@privos_ai/app-server 0.5.0 → 0.6.2

package/README.md

@@ -252,8 +252,175 @@ signed discovery requests as well.
 
 Verified runtime authorization is exposed as the frozen
 `ToolCallContext.runtimeAuthorization`. Room assertions include both the parent
-`runtimeInstallationId` and child `authorizationBindingId`; any separately
-verified actor JWT with a missing or different room is denied.
+`runtimeInstallationId` and child `authorizationBindingId`. A canonical signed
+`actor` claim is optional immediate attribution: when present it is strictly
+parsed, frozen, and surfaced as `ToolCallContext.actor`; when absent the Room
+dispatch remains valid. Actor metadata never selects or authorizes a workload.
+
+### Relay actor identity (Hub-signed user token)
+
+The `hub-runtime-dispatch-assertion` (Relay/Direct `SELF_HOSTED_LOCAL` /
+`PUBLISHER_HOSTED`) has no `actor` claim — only the managed-Cluster assertion
+variant does. Instead the Hub sends caller identity for these apps as a
+separate short-lived RS256 JWT at `params._meta.privosUser.userToken`,
+verifiable against the Hub's published JWKS
+(`/.well-known/mcp-apps/jwks.json`). The plain `userId` / `username` /
+`roomId` fields riding alongside that token are not proof of anything; only
+the signed token is.
+
+`connectRelay` verifies this token and populates `ToolCallContext.actor`
+automatically (`hubUserTokenAuth: 'auto'`, the default) whenever
+`standaloneIdentity` is set, or `runtimeDispatchV3.trust` is a static (non-resolver)
+trust record, and the app has not already supplied its own `auth` /
+`extractCallerCredential`. The verified token's `rid` is cross-bound against the
+already-verified dispatch assertion's room: a room-scoped assertion requires the
+token's `rid` to match exactly, and a workspace-scoped assertion refuses a
+room-bound token outright — `buildContext` throws `dispatch_assertion_binding_mismatch`
+on a mismatch, which `connectRelay` turns into a denied dispatch before the handler
+runs. Set `hubUserTokenAuth: 'disabled'` to opt out.
+
+```ts
+connectRelay({
+  privosUrl: loaded.relay.privosUrl,
+  standaloneIdentity,
+  descriptor,
+  handler, // context.actor is populated automatically when a token verifies
+});
+```
+
+For a non-standalone Relay/Direct setup with a dynamic (resolver) trust —
+where this app's own `mcpAppId` is still fixed, just not known synchronously
+from a static trust record — wire the same verification manually:
+
+```ts
+import {
+  buildHubUserTokenAuthOptions,
+  extractRelayUserTokenCredential,
+} from '@privos_ai/app-server';
+
+connectRelay({
+  privosUrl,
+  runtimeDispatchV3, // trust: a resolver function
+  auth: buildHubUserTokenAuthOptions({ hubOrigin: privosUrl, audience: mcpAppId }),
+  extractCallerCredential: extractRelayUserTokenCredential,
+  descriptor,
+  handler,
+});
+```
+
+`ToolCallContext.actor.provenance` distinguishes how an actor was established:
+`'dispatch-assertion'` for the managed-Cluster embedded `actor` claim (Direct
+transport only), `'user-token'` for this separately-verified Hub JWT (Direct
+bearer header or Relay `_meta.privosUser.userToken`). Apps that want a
+stricter policy for one path than the other can branch on this field.
+`buildHubUserTokenAuthOptions` refuses a plaintext-HTTP JWKS origin once
+`NODE_ENV=production`, bounds the JWKS fetch with a timeout, and — via the
+shared `jose` remote-JWKS client underneath — refetches at most once on an
+unknown `kid` before failing closed. A JWKS fetch failure never crashes
+dispatch; it degrades to `identityState: 'invalid'` and `actor: undefined`.
+
+Managed App Library generations use this same canonical Direct ingress. The
+router learns the generation from the verified workload broker, accepts only
+`X-PrivOS-Dispatch-Assertion`, verifies it with
+`verifyClusterDispatchAssertionV3`, and obtains any Actor only from that exact
+signed, body-bound assertion. A separate caller bearer or asserted-user header
+is not accepted on this managed-v3 path. Publisher-hosted and self-hosted-local
+v3 runtimes continue to use only `X-PrivOS-MCP-Dispatch-Assertion`. Sending both
+assertion headers or duplicating either header is denied before the handler
+runs.
+Successful managed room ingress also freezes the exact handler context and
+registers a client-private, object-identity capability for it. Public context
+fields are descriptive only and cannot be reconstructed into room authority.
+
+For backend calls that must retain the verified room child-binding, derive a
+request-only client from the tool context:
+
+```ts
+const roomHub = workloadIdentityClient.forRoom(context);
+const response = await roomHub.authorizedRequest('/api/v1/example.read', {
+  method: 'GET',
+  requiredScope: 'example:read',
+});
+```
+
+`forRoom` is synchronous and accepts only the exact managed-ingress context
+instance registered to that `WorkloadIdentityClient`; fabricated objects,
+clones, substituted fields, and contexts from another client are rejected.
+Actor presence or identity is not part of this capability. Its
+client accepts only Hub-relative paths and one exact scope, sends the verified
+`authorizationBindingId` only to workload-token issuance, and does not expose a
+raw token. Exact `roomId` and `authorizationBindingId` keys are reserved in the
+parsed query, nested JSON, `URLSearchParams`, and `FormData`; malformed declared
+JSON/form bodies and opaque streams are rejected before issuance. Strings,
+blobs, and byte buffers with a non-semantic content type remain exact raw
+payloads and are not scanned for coincidental text. Token caching and concurrent
+issuance are isolated by the complete workspace, generation, and room
+receipt/epoch/version identity, with one fixed 64-entry process-local LRU/token
+and active-issuance bound. A 401 evicts only the exact key that supplied the
+attempted token. POST/PATCH replay requires both `retryMode: 'idempotent'` and
+`replayable: true`; safe methods retain one refresh retry.
+
+## Standalone production mode (Relay pairing)
+
+Self-hosted apps with no reachable public URL (typically behind NAT) pair once over
+a one-time Relay WebSocket URL and run in production against a paired, persisted
+identity — no secret ever lives in a world-readable `.env`.
+
+```ts
+import { pairOverWebSocket } from '@privos_ai/app-server';
+
+// Prints the Hub fingerprint (SSH-host-key style) and, by default, persists
+// ./privos-standalone-identity.json at mode 0600 (override with
+// PRIVOS_STANDALONE_IDENTITY_FILE).
+await pairOverWebSocket(pairingUrl, { name: 'My App', version: '1.0.0' });
+```
+
+A Hub that replies with pairing payload v2 (`pairingVersion: 2`) additionally
+delivers Hub dispatch trust (`hubKid`, `hubPublicJwk`, affinity) and a pinned
+manifest digest; a v1 Hub pairs exactly as before (nothing persisted). Load the
+identity and run the app with `resolveRuntimeMode()` picking the transport:
+
+```ts
+import {
+  connectRelay,
+  createStandaloneReadinessCheck,
+  createStandaloneRelayIdentityController,
+  loadStandaloneIdentity,
+  resolveRuntimeMode,
+} from '@privos_ai/app-server';
+
+const runtimeMode = resolveRuntimeMode(); // 'managed' | 'standalone-production' | 'development'
+
+if (runtimeMode.mode === 'standalone-production') {
+  const loaded = loadStandaloneIdentity();
+  const standaloneIdentity = createStandaloneRelayIdentityController(loaded);
+  const relay = connectRelay({ privosUrl: loaded.relay.privosUrl, standaloneIdentity, descriptor, handler });
+
+  const ready = createStandaloneReadinessCheck({
+    isRelayAuthenticated: () => relay.isConnected(),
+    resolveManifest: () => publisherManifest,
+  });
+}
+```
+
+`resolveRuntimeMode()` resolves exactly one mode — `managed` (workload identity
+socket present) takes precedence over `standalone-production` (identity file
+present), which takes precedence over `development` (neither present; only
+permitted when `NODE_ENV` is not `production`). Both signals present at once is a
+startup error (`RuntimeModeError` code `AMBIGUOUS_RUNTIME_IDENTITY`), never a
+silent pick; `NODE_ENV=production` with neither present is `PRODUCTION_WITHOUT_IDENTITY`.
+
+Secret rotation, Hub re-key/generation trust rotation, and a capabilities push are
+delivered as ES256-signed control notifications over the same authenticated Relay
+connection, verified against the currently pinned Hub key before being applied and
+atomically persisted (`src/relay/standalone-control.ts` documents the wire
+contract). A cold app that missed a rotation correctly refuses the new key until
+it is delivered live or the app is re-paired — this is expected, not a bug.
+`createStandaloneReadinessCheck` matches the managed `/health` (alive) + `/ready`
+(identity loaded, trust valid, Relay authenticated, manifest lint clean, and no
+`MANIFEST_DRIFT` against the digest pinned at pairing) JSON shape, and
+`loadStandaloneIdentity` refuses to load a tampered file (wrong mode, foreign
+owner, or invalid content) with a specific reason instead of degrading silently.
 
 ## Manifest v2 preflight
 

package/dist/app-descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-descriptor.d.ts","sourceRoot":"","sources":["../src/app-descriptor.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,eAAO,MAAM,WAAW,8BAA8B,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,UAAU,CAAC;AAC/D,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,MAAM,CAAC;AACxD,MAAM,MAAM,6BAA6B,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC;AAE3E,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,wBAAwB,CAAC;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,gBAAgB,EAAE,6BAA6B,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACjD,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAID,wBAAgB,8BAA8B,CAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC/C,IAAI,CASN;AAED,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,aAAa,CAAC,GAAG,IAAI,CA4B7G;AAED,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,aAAa,EACzB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/B;IACF,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CA+BA;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBpF;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,aAAa,GAAG;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC,CAUA"}
+{"version":3,"file":"app-descriptor.d.ts","sourceRoot":"","sources":["../src/app-descriptor.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,eAAO,MAAM,WAAW,8BAA8B,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,UAAU,CAAC;AAC/D,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,MAAM,CAAC;AACxD,MAAM,MAAM,6BAA6B,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC;AAE3E,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,wBAAwB,CAAC;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,gBAAgB,EAAE,6BAA6B,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACjD,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAID,wBAAgB,8BAA8B,CAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC/C,IAAI,CASN;AAED,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,aAAa,CAAC,GAAG,IAAI,CA4B7G;AAED,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,aAAa,EACzB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/B;IACF,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CA+BA;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwBpF;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,aAAa,GAAG;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC,CAUA"}

package/dist/app-descriptor.js

@@ -73,6 +73,7 @@ export function buildInitializeResult(descriptor, options) {
     };
 }
 export function buildManifestJson(descriptor) {
+    validateDescriptorCapabilities(descriptor.capabilities);
     validateDescriptorPermissions(descriptor);
     return {
         schemaVersion: descriptor.permissions ? 2 : 1,
@@ -93,6 +94,7 @@ export function buildManifestJson(descriptor) {
         ...(descriptor.homepage ? { homepage: descriptor.homepage } : {}),
         ...(descriptor.scopes ? { scopes: [...descriptor.scopes] } : {}),
         ...(descriptor.permissions ? { permissions: descriptor.permissions.map((permission) => ({ ...permission })) } : {}),
+        ...(descriptor.capabilities ? { capabilities: { ...descriptor.capabilities } } : {}),
     };
 }
 export function buildPairingMetadata(descriptor) {

package/dist/app-descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-descriptor.js","sourceRoot":"","sources":["../src/app-descriptor.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,MAAM,CAAC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAoCvD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,8BAA8B,CAC7C,YAAiD;IAEjD,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACd,kEAAkE,GAAG,GAAG,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,UAAyD;IACtG,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO;IACpC,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QACjD,IACC,CAAC,UAAU;YACX,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAC1D,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACrE,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACzC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACnG,IAAI,UAAU,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/H,MAAM,IAAI,KAAK,CAAC,4DAA4D,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,KAAK,UAAU,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,UAAyB,EACzB,OAAiC;IAMjC,8BAA8B,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAE1C,MAAM,YAAY,GAA4B;QAC7C,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,OAAO,EAAE,SAAS;YACrB,CAAC,CAAC;gBACA,UAAU,EAAE;oBACX,4BAA4B,EAAE;wBAC7B,SAAS,EAAE,CAAC,WAAW,CAAC;qBACxB;iBACD;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;KAClC,CAAC;IAEF,MAAM,UAAU,GAA4B;QAC3C,IAAI,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QAC1D,OAAO,EAAE,UAAU,CAAC,OAAO;KAC3B,CAAC;IACF,IAAI,UAAU,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;IACjE,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM;QAAE,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,WAAW,EAAE,MAAM;QAAE,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;IAE7H,OAAO;QACN,eAAe,EAAE,oBAAoB;QACrC,YAAY;QACZ,UAAU;KACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAyB;IAC1D,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACN,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,EAAE,UAAU,CAAC,EAAE;QACnB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI;QAC1C,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,EAAE;QACzC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,UAAU,CAAC,MAAM;YACpB,CAAC,CAAC;gBACA,MAAM,EAAE;oBACP,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;oBAC5B,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5E;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAyB;IAQ7D,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QAC1D,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,EAAE;QACzC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3H,CAAC;AACH,CAAC"}
+{"version":3,"file":"app-descriptor.js","sourceRoot":"","sources":["../src/app-descriptor.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,MAAM,CAAC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAoCvD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,8BAA8B,CAC7C,YAAiD;IAEjD,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACd,kEAAkE,GAAG,GAAG,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,UAAyD;IACtG,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO;IACpC,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QACjD,IACC,CAAC,UAAU;YACX,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;YAC1D,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACrE,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACzC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACnG,IAAI,UAAU,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/H,MAAM,IAAI,KAAK,CAAC,4DAA4D,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,KAAK,UAAU,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,UAAyB,EACzB,OAAiC;IAMjC,8BAA8B,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAE1C,MAAM,YAAY,GAA4B;QAC7C,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,OAAO,EAAE,SAAS;YACrB,CAAC,CAAC;gBACA,UAAU,EAAE;oBACX,4BAA4B,EAAE;wBAC7B,SAAS,EAAE,CAAC,WAAW,CAAC;qBACxB;iBACD;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;KAClC,CAAC;IAEF,MAAM,UAAU,GAA4B;QAC3C,IAAI,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QAC1D,OAAO,EAAE,UAAU,CAAC,OAAO;KAC3B,CAAC;IACF,IAAI,UAAU,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;IACjE,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM;QAAE,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,WAAW,EAAE,MAAM;QAAE,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;IAE7H,OAAO;QACN,eAAe,EAAE,oBAAoB;QACrC,YAAY;QACZ,UAAU;KACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAyB;IAC1D,8BAA8B,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACN,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,EAAE,UAAU,CAAC,EAAE;QACnB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI;QAC1C,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,EAAE;QACzC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,UAAU,CAAC,MAAM;YACpB,CAAC,CAAC;gBACA,MAAM,EAAE;oBACP,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;oBAC5B,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5E;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAyB;IAQ7D,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QAC1D,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,EAAE;QACzC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3H,CAAC;AACH,CAAC"}

package/dist/auth/user-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-token.d.ts","sourceRoot":"","sources":["../../src/auth/user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,aAAa,EAElB,MAAM,MAAM,CAAC;AAEd,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,QAAQ,CAAC;CACtD;AAED,MAAM,MAAM,qBAAqB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAuCjE,mEAAmE;AACnE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,uIAE1D;AAED,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAwBD;;;GAGG;AACH,wBAAsB,eAAe,CACpC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,WAAW,EACpB,cAAc,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAQxB"}
+{"version":3,"file":"user-token.d.ts","sourceRoot":"","sources":["../../src/auth/user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,aAAa,EAElB,MAAM,MAAM,CAAC;AAEd,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,QAAQ,CAAC;CACtD;AAED,MAAM,MAAM,qBAAqB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAwCjE,mEAAmE;AACnE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,uIAE1D;AAED,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAqCD;;;GAGG;AACH,wBAAsB,eAAe,CACpC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,WAAW,EACpB,cAAc,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,qBAAqB,CAAC,CAuChC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAQxB"}

package/dist/auth/user-token.js

@@ -19,6 +19,7 @@ function resolveIssuer(value) {
 }
 function getJwks(options) {
     const url = resolveUrl(options.jwksUrl);
+    assertProductionSafeJwksUrl(url);
     const cacheKey = `${url.toString()}|${options.jwksCacheTtlMs ?? ''}|${options.fetchTimeoutMs ?? ''}`;
     let jwks = jwksCache.get(cacheKey);
     if (!jwks) {
@@ -51,12 +52,24 @@ function actorFromPayload(payload) {
     }
     const username = typeof payload.preferred_username === 'string' ? payload.preferred_username : undefined;
     const roomId = typeof payload.rid === 'string' ? payload.rid : undefined;
-    return {
+    return Object.freeze({
         userId: payload.sub,
         ...(username !== undefined ? { username } : {}),
         ...(roomId !== undefined ? { roomId } : {}),
-        claims: { ...payload },
-    };
+        claims: Object.freeze({ ...payload }),
+        provenance: 'user-token',
+    });
+}
+/**
+ * A plaintext-HTTP JWKS origin lets any on-path attacker swap the public key
+ * an app verifies caller tokens against. Refuse it once `NODE_ENV=production`
+ * — thrown here, it is always caught by `verifyUserToken`'s try/catch and
+ * degrades to `{ ok: false, reason: 'invalid' }`, never a crash.
+ */
+function assertProductionSafeJwksUrl(url) {
+    if (process.env.NODE_ENV === 'production' && url.protocol !== 'https:') {
+        throw new Error('Refusing a plaintext-HTTP JWKS origin in production.');
+    }
 }
 /**
  * Verify a Hub-signed RS256 user JWT via JWKS.
@@ -66,6 +79,11 @@ export async function verifyUserToken(token, options, assertedUserId) {
     if (!token) {
         return { ok: false, reason: 'missing', message: 'Missing caller token' };
     }
+    if (Buffer.byteLength(token, 'utf8') > 32_768 ||
+        !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token) ||
+        (assertedUserId !== undefined && !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,159}$/.test(assertedUserId))) {
+        return { ok: false, reason: 'invalid', message: 'Caller credential is malformed' };
+    }
     try {
         const audience = resolveAudience(options.audience);
         const issuer = resolveIssuer(options.issuer);

package/dist/auth/user-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-token.js","sourceRoot":"","sources":["../../src/auth/user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,GAIT,MAAM,MAAM,CAAC;AA8Bd,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,UAAU,CAAC,KAA0C;IAC7D,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACvB,KAAsE;IAEtE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAA6C;IACnE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,OAAoB;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;IACrG,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE;YAC9B,eAAe,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;YAChD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAC;QACH,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IAC1D,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAAoB;IACxC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAmB;IAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,QAAQ,GACb,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO;QACN,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,EAAE,GAAG,OAAO,EAA6B;KACjD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,KAAyB,EACzB,OAAoB,EACpB,cAAuB;IAEvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE;YAChE,QAAQ;YACR,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,EAAE;YACnD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,IAAI,cAAc,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9F,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,qDAAqD;aAC9D,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;SACzE,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,UAA8B,EAC9B,OAAoB;IAEpB,MAAM,KAAK,GACV,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC"}
+{"version":3,"file":"user-token.js","sourceRoot":"","sources":["../../src/auth/user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,GAIT,MAAM,MAAM,CAAC;AA8Bd,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,UAAU,CAAC,KAA0C;IAC7D,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACvB,KAAsE;IAEtE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAA6C;IACnE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,OAAoB;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;IACrG,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE;YAC9B,eAAe,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;YAChD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAC;QACH,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IAC1D,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAAoB;IACxC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAmB;IAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,QAAQ,GACb,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAsC;QAC1E,UAAU,EAAE,YAAY;KACxB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,GAAQ;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,KAAyB,EACzB,OAAoB,EACpB,cAAuB;IAEvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC1E,CAAC;IACD,IACC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM;QACzC,CAAC,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/D,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAC7F,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE;YAChE,QAAQ;YACR,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,EAAE;YACnD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,IAAI,cAAc,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9F,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,qDAAqD;aAC9D,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;SACzE,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,UAA8B,EAC9B,OAAoB;IAEpB,MAAM,KAAK,GACV,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC"}

package/dist/context/tool-call-context.d.ts

@@ -1,4 +1,15 @@
-import type { VerifiedRuntimeDispatchAssertionV3 } from '../workload/dispatch-assertion.js';
+import type { VerifiedRuntimeAuthorizationV3 } from '../workload/dispatch-assertion.js';
+/**
+ * How a `VerifiedActor` was established:
+ * - `'dispatch-assertion'` — a Hub-signed dispatch assertion carried an
+ *   embedded `actor` claim (managed Cluster ingress, Direct transport only).
+ * - `'user-token'` — a separate Hub-signed RS256 user JWT was verified
+ *   against the Hub JWKS (Direct bearer header, or Relay
+ *   `_meta.privosUser.userToken`).
+ * Apps that want stricter policy for one provenance than the other can branch
+ * on this field; `context.transport` narrows it further (e.g. relay + user-token).
+ */
+export type VerifiedActorProvenance = 'dispatch-assertion' | 'user-token';
 export interface VerifiedActor {
     /** JWT `sub` — stable opaque user id. */
     userId: string;
@@ -8,6 +19,8 @@ export interface VerifiedActor {
     roomId?: string;
     /** Raw claims subset safe for app policy (no token string). */
     claims: Readonly<Record<string, unknown>>;
+    /** How this actor was established — see {@link VerifiedActorProvenance}. */
+    provenance: VerifiedActorProvenance;
 }
 export type IdentityState = 'verified' | 'missing' | 'invalid';
 export interface ToolCallContext {
@@ -19,7 +32,7 @@ export interface ToolCallContext {
     traceId?: string;
     identityState: IdentityState;
     /** Immutable Hub runtime authorization verified at the final HTTP/Relay boundary. */
-    readonly runtimeAuthorization?: VerifiedRuntimeDispatchAssertionV3;
+    readonly runtimeAuthorization?: VerifiedRuntimeAuthorizationV3;
     /**
      * Scope for duplicate in-flight JSON-RPC id detection.
      * Direct: MCP-Session-Id or per-request ephemeral id.

package/dist/context/tool-call-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-call-context.d.ts","sourceRoot":"","sources":["../../src/context/tool-call-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AAE5F,MAAM,WAAW,aAAa;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,kCAAkC,CAAC;IACnE;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB"}
+{"version":3,"file":"tool-call-context.d.ts","sourceRoot":"","sources":["../../src/context/tool-call-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAExF;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,YAAY,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,UAAU,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,8BAA8B,CAAC;IAC/D;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB"}

package/dist/direct/express-router.d.ts

@@ -2,6 +2,7 @@ import { Router, type Request } from 'express';
 import { type AppDescriptor } from '../app-descriptor.js';
 import type { AuthOptions } from '../auth/user-token.js';
 import { AppServerRuntime, extractDirectCallerCredential, type AppErrorMapper, type AppMcpHandler, type AppServerRuntimeOptions, type CallerCredentialExtractor, type RuntimeLimits, type UiResourceProvider } from '../runtime.js';
+import { type WorkloadIdentityClient } from '../workload/workload-identity.js';
 import { type RuntimeDispatchSecurityV3 } from '../workload/dispatch-assertion.js';
 export interface DirectRouterOptions {
     descriptor: AppDescriptor | (() => AppDescriptor | Promise<AppDescriptor>);
@@ -27,6 +28,8 @@ export interface DirectRouterOptions {
     runtime?: AppServerRuntime;
     /** Require Hub dispatch assertions when the Cluster identity socket is mounted. */
     workloadSecurity?: 'auto' | 'required' | 'disabled';
+    /** Optional app-owned client; useful when readiness and ingress share one broker session. */
+    workloadIdentityClient?: WorkloadIdentityClient;
     /** Explicit required final-boundary authorization for local or publisher protocol-v3 runtimes. */
     runtimeDispatchV3?: RuntimeDispatchSecurityV3;
 }

package/dist/direct/express-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express-router.d.ts","sourceRoot":"","sources":["../../src/direct/express-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAoC,MAAM,SAAS,CAAC;AAGjF,OAAO,EAEN,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOzD,OAAO,EACN,gBAAgB,EAGhB,6BAA6B,EAE7B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAIN,KAAK,yBAAyB,EAE9B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,aAAa,CAAC;IACvB,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,yBAAyB,CAAC;QACnD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;IACpD,kGAAkG;IAClG,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;CAC9C;AAYD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAsFvE;AAuKD,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC"}
+{"version":3,"file":"express-router.d.ts","sourceRoot":"","sources":["../../src/direct/express-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAoC,MAAM,SAAS,CAAC;AAGjF,OAAO,EAEN,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAQzD,OAAO,EACN,gBAAgB,EAGhB,6BAA6B,EAG7B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAA6B,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1G,OAAO,EAKN,KAAK,yBAAyB,EAG9B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,aAAa,CAAC;IACvB,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,yBAAyB,CAAC;QACnD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;IACpD,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,kGAAkG;IAClG,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;CAC9C;AAYD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAsFvE;AA0OD,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC"}

package/dist/direct/express-router.js

@@ -4,7 +4,8 @@ import { buildManifestJson, } from '../app-descriptor.js';
 import { INVALID_REQUEST, PARSE_ERROR, errorResponse, jsonRpcError, } from '../protocol/errors.js';
 import { AppServerRuntime, DEFAULT_MAX_MESSAGE_BYTES, ephemeralSessionScope, extractDirectCallerCredential, resolveCallerCredential, } from '../runtime.js';
 import { getWorkloadIdentityClient } from '../workload/workload-identity.js';
-import { isUnsignedRuntimeReadinessRpcV3, verifyDispatchAssertion, verifyRuntimeDispatchAssertionV3, } from '../workload/dispatch-assertion.js';
+import { registerManagedIngressRoomAuthority } from '../workload/managed-ingress-authority.js';
+import { isUnsignedRuntimeReadinessRpcV3, verifyClusterDispatchAssertionV3, verifyDispatchAssertion, verifyRuntimeDispatchAssertionV3, } from '../workload/dispatch-assertion.js';
 const REQUIRED_CORS_HEADERS = [
     'Content-Type',
     'Authorization',
@@ -102,7 +103,9 @@ async function handleMcpPost(req, res, runtime, options) {
         ? candidateRequestId
         : undefined;
     let runtimeAuthorization;
-    const legacyAssertionHeaders = rawHeaderValues(req, 'x-privos-dispatch-assertion');
+    let managedWorkloadClient;
+    let managedActor;
+    const managedAssertionHeaders = rawHeaderValues(req, 'x-privos-dispatch-assertion');
     const runtimeAssertionHeaders = rawHeaderValues(req, 'x-privos-mcp-dispatch-assertion');
     const unsupportedRuntimeAffinityHeaders = [
         ...rawHeaderValues(req, 'x-privos-mcp-runtime-installation-id'),
@@ -112,9 +115,15 @@ async function handleMcpPost(req, res, runtime, options) {
         denyDispatch(res, requestId);
         return;
     }
+    if (managedAssertionHeaders.length > 1 ||
+        runtimeAssertionHeaders.length > 1 ||
+        (managedAssertionHeaders.length > 0 && runtimeAssertionHeaders.length > 0)) {
+        denyDispatch(res, requestId);
+        return;
+    }
     if (options.runtimeDispatchV3) {
         try {
-            if (legacyAssertionHeaders.length > 0 || runtimeAssertionHeaders.length > 1) {
+            if (managedAssertionHeaders.length > 0) {
                 throw new Error('dispatch_assertion_ambiguous');
             }
             if (runtimeAssertionHeaders.length === 0) {
@@ -140,25 +149,45 @@ async function handleMcpPost(req, res, runtime, options) {
             denyDispatch(res, requestId);
             return;
         }
-        const workloadClient = getWorkloadIdentityClient();
+        const workloadClient = options.workloadIdentityClient ?? getWorkloadIdentityClient();
         const workloadSecurity = options.workloadSecurity ?? 'auto';
         const requireDispatchAssertion = workloadSecurity === 'required' || (workloadSecurity === 'auto' && workloadClient.isAvailable());
         if (requireDispatchAssertion) {
             try {
-                const assertion = headerValue(req.headers['x-privos-dispatch-assertion']);
+                const assertion = managedAssertionHeaders[0];
                 if (!assertion)
                     throw new Error('dispatch_assertion_missing');
-                verifyDispatchAssertion({ compact: assertion, body, context: await workloadClient.brokerContext() });
+                const brokerContext = await workloadClient.brokerContext();
+                if (brokerContext.binding.generation) {
+                    const verified = verifyClusterDispatchAssertionV3({ compact: assertion, body, context: brokerContext });
+                    runtimeAuthorization = verified;
+                    managedWorkloadClient = workloadClient;
+                    managedActor = verified.actor;
+                }
+                else {
+                    verifyDispatchAssertion({ compact: assertion, body, context: brokerContext });
+                }
             }
             catch {
                 denyDispatch(res, requestId);
                 return;
             }
         }
+        else if (managedAssertionHeaders.length > 0) {
+            denyDispatch(res, requestId);
+            return;
+        }
+    }
+    const credentialResolution = managedWorkloadClient
+        ? rawHeaderValues(req, 'authorization').length > 0 || rawHeaderValues(req, 'x-mcp-user-id').length > 0
+            ? { kind: 'error', message: 'Managed v3 attribution is carried only by the signed dispatch assertion' }
+            : { kind: 'absent' }
+        : await resolveCallerCredential(options.extractCallerCredential ??
+            ((ingress) => extractDirectCallerCredential(ingress.headers)), { headers: req.headers });
+    if (managedWorkloadClient && credentialResolution.kind === 'error') {
+        denyDispatch(res, requestId);
+        return;
     }
-    const extract = options.extractCallerCredential ??
-        ((ingress) => extractDirectCallerCredential(ingress.headers));
-    const credentialResolution = await resolveCallerCredential(extract, { headers: req.headers });
     const sessionHeader = headerValue(req.headers['mcp-session-id']);
     const sessionScope = sessionHeader?.trim()
         ? `mcp-session:${sessionHeader.trim()}`
@@ -170,8 +199,17 @@ async function handleMcpPost(req, res, runtime, options) {
             requestId,
             sessionScope,
             credentialResolution,
+            ...(options.auth ? { auth: options.auth } : {}),
             ...(runtimeAuthorization ? { runtimeAuthorization } : {}),
         });
+        if (managedActor && runtimeAuthorization) {
+            if (runtimeAuthorization.authorizationContext === 'room' &&
+                managedActor.roomId !== undefined &&
+                managedActor.roomId !== runtimeAuthorization.roomId) {
+                throw new Error('dispatch_assertion_binding_mismatch');
+            }
+            context = withManagedDispatchActor(context, managedActor);
+        }
     }
     catch (error) {
         if (runtimeAuthorization && error instanceof Error && error.message === 'dispatch_assertion_binding_mismatch') {
@@ -180,7 +218,10 @@ async function handleMcpPost(req, res, runtime, options) {
         }
         throw error;
     }
-    const outcome = await runtime.dispatchObject(body, context);
+    const finalizeContext = managedWorkloadClient && runtimeAuthorization?.authorizationContext === 'room'
+        ? (requestContext) => registerManagedIngressRoomAuthority(managedWorkloadClient, requestContext, runtimeAuthorization)
+        : undefined;
+    const outcome = await runtime.dispatchObject(body, context, finalizeContext);
     if (outcome.type === 'no_response' || outcome.type === 'protocol_warning') {
         res.status(202).end();
         return;
@@ -220,6 +261,25 @@ function rawHeaderValues(req, name) {
     }
     return values;
 }
+function withManagedDispatchActor(context, actor) {
+    const claims = Object.freeze({
+        sub: actor.subject,
+        ...(actor.username !== undefined ? { preferred_username: actor.username } : {}),
+        ...(actor.roomId !== undefined ? { rid: actor.roomId } : {}),
+    });
+    const verifiedActor = Object.freeze({
+        userId: actor.subject,
+        ...(actor.username !== undefined ? { username: actor.username } : {}),
+        ...(actor.roomId !== undefined ? { roomId: actor.roomId } : {}),
+        claims,
+        provenance: 'dispatch-assertion',
+    });
+    return {
+        ...context,
+        identityState: 'verified',
+        actor: verifiedActor,
+    };
+}
 function denyDispatch(res, requestId) {
     res.status(403).json(errorResponse(requestId ?? null, jsonRpcError(INVALID_REQUEST, 'Authenticated private dispatch required', {
         code: 'DISPATCH_ASSERTION_INVALID',

package/dist/direct/express-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"express-router.js","sourceRoot":"","sources":["../../src/direct/express-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AACjF,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACN,iBAAiB,GAEjB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,eAAe,EACf,WAAW,EACX,aAAa,EACb,YAAY,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,GAOvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACN,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,GAGhC,MAAM,mCAAmC,CAAC;AA8B3C,MAAM,qBAAqB,GAAG;IAC7B,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,sBAAsB;IACtB,6BAA6B;IAC7B,iCAAiC;CACxB,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,OAAO,GACZ,OAAO,CAAC,OAAO;QACf,IAAI,gBAAgB,CAAC;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAC1C,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,CAAC;IAC9E,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC9D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACR,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClD,IAAI,CAAC;YACJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,CAAC;QACX,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACV,OAAO,EACP,OAAO,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,kBAAkB;KACxB,CAAC,EACF,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACJ,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,CAAC;QACX,CAAC;IACF,CAAC,CACD,CAAC;IAEF,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC5E,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO;QACR,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,aAAa,CACZ,IAAI,EACJ,YAAY,CAAC,eAAe,EAAE,mBAAmB,EAAE;gBAClD,IAAI,EAAE,mBAAmB;aACzB,CAAC,CACF,CACD,CAAC;YACF,OAAO;QACR,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YACpF,OAAO;QACR,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,GAAY,EACZ,GAAa,EACb,OAAyB,EACzB,OAA4B;IAE5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,kBAAkB,GACvB,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QACnF,CAAC,CAAE,IAAwB,CAAC,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,kBAAkB,KAAK,IAAI;QAC5C,OAAO,kBAAkB,KAAK,QAAQ;QACtC,OAAO,kBAAkB,KAAK,QAAQ;QACtC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,SAAS,CAAC;IAEb,IAAI,oBAAoE,CAAC;IACzE,MAAM,sBAAsB,GAAG,eAAe,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACnF,MAAM,uBAAuB,GAAG,eAAe,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACxF,MAAM,iCAAiC,GAAG;QACzC,GAAG,eAAe,CAAC,GAAG,EAAE,sCAAsC,CAAC;QAC/D,GAAG,eAAe,CAAC,GAAG,EAAE,uCAAuC,CAAC;KAChE,CAAC;IACF,IAAI,iCAAiC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC;YACJ,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,+BAA+B,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAC/C,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,oBAAoB,GAAG,MAAM,gCAAgC,CAAC;oBAC7D,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAE;oBACpC,IAAI;oBACJ,QAAQ,EAAE,OAAO,CAAC,iBAAiB;iBACnC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;IACF,CAAC;SAAM,CAAC;QACP,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,MAAM,cAAc,GAAG,yBAAyB,EAAE,CAAC;QACnD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAC5D,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,UAAU,IAAI,CAAC,gBAAgB,KAAK,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAClI,IAAI,wBAAwB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBAC1E,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAC9D,uBAAuB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;YAAC,MAAM,CAAC;gBACR,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC7B,OAAO;YACR,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GACZ,OAAO,CAAC,uBAAuB;QAC/B,CAAC,CAAC,OAAwC,EAAE,EAAE,CAC7C,6BAA6B,CAC5B,OAAO,CAAC,OAAwD,CAChE,CAAC,CAAC;IACL,MAAM,oBAAoB,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAE9F,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,aAAa,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,eAAe,aAAa,CAAC,IAAI,EAAE,EAAE;QACvC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEnC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,YAAY;YACZ,oBAAoB;YACpB,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,oBAAoB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,qCAAqC,EAAE,CAAC;YAC/G,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE5D,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,OAAe;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA6E,CAAC;IACxF,OAAO,CACN,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAChC,CAAC,CAAC,IAAI,KAAK,aAAa;QACxB,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAC7E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8D,CAAC;IACzE,OAAO,CACN,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAC7B,CAAC,CAAC,MAAM,KAAK,GAAG;QAChB,CAAC,CAAC,UAAU,KAAK,GAAG,CACpB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,IAAY;IAClD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAa,EAAE,SAA6C;IACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,aAAa,CAAC,SAAS,IAAI,IAAI,EAAE,YAAY,CAAC,eAAe,EAAE,yCAAyC,EAAE;QACzG,IAAI,EAAE,4BAA4B;KAClC,CAAC,CAAC,CACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgB;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAa,CAAC,GAAG,qBAAqB,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC"}
+{"version":3,"file":"express-router.js","sourceRoot":"","sources":["../../src/direct/express-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AACjF,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACN,iBAAiB,GAEjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACN,eAAe,EACf,WAAW,EACX,aAAa,EACb,YAAY,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,GAQvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAA+B,MAAM,kCAAkC,CAAC;AAC1G,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAC/F,OAAO,EACN,+BAA+B,EAC/B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAIhC,MAAM,mCAAmC,CAAC;AAgC3C,MAAM,qBAAqB,GAAG;IAC7B,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,sBAAsB;IACtB,6BAA6B;IAC7B,iCAAiC;CACxB,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,OAAO,GACZ,OAAO,CAAC,OAAO;QACf,IAAI,gBAAgB,CAAC;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAC1C,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,CAAC;IAC9E,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC9D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACR,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClD,IAAI,CAAC;YACJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,CAAC;QACX,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACV,OAAO,EACP,OAAO,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,kBAAkB;KACxB,CAAC,EACF,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACJ,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,CAAC;QACX,CAAC;IACF,CAAC,CACD,CAAC;IAEF,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC5E,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO;QACR,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,aAAa,CACZ,IAAI,EACJ,YAAY,CAAC,eAAe,EAAE,mBAAmB,EAAE;gBAClD,IAAI,EAAE,mBAAmB;aACzB,CAAC,CACF,CACD,CAAC;YACF,OAAO;QACR,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YACpF,OAAO;QACR,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,GAAY,EACZ,GAAa,EACb,OAAyB,EACzB,OAA4B;IAE5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,kBAAkB,GACvB,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QACnF,CAAC,CAAE,IAAwB,CAAC,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,kBAAkB,KAAK,IAAI;QAC5C,OAAO,kBAAkB,KAAK,QAAQ;QACtC,OAAO,kBAAkB,KAAK,QAAQ;QACtC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,SAAS,CAAC;IAEb,IAAI,oBAAgE,CAAC;IACrE,IAAI,qBAAyD,CAAC;IAC9D,IAAI,YAA+C,CAAC;IACpD,MAAM,uBAAuB,GAAG,eAAe,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACpF,MAAM,uBAAuB,GAAG,eAAe,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACxF,MAAM,iCAAiC,GAAG;QACzC,GAAG,eAAe,CAAC,GAAG,EAAE,sCAAsC,CAAC;QAC/D,GAAG,eAAe,CAAC,GAAG,EAAE,uCAAuC,CAAC;KAChE,CAAC;IACF,IAAI,iCAAiC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IACD,IACC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QAClC,uBAAuB,CAAC,MAAM,GAAG,CAAC;QAClC,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,CAAC,EACzE,CAAC;QACF,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC;YACJ,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,+BAA+B,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAC/C,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,oBAAoB,GAAG,MAAM,gCAAgC,CAAC;oBAC7D,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAE;oBACpC,IAAI;oBACJ,QAAQ,EAAE,OAAO,CAAC,iBAAiB;iBACnC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;IACF,CAAC;SAAM,CAAC;QACP,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,sBAAsB,IAAI,yBAAyB,EAAE,CAAC;QACrF,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAC5D,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,UAAU,IAAI,CAAC,gBAAgB,KAAK,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAClI,IAAI,wBAAwB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAC9D,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC;gBAC3D,IAAI,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,gCAAgC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;oBACxG,oBAAoB,GAAG,QAAQ,CAAC;oBAChC,qBAAqB,GAAG,cAAc,CAAC;oBACvC,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACP,uBAAuB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC7B,OAAO;YACR,CAAC;QACF,CAAC;aAAM,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;IACF,CAAC;IACD,MAAM,oBAAoB,GAA+B,qBAAqB;QAC7E,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC;YACrG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,yEAAyE,EAAE;YACvG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrB,CAAC,CAAC,MAAM,uBAAuB,CAC7B,OAAO,CAAC,uBAAuB;YAC9B,CAAC,CAAC,OAAwC,EAAE,EAAE,CAC7C,6BAA6B,CAC5B,OAAO,CAAC,OAAwD,CAChE,CAAC,EACJ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CACxB,CAAC;IACJ,IAAI,qBAAqB,IAAI,oBAAoB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpE,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,aAAa,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,eAAe,aAAa,CAAC,IAAI,EAAE,EAAE;QACvC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEnC,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,YAAY;YACZ,oBAAoB;YACpB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,YAAY,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IACC,oBAAoB,CAAC,oBAAoB,KAAK,MAAM;gBACpD,YAAY,CAAC,MAAM,KAAK,SAAS;gBACjC,YAAY,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAClD,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,GAAG,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3D,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,oBAAoB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,qCAAqC,EAAE,CAAC;YAC/G,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,MAAM,eAAe,GAAG,qBAAqB,IAAI,oBAAoB,EAAE,oBAAoB,KAAK,MAAM;QACrG,CAAC,CAAC,CAAC,cAA8B,EAAE,EAAE,CACpC,mCAAmC,CAAC,qBAAqB,EAAE,cAAc,EAAE,oBAAoB,CAAC;QACjG,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IAE7E,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,OAAe;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA6E,CAAC;IACxF,OAAO,CACN,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAChC,CAAC,CAAC,IAAI,KAAK,aAAa;QACxB,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAC7E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8D,CAAC;IACzE,OAAO,CACN,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAC7B,CAAC,CAAC,MAAM,KAAK,GAAG;QAChB,CAAC,CAAC,UAAU,KAAK,GAAG,CACpB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,IAAY;IAClD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAChC,OAAwB,EACxB,KAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,GAAG,EAAE,KAAK,CAAC,OAAO;QAClB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,aAAa,GAAkB,MAAM,CAAC,MAAM,CAAC;QAClD,MAAM,EAAE,KAAK,CAAC,OAAO;QACrB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM;QACN,UAAU,EAAE,oBAAoB;KAChC,CAAC,CAAC;IACH,OAAO;QACN,GAAG,OAAO;QACV,aAAa,EAAE,UAAU;QACzB,KAAK,EAAE,aAAa;KACpB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAa,EAAE,SAA6C;IACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,aAAa,CAAC,SAAS,IAAI,IAAI,EAAE,YAAY,CAAC,eAAe,EAAE,yCAAyC,EAAE;QACzG,IAAI,EAAE,4BAA4B;KAClC,CAAC,CAAC,CACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgB;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAa,CAAC,GAAG,qBAAqB,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC"}

package/dist/direct/http-ingress.js

@@ -88,7 +88,7 @@ export async function startHttpIngress(options) {
                 const healthPath = options.health?.path ?? '/health';
                 console.log(`${logPrefix}   Health:   ${boundPublicUrl}${healthPath}`);
             }
-            const workloadClient = getWorkloadIdentityClient();
+            const workloadClient = options.workloadIdentityClient ?? getWorkloadIdentityClient();
             if (workloadClient.isAvailable() && options.workloadSecurity !== 'disabled') {
                 const bootstrapTimer = setTimeout(() => {
                     void workloadClient.ensureReady().catch(() => {

package/dist/direct/http-ingress.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-ingress.js","sourceRoot":"","sources":["../../src/direct/http-ingress.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,OAAuC,MAAM,SAAS,CAAC;AAG9D,OAAO,EAAE,kBAAkB,EAA4B,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAsD7E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IAClE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACtC,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG;oBACZ,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;oBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;iBACtB,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,CAAC;YACX,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,EACL,MAAM,EAAE,EAAE,EACV,KAAK,EAAE,EAAE,EACT,GAAG,UAAU,EACb,GAAG,OAAO,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAiC;IAEjC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;IACvD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAE3F,MAAM,MAAM,GACX,iBAAiB,CAAC,MAAM;QACxB,CAAC,CAAC,KAAa,EAAE,MAA+B,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,MAAM,KAAK,GACV,MAAM,KAAK,YAAY,IAAI,QAAQ;gBAClC,CAAC,CAAC,cAAc,QAAQ,EAAE;gBAC1B,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;YACtB,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACzF,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,KAAK,IAAI,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxF,OAAO;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,IAAI,SAAS;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAEpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAW,IAAI;YAC1B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjC,SAAS,WAAW;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,SAAS,GACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAChE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACX,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GACnB,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7B,oBAAoB,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;YAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,iBAAiB,cAAc,UAAU,SAAS,GAAG,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,gBAAgB,cAAc,GAAG,OAAO,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,gBAAgB,cAAc,GAAG,YAAY,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,gBAAgB,cAAc,GAAG,UAAU,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,cAAc,GAAG,yBAAyB,EAAE,CAAC;YACnD,IAAI,cAAc,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;gBAC7E,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtC,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;wBAC5C,MAAM,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;oBACtF,CAAC,CAAC,CAAC;gBACJ,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,cAAc,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YACD,OAAO,CAAC;gBACP,GAAG;gBACH,MAAM;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,cAAc;gBACzB,KAAK,EAAE,GAAG,EAAE,CACX,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACjD,CAAC,CAAC;aACH,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACvC,UAA2C,EAAE;IAE7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAEhD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"http-ingress.js","sourceRoot":"","sources":["../../src/direct/http-ingress.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,OAAuC,MAAM,SAAS,CAAC;AAG9D,OAAO,EAAE,kBAAkB,EAA4B,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAsD7E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IAClE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACtC,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG;oBACZ,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;oBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;iBACtB,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,CAAC;YACX,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,EACL,MAAM,EAAE,EAAE,EACV,KAAK,EAAE,EAAE,EACT,GAAG,UAAU,EACb,GAAG,OAAO,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAiC;IAEjC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;IACvD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAE3F,MAAM,MAAM,GACX,iBAAiB,CAAC,MAAM;QACxB,CAAC,CAAC,KAAa,EAAE,MAA+B,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,MAAM,KAAK,GACV,MAAM,KAAK,YAAY,IAAI,QAAQ;gBAClC,CAAC,CAAC,cAAc,QAAQ,EAAE;gBAC1B,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;YACtB,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACzF,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,KAAK,IAAI,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxF,OAAO;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,IAAI,SAAS;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAEpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAW,IAAI;YAC1B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjC,SAAS,WAAW;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,SAAS,GACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAChE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACX,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GACnB,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7B,oBAAoB,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;YAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,iBAAiB,cAAc,UAAU,SAAS,GAAG,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,gBAAgB,cAAc,GAAG,OAAO,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,gBAAgB,cAAc,GAAG,YAAY,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,gBAAgB,cAAc,GAAG,UAAU,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,cAAc,GAAG,OAAO,CAAC,sBAAsB,IAAI,yBAAyB,EAAE,CAAC;YACrF,IAAI,cAAc,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;gBAC7E,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtC,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;wBAC5C,MAAM,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;oBACtF,CAAC,CAAC,CAAC;gBACJ,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,cAAc,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YACD,OAAO,CAAC;gBACP,GAAG;gBACH,MAAM;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,cAAc;gBACzB,KAAK,EAAE,GAAG,EAAE,CACX,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACjD,CAAC,CAAC;aACH,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACvC,UAA2C,EAAE;IAE7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAEhD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC"}