    `workloadSecurity: 'disabled'` (legacy managed dispatch is never accepted
+ *    here). The MANAGED workload identity SINGLETON is used for OUTBOUND Hub
+ *    calls + the capability monitor only when its socket is present — before
+ *    that (e.g. PREACTIVATION with no broker yet) there is no outbound
+ *    identity and the agent-bot hub falls back to the dev Hub origin.
  *
  * `/health` and `/ready` exist in ALL modes (marketplace Docker HEALTHCHECK and
  * the cluster monitor probe them). Ambiguous identity or production-without-
@@ -73,6 +81,8 @@ export async function serveApp(options) {
     const resolution = resolveMode({ env });
     const mode = resolution.mode;
     logger('serveApp.mode_resolved', { mode, reason: resolution.reason });
+    // Only present when mode === 'runtime-v3'; resolveRuntimeMode guarantees it.
+    const runtimeV3 = mode === 'runtime-v3' ? resolution.runtimeV3 : undefined;
     if (options.transportOverride !== undefined && mode !== 'development') {
         // H1: transportOverride is the API form of PRIVOS_TRANSPORT and is a
         // development affordance only. Accepting it under a production mode would
@@ -102,6 +112,33 @@ export async function serveApp(options) {
         agentBotHub = createAgentBotHubClientFromWorkloadIdentity(workloadIdentityClient);
         mountDirectRouter = true;
     }
+    else if (mode === 'runtime-v3') {
+        // Outbound identity is the MANAGED broker socket, but ONLY when it is
+        // actually present: PREACTIVATION (no broker yet) has no outbound
+        // identity at all, and this mode never falls back to the legacy managed
+        // dispatch path the way `getWorkloadIdentityClient()` would suggest.
+        const getClient = options.__test?.getWorkloadIdentityClient ?? getWorkloadIdentityClient;
+        const candidateClient = getClient();
+        if (candidateClient.isAvailable()) {
+            workloadIdentityClient = candidateClient;
+            resolveHubOrigin = async () => {
+                try {
+                    return (await workloadIdentityClient.brokerContext()).hubOrigin;
+                }
+                catch {
+                    return undefined;
+                }
+            };
+            agentBotHub = createAgentBotHubClientFromWorkloadIdentity(workloadIdentityClient);
+        }
+        else {
+            // No broker socket yet: the dev fallback origin (PRIVOS_URL) is the
+            // only Hub address available in this state (e.g. PREACTIVATION).
+            resolveHubOrigin = async () => developmentHubOrigin(env);
+            agentBotHub = createAgentBotHubClient({ resolveHubOrigin });
+        }
+        mountDirectRouter = true;
+    }
     else if (mode === 'standalone-production') {
         const load = options.__test?.loadStandaloneIdentity ?? loadStandaloneIdentity;
         loaded = load();
@@ -167,6 +204,22 @@ export async function serveApp(options) {
             // Development leaves the default 'auto', which with no workload
             // socket accepts unsigned — safe only because dev binds loopback.
             ...(mode === 'managed' ? { workloadSecurity: 'required', workloadIdentityClient } : {}),
+            // runtime-v3 never accepts the legacy managed dispatch header —
+            // its final-boundary authorization is `runtimeDispatchV3` instead.
+            ...(mode === 'runtime-v3'
+                ? {
+                    workloadSecurity: 'disabled',
+                    runtimeDispatchV3: {
+                        mode: 'required',
+                        trust: runtimeV3.trust,
+                        // The type has no 'none' literal — omitting the field is how
+                        // isUnsignedRuntimeReadinessRpcV3 is told to accept nothing.
+                        ...(runtimeV3.allowUnsignedPreactivationReadiness
+                            ? { unsignedReadiness: 'initialize-and-tools-list' }
+                            : {}),
+                    },
+                }
+                : {}),
         }));
     }
     const listen = resolveHttpIngressListen({ env, defaultPort: DEFAULT_SERVE_APP_PORT });
@@ -223,11 +276,12 @@ export async function serveApp(options) {
             logger: (event, fields) => logger(event, fields),
         });
     }
-    // Managed: warm the workload attestation in the background (the post-listen
-    // bootstrap the SDK's startHttpIngress does) and keep it fresh, so /ready
-    // reads a converged LAST-KNOWN-GOOD cache instead of forcing a synchronous
-    // broker token mint on every probe. dispose() stops the monitor.
-    if (mode === 'managed' && workloadIdentityClient) {
+    // Managed + runtime-v3 (when its broker socket is present): warm the
+    // workload attestation in the background (the post-listen bootstrap the
+    // SDK's startHttpIngress does) and keep it fresh, so /ready reads a
+    // converged LAST-KNOWN-GOOD cache instead of forcing a synchronous broker
+    // token mint on every probe. dispose() stops the monitor.
+    if ((mode === 'managed' || mode === 'runtime-v3') && workloadIdentityClient) {
         void workloadIdentityClient.getEffectiveCapabilities({ forceRefresh: true }).catch(() => undefined);
         workloadIdentityClient.startCapabilityMonitor(30_000);
     }
@@ -287,6 +341,18 @@ function buildReadiness(input) {
             };
         };
     }
+    if (input.mode === 'runtime-v3') {
+        // Trust is validated (RuntimeModeError otherwise) before the server ever
+        // starts listening, so by the time /ready is reachable it is always 200 —
+        // the driver never gates activation on this probe (it polls it AFTER
+        // flipping the installation ACTIVE, purely to observe workload posture).
+        const client = input.workloadIdentityClient;
+        return async () => ({
+            ok: true,
+            status: 200,
+            body: { mode: 'runtime-v3', workload: client ? workloadReadinessStatusV3(client.peekEffectiveCapabilities()) : 'unattested' },
+        });
+    }
     if (input.mode === 'standalone-production') {
         const check = createStandaloneReadinessCheck({
             isRelayAuthenticated: () => input.relayRef.current?.isConnected() ?? false,
@@ -300,4 +366,12 @@ function buildReadiness(input) {
     // development: trivial 200 — no trust to attest, unsigned local surface.
     return async () => ({ ok: true, status: 200, body: { mode: 'development' } });
 }
+/** Collapses the workload client's five internal statuses onto the three runtime-v3 `/ready` reports. */
+function workloadReadinessStatusV3(capabilities) {
+    if (capabilities.status === 'active')
+        return 'active';
+    if (capabilities.status === 'paired' || capabilities.status === 'stale')
+        return 'paired';
+    return 'unattested';
+}
 //# sourceMappingURL=serve-app.js.map

package/dist/serve-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve-app.js","sourceRoot":"","sources":["../src/serve-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,OAAyB,MAAM,SAAS,CAAC;AAGhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAA6B,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACN,uBAAuB,EACvB,oCAAoC,EACpC,2CAA2C,GAE3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACN,uCAAuC,GAEvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,sBAAsB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EACN,yBAAyB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAyE3C,SAAS,aAAa,CAAC,KAAa,EAAE,MAA+B;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;AACF,CAAC;AAED,2HAA2H;AAC3H,SAAS,oBAAoB,CAAC,GAAsB;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;IAC3B,OAAO,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,2KAA2K;AAC3K,MAAM,UAAU,uBAAuB;IACtC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,kBAAkB,IAAI,kBAAkB,CAAC;IAE7E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,IAAI,gBAAgB,CACzB,gCAAgC,EAChC,2DAA2D,IAAI,+BAA+B;YAC7F,8FAA8F,CAC/F,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,sBAA0D,CAAC;IAC/D,IAAI,WAA+B,CAAC;IACpC,IAAI,gBAAmD,CAAC;IACxD,IAAI,MAA4C,CAAC;IACjD,IAAI,kBAAiE,CAAC;IACtE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,yBAAyB,IAAI,yBAAyB,CAAC;QACzF,sBAAsB,GAAG,SAAS,EAAE,CAAC;QACrC,gBAAgB,GAAG,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC;gBACJ,OAAO,CAAC,MAAM,sBAAuB,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC,CAAC;QACF,WAAW,GAAG,2CAA2C,CAAC,sBAAsB,CAAC,CAAC;QAClF,iBAAiB,GAAG,IAAI,CAAC;IAC1B,CAAC;SAAM,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,sBAAsB,IAAI,sBAAsB,CAAC;QAC9E,MAAM,GAAG,IAAI,EAAE,CAAC;QAChB,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB;YAAE,4BAA4B,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACzG,MAAM,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,uCAAuC,IAAI,uCAAuC,CAAC;QACpG,kBAAkB,GAAG,cAAc,CAAC,MAAM,EAAE;YAC3C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;SAChD,CAAC,CAAC;QACH,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,MAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,WAAW,GAAG,oCAAoC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3E,iBAAiB,GAAG,KAAK,CAAC,CAAC,6BAA6B;IACzD,CAAC;SAAM,CAAC;QACP,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzD,WAAW,GAAG,uBAAuB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5D,mEAAmE;QACnE,qEAAqE;QACrE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI;QACJ,WAAW;QACX,sBAAsB;QACtB,gBAAgB;KAChB,CAAC,CAAC;IAEH,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC;QAChC,IAAI;QACJ,sBAAsB;QACtB,QAAQ;QACR,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,uBAAuB;KACnE,CAAC,CAAC;IAEH,oEAAoE;IACpE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,CAAC;QACb,CAAC;IACF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,SAAS;QAAE,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,iBAAiB,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CACN,kBAAkB,CAAC;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,qEAAqE;YACrE,gEAAgE;YAChE,kEAAkE;YAClE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAmB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtF,6EAA6E;IAC7E,wEAAwE;IACxE,+EAA+E;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACrF,8EAA8E;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEhF,iEAAiE;IACjE,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,YAAY,CAAC;QAC/D,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,uBAAuB,CAAC;QAC3E,MAAM,sBAAsB,GAAG,KAAK,IAA4B,EAAE;YACjE,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YACxG,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;gBACzC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1E,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAmC,EAAE,CAAC;gBACnE,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,0BAA0B;YAC3B,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,aAAa,GAAG,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACnG,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC;YAC5B,SAAS,EAAE,MAAO,CAAC,KAAK,CAAC,SAAS;YAClC,kBAAkB,EAAE,kBAAkB;YACtC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,UAAU,EAAE,sBAAsB;YAClC,OAAO;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;SAChD,CAAC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,IAAI,KAAK,SAAS,IAAI,sBAAsB,EAAE,CAAC;QAClD,KAAK,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpG,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,cAAc,GAAsD,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAmB;QAC9B,IAAI;QACJ,MAAM;QACN,WAAW,EAAE,QAAQ,CAAC,OAAO;QAC7B,SAAS;QACT,KAAK,CAAC,KAAK;YACV,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,cAAc;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzF,cAAc,GAAG,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,OAAO;gBAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,sBAAsB,EAAE,OAAO,EAAE,CAAC;QACnC,CAAC;KACD,CAAC;IAEF,IAAI,OAAO,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,GAAG,EAAE;gBACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC9B,MAAM,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC7D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACtB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACA,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAuB,CAAC;QAC7C,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;YAChD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;YAChE,OAAO;gBACN,EAAE;gBACF,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBACtB,IAAI,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI,CAAC,MAAM;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;oBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/C;aACD,CAAC;QACH,CAAC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,8BAA8B,CAAC;YAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,KAAK;YAC1E,eAAe,EAAE,KAAK,CAAC,eAAe;SACtC,CAAC,CAAC;QACH,OAAO,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"serve-app.js","sourceRoot":"","sources":["../src/serve-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,OAAyB,MAAM,SAAS,CAAC;AAGhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAA6B,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACN,uBAAuB,EACvB,oCAAoC,EACpC,2CAA2C,GAE3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACN,uCAAuC,GAEvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,sBAAsB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AAG3F,OAAO,EACN,yBAAyB,GAGzB,MAAM,iCAAiC,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAyE3C,SAAS,aAAa,CAAC,KAAa,EAAE,MAA+B;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;AACF,CAAC;AAED,2HAA2H;AAC3H,SAAS,oBAAoB,CAAC,GAAsB;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;IAC3B,OAAO,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,2KAA2K;AAC3K,MAAM,UAAU,uBAAuB;IACtC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,kBAAkB,IAAI,kBAAkB,CAAC;IAE7E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,SAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5E,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,IAAI,gBAAgB,CACzB,gCAAgC,EAChC,2DAA2D,IAAI,+BAA+B;YAC7F,8FAA8F,CAC/F,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,sBAA0D,CAAC;IAC/D,IAAI,WAA+B,CAAC;IACpC,IAAI,gBAAmD,CAAC;IACxD,IAAI,MAA4C,CAAC;IACjD,IAAI,kBAAiE,CAAC;IACtE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,yBAAyB,IAAI,yBAAyB,CAAC;QACzF,sBAAsB,GAAG,SAAS,EAAE,CAAC;QACrC,gBAAgB,GAAG,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC;gBACJ,OAAO,CAAC,MAAM,sBAAuB,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC,CAAC;QACF,WAAW,GAAG,2CAA2C,CAAC,sBAAsB,CAAC,CAAC;QAClF,iBAAiB,GAAG,IAAI,CAAC;IAC1B,CAAC;SAAM,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,yBAAyB,IAAI,yBAAyB,CAAC;QACzF,MAAM,eAAe,GAAG,SAAS,EAAE,CAAC;QACpC,IAAI,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,sBAAsB,GAAG,eAAe,CAAC;YACzC,gBAAgB,GAAG,KAAK,IAAI,EAAE;gBAC7B,IAAI,CAAC;oBACJ,OAAO,CAAC,MAAM,sBAAuB,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC;gBAClE,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,SAAS,CAAC;gBAClB,CAAC;YACF,CAAC,CAAC;YACF,WAAW,GAAG,2CAA2C,CAAC,sBAAsB,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACP,oEAAoE;YACpE,iEAAiE;YACjE,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACzD,WAAW,GAAG,uBAAuB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAC;IAC1B,CAAC;SAAM,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,sBAAsB,IAAI,sBAAsB,CAAC;QAC9E,MAAM,GAAG,IAAI,EAAE,CAAC;QAChB,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB;YAAE,4BAA4B,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACzG,MAAM,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,uCAAuC,IAAI,uCAAuC,CAAC;QACpG,kBAAkB,GAAG,cAAc,CAAC,MAAM,EAAE;YAC3C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;SAChD,CAAC,CAAC;QACH,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,MAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,WAAW,GAAG,oCAAoC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3E,iBAAiB,GAAG,KAAK,CAAC,CAAC,6BAA6B;IACzD,CAAC;SAAM,CAAC;QACP,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzD,WAAW,GAAG,uBAAuB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5D,mEAAmE;QACnE,qEAAqE;QACrE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI;QACJ,WAAW;QACX,sBAAsB;QACtB,gBAAgB;KAChB,CAAC,CAAC;IAEH,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC;QAChC,IAAI;QACJ,sBAAsB;QACtB,QAAQ;QACR,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,uBAAuB;KACnE,CAAC,CAAC;IAEH,oEAAoE;IACpE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,CAAC;QACb,CAAC;IACF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,SAAS;QAAE,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,iBAAiB,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CACN,kBAAkB,CAAC;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,qEAAqE;YACrE,gEAAgE;YAChE,kEAAkE;YAClE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAmB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,gEAAgE;YAChE,mEAAmE;YACnE,GAAG,CAAC,IAAI,KAAK,YAAY;gBACxB,CAAC,CAAC;oBACA,gBAAgB,EAAE,UAAmB;oBACrC,iBAAiB,EAAE;wBAClB,IAAI,EAAE,UAAU;wBAChB,KAAK,EAAE,SAAU,CAAC,KAAK;wBACvB,6DAA6D;wBAC7D,6DAA6D;wBAC7D,GAAG,CAAC,SAAU,CAAC,mCAAmC;4BACjD,CAAC,CAAC,EAAE,iBAAiB,EAAE,2BAAoC,EAAE;4BAC7D,CAAC,CAAC,EAAE,CAAC;qBAC8B;iBACrC;gBACF,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtF,6EAA6E;IAC7E,wEAAwE;IACxE,+EAA+E;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACrF,8EAA8E;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEhF,iEAAiE;IACjE,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,YAAY,CAAC;QAC/D,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,uBAAuB,CAAC;QAC3E,MAAM,sBAAsB,GAAG,KAAK,IAA4B,EAAE;YACjE,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YACxG,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;gBACzC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1E,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAmC,EAAE,CAAC;gBACnE,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,0BAA0B;YAC3B,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,aAAa,GAAG,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACnG,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC;YAC5B,SAAS,EAAE,MAAO,CAAC,KAAK,CAAC,SAAS;YAClC,kBAAkB,EAAE,kBAAkB;YACtC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,UAAU,EAAE,sBAAsB;YAClC,OAAO;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;SAChD,CAAC,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAC7E,KAAK,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpG,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,cAAc,GAAsD,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAmB;QAC9B,IAAI;QACJ,MAAM;QACN,WAAW,EAAE,QAAQ,CAAC,OAAO;QAC7B,SAAS;QACT,KAAK,CAAC,KAAK;YACV,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,cAAc;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzF,cAAc,GAAG,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,OAAO;gBAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,sBAAsB,EAAE,OAAO,EAAE,CAAC;QACnC,CAAC;KACD,CAAC;IAEF,IAAI,OAAO,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,GAAG,EAAE;gBACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC9B,MAAM,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC7D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACtB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACA,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAuB,CAAC;QAC7C,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;YAChD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;YAChE,OAAO;gBACN,EAAE;gBACF,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBACtB,IAAI,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI,CAAC,MAAM;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;oBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/C;aACD,CAAC;QACH,CAAC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC;QAC5C,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;YACnB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE;SAC7H,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,8BAA8B,CAAC;YAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,KAAK;YAC1E,eAAe,EAAE,KAAK,CAAC,eAAe;SACtC,CAAC,CAAC;QACH,OAAO,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,yGAAyG;AACzG,SAAS,yBAAyB,CAAC,YAAmC;IACrE,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtD,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACzF,OAAO,YAAY,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privos_ai/app-server",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "Business-agnostic PrivOS MCP App server runtime — Direct HTTP + Relay WebSocket",
   "type": "module",
   "main": "./dist/index.js",
@@ -74,5 +74,10 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.10"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PrivOS-AI/privos-app-packages.git",
+    "directory": "app-server"
+  }
 }