@privos_ai/app-server 0.6.2 → 0.7.0

package/dist/index.d.ts

@@ -25,10 +25,16 @@ export { DEFAULT_HUB_USER_TOKEN_JWKS_PATH, buildHubUserTokenAuthOptions, extract
 export type { HubUserTokenAuthOptions } from './relay/hub-user-token-actor.js';
 export { DEFAULT_STANDALONE_IDENTITY_FILE, StandaloneIdentityError, loadStandaloneIdentity, saveStandaloneIdentity, rotateStandaloneIdentity, standaloneIdentityFileExists, standaloneHubFingerprint, assertStandaloneIdentityShape, } from './relay/standalone-identity.js';
 export type { StandaloneIdentityV2, LoadedStandaloneIdentity, StandaloneIdentityErrorCode, } from './relay/standalone-identity.js';
-export { STANDALONE_SECRET_ROTATE_METHOD, STANDALONE_TRUST_ROTATE_METHOD, STANDALONE_CAPABILITIES_CHANGED_METHOD, StandaloneControlError, isStandaloneControlMethod, createStandaloneRelayIdentityController, loadStandaloneRelayIdentityController, } from './relay/standalone-control.js';
+export { STANDALONE_SECRET_ROTATE_METHOD, STANDALONE_TRUST_ROTATE_METHOD, STANDALONE_CAPABILITIES_CHANGED_METHOD, STANDALONE_AGENT_BOT_CREDENTIAL_METHOD, StandaloneControlError, isStandaloneControlMethod, createStandaloneRelayIdentityController, loadStandaloneRelayIdentityController, } from './relay/standalone-control.js';
 export type { StandaloneEffectiveCapabilities, StandaloneRelayIdentityController, StandaloneRelayIdentityControllerOptions, } from './relay/standalone-control.js';
 export { checkManifestDigestDrift, createStandaloneReadinessCheck, } from './relay/standalone-readiness.js';
 export type { StandaloneReadinessCheckOptions, StandaloneReadinessReason, StandaloneReadinessResult, } from './relay/standalone-readiness.js';
+export { AGENT_BOT_CREDENTIAL_ENV_KEY, AGENT_BOT_USER_ID_ENV_KEY, AGENT_BOT_CREDENTIAL_OPERATOR_INSTRUCTION, readAgentBotCredential, getAgentBotCredentialState, setAdoptedAgentBotCredential, markAgentBotCredentialLive, markAgentBotCredentialRejected, resetAgentBotCredentialOutcomeForTests, } from './relay/agent-bot-credential.js';
+export type { AgentBotCredential, AgentBotCredentialState } from './relay/agent-bot-credential.js';
+export { createAgentBotHubClient, createAgentBotHubClientFromWorkloadIdentity, createAgentBotHubClientFromHubOrigin, AgentBotCredentialAbsentError, AgentBotHubUnreachableError, } from './relay/hub-rest-as-bot-client.js';
+export type { RoomBoundHubClient, RoomBoundHubFetchInit, AgentBotHubClientOptions, } from './relay/hub-rest-as-bot-client.js';
+export { serveApp, DEFAULT_SERVE_APP_PORT } from './serve-app.js';
+export type { ServeAppOptions, ServeAppHandle, ServeAppHandlerContext, ServeAppTransportOverride, ServeAppTestSeams, } from './serve-app.js';
 export { resolveRuntimeMode, RuntimeModeError } from './runtime-mode.js';
 export type { RuntimeMode, RuntimeModeResolution, RuntimeModeErrorCode, ResolveRuntimeModeOptions, } from './runtime-mode.js';
 export { DEFAULT_WORKLOAD_SOCKET, WorkloadIdentityClient, WorkloadIdentityError, WorkloadPermissionDeniedError, RoomBoundWorkloadClient, getWorkloadIdentityClient, } from './workload/workload-identity.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACxE,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,eAAe,GACf,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,qBAAqB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACX,SAAS,EACT,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACX,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,+BAA+B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,WAAW,GACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,OAAO,EACN,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACX,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACX,+BAA+B,EAC/B,iCAAiC,EACjC,wCAAwC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACX,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACX,yBAAyB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,kCAAkC,EAClC,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,8BAA8B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,gCAAgC,EAChC,uCAAuC,EACvC,0CAA0C,EAC1C,gDAAgD,EAChD,oCAAoC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACxE,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACX,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,eAAe,GACf,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,qBAAqB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACX,SAAS,EACT,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACX,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,sBAAsB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,+BAA+B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,WAAW,GACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,OAAO,EACN,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACX,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACX,+BAA+B,EAC/B,iCAAiC,EACjC,wCAAwC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACN,4BAA4B,EAC5B,yBAAyB,EACzB,yCAAyC,EACzC,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,sCAAsC,GACtC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EACN,uBAAuB,EACvB,2CAA2C,EAC3C,oCAAoC,EACpC,6BAA6B,EAC7B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EACX,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACX,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACX,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACX,yBAAyB,EACzB,8BAA8B,EAC9B,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,kCAAkC,EAClC,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,8BAA8B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,gCAAgC,EAChC,uCAAuC,EACvC,0CAA0C,EAC1C,gDAAgD,EAChD,oCAAoC,GACpC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -13,8 +13,11 @@ export { pairOverWebSocket, pairFromDescriptor, connectRelay, } from './relay/re
 export { rawDataToText, MessageTooLargeError } from './relay/message-adapter.js';
 export { DEFAULT_HUB_USER_TOKEN_JWKS_PATH, buildHubUserTokenAuthOptions, extractRelayUserTokenCredential, validateHubUserTokenOrigin, } from './relay/hub-user-token-actor.js';
 export { DEFAULT_STANDALONE_IDENTITY_FILE, StandaloneIdentityError, loadStandaloneIdentity, saveStandaloneIdentity, rotateStandaloneIdentity, standaloneIdentityFileExists, standaloneHubFingerprint, assertStandaloneIdentityShape, } from './relay/standalone-identity.js';
-export { STANDALONE_SECRET_ROTATE_METHOD, STANDALONE_TRUST_ROTATE_METHOD, STANDALONE_CAPABILITIES_CHANGED_METHOD, StandaloneControlError, isStandaloneControlMethod, createStandaloneRelayIdentityController, loadStandaloneRelayIdentityController, } from './relay/standalone-control.js';
+export { STANDALONE_SECRET_ROTATE_METHOD, STANDALONE_TRUST_ROTATE_METHOD, STANDALONE_CAPABILITIES_CHANGED_METHOD, STANDALONE_AGENT_BOT_CREDENTIAL_METHOD, StandaloneControlError, isStandaloneControlMethod, createStandaloneRelayIdentityController, loadStandaloneRelayIdentityController, } from './relay/standalone-control.js';
 export { checkManifestDigestDrift, createStandaloneReadinessCheck, } from './relay/standalone-readiness.js';
+export { AGENT_BOT_CREDENTIAL_ENV_KEY, AGENT_BOT_USER_ID_ENV_KEY, AGENT_BOT_CREDENTIAL_OPERATOR_INSTRUCTION, readAgentBotCredential, getAgentBotCredentialState, setAdoptedAgentBotCredential, markAgentBotCredentialLive, markAgentBotCredentialRejected, resetAgentBotCredentialOutcomeForTests, } from './relay/agent-bot-credential.js';
+export { createAgentBotHubClient, createAgentBotHubClientFromWorkloadIdentity, createAgentBotHubClientFromHubOrigin, AgentBotCredentialAbsentError, AgentBotHubUnreachableError, } from './relay/hub-rest-as-bot-client.js';
+export { serveApp, DEFAULT_SERVE_APP_PORT } from './serve-app.js';
 export { resolveRuntimeMode, RuntimeModeError } from './runtime-mode.js';
 export { DEFAULT_WORKLOAD_SOCKET, WorkloadIdentityClient, WorkloadIdentityError, WorkloadPermissionDeniedError, RoomBoundWorkloadClient, getWorkloadIdentityClient, } from './workload/workload-identity.js';
 export { BoundedRuntimeDispatchReplayConsumerV3, assertRuntimeDispatchRelayAffinityV3, assertRuntimeDispatchTrustConfigurationV3, extractRuntimeDispatchRelayEnvelopeV3, isExactRuntimeReadinessRpcV3, isUnsignedRuntimeReadinessRpcV3, parseRuntimeDispatchTrustV3Json, sha256RuntimeDispatchBodyV3, verifyClusterDispatchAssertionV3, verifyDispatchAssertion, verifyRuntimeDispatchAssertionV3, } from './workload/dispatch-assertion.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQxE,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAahC,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AASlC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACN,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQzE,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAWzC,OAAO,EACN,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAkB1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAc/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQxE,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EACN,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,oBAAoB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAahC,OAAO,EACN,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACN,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AASlC,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACZ,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACN,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,uCAAuC,EACvC,qCAAqC,GACrC,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACN,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACN,4BAA4B,EAC5B,yBAAyB,EACzB,yCAAyC,EACzC,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,sCAAsC,GACtC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACN,uBAAuB,EACvB,2CAA2C,EAC3C,oCAAoC,EACpC,6BAA6B,EAC7B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAC;AAO3C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AASlE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQzE,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iCAAiC,CAAC;AAWzC,OAAO,EACN,sCAAsC,EACtC,oCAAoC,EACpC,yCAAyC,EACzC,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,gCAAgC,GAChC,MAAM,kCAAkC,CAAC;AAkB1C,OAAO,EACN,gCAAgC,EAChC,+CAA+C,EAC/C,6CAA6C,GAC7C,MAAM,uCAAuC,CAAC;AAc/C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,kCAAkC,GAClC,MAAM,qBAAqB,CAAC"}

package/dist/relay/agent-bot-credential.d.ts

@@ -0,0 +1,71 @@
+/**
+ * An app's own installation-bot credential, read from its own environment or
+ * adopted live over the standalone control channel.
+ *
+ * There is no issuance code path here. A workspace admin issues (or re-issues)
+ * the credential from Hub's admin app settings page; Hub mints it, then
+ * delivers it to the running app one of two ways:
+ *   - managed / marketplace: written into the app's encrypted env config, so it
+ *     arrives as an environment variable at container (re)start;
+ *   - standalone-production: pushed as a signed control assertion over the Relay
+ *     WebSocket (see `standalone-control.ts`), which persists it into the
+ *     identity file and adopts it in-process HOT — no restart required.
+ *
+ * This module therefore does exactly these things, and nothing else:
+ *   - read the two reserved env vars, fresh, every time (env is the operator
+ *     override and always wins);
+ *   - fall back to a live-adopted / identity-file-persisted value when the env
+ *     vars are absent (the standalone hot-adoption path);
+ *   - derive a coarse state from the last outcome of actually using them;
+ *   - let the transport that uses them report what happened, without ever
+ *     handing the token itself to anything but the transport's own headers.
+ *
+ * No function here returns, logs, or throws the credential value beyond the
+ * opaque pair `readAgentBotCredential` returns for the transport to place
+ * directly into request headers.
+ */
+/** The reserved manifest env keys Hub uses to deliver this credential. */
+export declare const AGENT_BOT_CREDENTIAL_ENV_KEY = "PRIVOS_AGENT_BOT_CREDENTIAL";
+export declare const AGENT_BOT_USER_ID_ENV_KEY = "PRIVOS_AGENT_BOT_USER_ID";
+/**
+ * Derived credential state — never owned, always recomputed:
+ *   - `absent`: neither the env pair nor an adopted value is available. Normal
+ *     for a fresh install; the credential arrives later and out-of-band.
+ *   - `live`: a credential is available and the most recent call using it (if
+ *     any) did not come back 401. Optimistic default before any call.
+ *   - `rejected`: the most recent call using this exact credential came back
+ *     401. Every re-issue rotates the previous token dead, and revocation has
+ *     more causes than loss (grant change, suspension, upgrade cutover,
+ *     uninstall) — this app cannot distinguish them and cannot fix any of them.
+ *     Only a newly delivered credential (env restart, or a fresh control-channel
+ *     push) can return to `live`.
+ */
+export type AgentBotCredentialState = 'absent' | 'live' | 'rejected';
+/** Opaque header pair. Never stringify, log, or embed this outside a request header. */
+export interface AgentBotCredential {
+    readonly botUserId: string;
+    readonly token: string;
+}
+/** Operator-facing instruction shown while the app cannot use its own credential. */
+export declare const AGENT_BOT_CREDENTIAL_OPERATOR_INSTRUCTION: string;
+/**
+ * Adopt a credential delivered out-of-band (standalone control channel, or a
+ * boot-time seed from the persisted identity file). Env always overrides this,
+ * so adopting never masks an operator-set env value. A fresh adoption clears the
+ * last outcome so a previously-rejected token does not keep the state `rejected`.
+ */
+export declare function setAdoptedAgentBotCredential(credential: AgentBotCredential): void;
+/**
+ * Read the credential: the env pair first (operator override), then any
+ * adopted / persisted value. `null` when neither is available.
+ */
+export declare function readAgentBotCredential(): AgentBotCredential | null;
+/** Current derived state. Safe to expose to a UI: never carries the token. */
+export declare function getAgentBotCredentialState(): AgentBotCredentialState;
+/** Record that the credential was just used successfully. */
+export declare function markAgentBotCredentialLive(): void;
+/** Record that Hub just rejected this exact credential with 401. */
+export declare function markAgentBotCredentialRejected(): void;
+/** Test-only: reset all in-process state so cases do not leak into each other. */
+export declare function resetAgentBotCredentialOutcomeForTests(): void;
+//# sourceMappingURL=agent-bot-credential.d.ts.map

package/dist/relay/agent-bot-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-bot-credential.d.ts","sourceRoot":"","sources":["../../src/relay/agent-bot-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAC1E,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAErE,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,qFAAqF;AACrF,eAAO,MAAM,yCAAyC,QAE2C,CAAC;AAiBlG;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAKjF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,GAAG,IAAI,CAQlE;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,IAAI,uBAAuB,CAGpE;AAED,6DAA6D;AAC7D,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED,kFAAkF;AAClF,wBAAgB,sCAAsC,IAAI,IAAI,CAG7D"}

package/dist/relay/agent-bot-credential.js

@@ -0,0 +1,92 @@
+/**
+ * An app's own installation-bot credential, read from its own environment or
+ * adopted live over the standalone control channel.
+ *
+ * There is no issuance code path here. A workspace admin issues (or re-issues)
+ * the credential from Hub's admin app settings page; Hub mints it, then
+ * delivers it to the running app one of two ways:
+ *   - managed / marketplace: written into the app's encrypted env config, so it
+ *     arrives as an environment variable at container (re)start;
+ *   - standalone-production: pushed as a signed control assertion over the Relay
+ *     WebSocket (see `standalone-control.ts`), which persists it into the
+ *     identity file and adopts it in-process HOT — no restart required.
+ *
+ * This module therefore does exactly these things, and nothing else:
+ *   - read the two reserved env vars, fresh, every time (env is the operator
+ *     override and always wins);
+ *   - fall back to a live-adopted / identity-file-persisted value when the env
+ *     vars are absent (the standalone hot-adoption path);
+ *   - derive a coarse state from the last outcome of actually using them;
+ *   - let the transport that uses them report what happened, without ever
+ *     handing the token itself to anything but the transport's own headers.
+ *
+ * No function here returns, logs, or throws the credential value beyond the
+ * opaque pair `readAgentBotCredential` returns for the transport to place
+ * directly into request headers.
+ */
+/** The reserved manifest env keys Hub uses to deliver this credential. */
+export const AGENT_BOT_CREDENTIAL_ENV_KEY = 'PRIVOS_AGENT_BOT_CREDENTIAL';
+export const AGENT_BOT_USER_ID_ENV_KEY = 'PRIVOS_AGENT_BOT_USER_ID';
+/** Operator-facing instruction shown while the app cannot use its own credential. */
+export const AGENT_BOT_CREDENTIAL_OPERATOR_INSTRUCTION = 'A workspace admin must issue or re-issue this app’s credential from Hub → Admin → Apps '
+    + '→ this app → Settings, then press Apply. This app cannot issue or repair its own credential.';
+// Last observed outcome of actually using the credential. `null` means no
+// call has been made yet in this process, which reads as `live` (optimistic)
+// per the state machine above.
+let lastOutcome = null;
+// A credential adopted at boot (seeded from the persisted identity file) or
+// hot over the standalone control channel. Env always wins over this; it is the
+// fallback that makes standalone delivery without a restart observable at all.
+let adopted = null;
+function normalize(botUserId, token) {
+    if (!token.trim() || !botUserId.trim())
+        return null;
+    return Object.freeze({ botUserId: botUserId.trim(), token });
+}
+/**
+ * Adopt a credential delivered out-of-band (standalone control channel, or a
+ * boot-time seed from the persisted identity file). Env always overrides this,
+ * so adopting never masks an operator-set env value. A fresh adoption clears the
+ * last outcome so a previously-rejected token does not keep the state `rejected`.
+ */
+export function setAdoptedAgentBotCredential(credential) {
+    const next = normalize(credential.botUserId, credential.token);
+    if (!next)
+        return;
+    adopted = next;
+    lastOutcome = null;
+}
+/**
+ * Read the credential: the env pair first (operator override), then any
+ * adopted / persisted value. `null` when neither is available.
+ */
+export function readAgentBotCredential() {
+    const token = process.env[AGENT_BOT_CREDENTIAL_ENV_KEY];
+    const botUserId = process.env[AGENT_BOT_USER_ID_ENV_KEY];
+    if (token && botUserId) {
+        const fromEnv = normalize(botUserId, token);
+        if (fromEnv)
+            return fromEnv;
+    }
+    return adopted;
+}
+/** Current derived state. Safe to expose to a UI: never carries the token. */
+export function getAgentBotCredentialState() {
+    if (!readAgentBotCredential())
+        return 'absent';
+    return lastOutcome === 'rejected' ? 'rejected' : 'live';
+}
+/** Record that the credential was just used successfully. */
+export function markAgentBotCredentialLive() {
+    lastOutcome = 'live';
+}
+/** Record that Hub just rejected this exact credential with 401. */
+export function markAgentBotCredentialRejected() {
+    lastOutcome = 'rejected';
+}
+/** Test-only: reset all in-process state so cases do not leak into each other. */
+export function resetAgentBotCredentialOutcomeForTests() {
+    lastOutcome = null;
+    adopted = null;
+}
+//# sourceMappingURL=agent-bot-credential.js.map

package/dist/relay/agent-bot-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-bot-credential.js","sourceRoot":"","sources":["../../src/relay/agent-bot-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,6BAA6B,CAAC;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAuBpE,qFAAqF;AACrF,MAAM,CAAC,MAAM,yCAAyC,GACrD,yFAAyF;MACvF,8FAA8F,CAAC;AAElG,0EAA0E;AAC1E,6EAA6E;AAC7E,+BAA+B;AAC/B,IAAI,WAAW,GAA+B,IAAI,CAAC;AAEnD,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,IAAI,OAAO,GAA8B,IAAI,CAAC;AAE9C,SAAS,SAAS,CAAC,SAAiB,EAAE,KAAa;IAClD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAA8B;IAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,OAAO,GAAG,IAAI,CAAC;IACf,WAAW,GAAG,IAAI,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B;IACzC,IAAI,CAAC,sBAAsB,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,0BAA0B;IACzC,WAAW,GAAG,MAAM,CAAC;AACtB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,8BAA8B;IAC7C,WAAW,GAAG,UAAU,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sCAAsC;IACrD,WAAW,GAAG,IAAI,CAAC;IACnB,OAAO,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/relay/hub-rest-as-bot-client.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Hub REST transport that authenticates as this app's own installation bot.
+ *
+ * Hub authenticates a REST call from the header PAIR `x-user-id` +
+ * `x-auth-token` (privos-hub `apps/meteor/app/api/server/api.ts` auth path).
+ * This transport reads that pair from `agent-bot-credential.ts` on every
+ * call — never once at construction — and never carries any Sandbox
+ * selector, verified-room binding, or human-actor identity: the bot is a
+ * standing, room-independent identity, so this transport needs no
+ * `ToolCallContext` at all and works exactly the same inside a live tool
+ * call as it does in the background.
+ *
+ * This is the canonical home of `RoomBoundHubClient` / `RoomBoundHubFetchInit`.
+ * Both this bot-credential transport and the per-call room-bound workload
+ * client (`workloadIdentityClient.forRoom(context)`) satisfy the same
+ * `RoomBoundHubClient` shape, so callers can accept either without a second
+ * interface.
+ */
+import type { WorkloadIdentityClient } from '../workload/workload-identity.js';
+/** The room-bound surface a Hub REST caller is allowed to use. */
+export interface RoomBoundHubClient {
+    authorizedFetch(input: string, init: RoomBoundHubFetchInit): Promise<Response>;
+}
+export interface RoomBoundHubFetchInit extends RequestInit {
+    /** One exact granted permission this call exercises. Documentation only here: this transport carries exactly one identity, not a per-scope token. */
+    requiredScope: string;
+    retryMode?: 'safe-methods' | 'idempotent' | 'never';
+    replayable?: true;
+}
+/** The credential is absent: there is nothing to send. Distinct from a Hub rejection. */
+export declare class AgentBotCredentialAbsentError extends Error {
+    constructor();
+}
+/**
+ * Hub could not be reached, or its origin could not be resolved. Distinct
+ * from a 401: nothing here says the credential itself is wrong. Deliberately
+ * carries no cause detail — a caught network error's message is never safe to
+ * surface, since nothing guarantees it cannot embed request state.
+ */
+export declare class AgentBotHubUnreachableError extends Error {
+    constructor();
+}
+export interface AgentBotHubClientOptions {
+    /** Resolve the current Hub origin. `undefined` means Hub is unreachable right now. */
+    resolveHubOrigin: () => Promise<string | undefined>;
+    fetchImplementation?: typeof fetch;
+}
+/**
+ * Build the bot-credential transport.
+ *
+ * Every call re-reads the credential and re-resolves the Hub origin, so a
+ * long-lived instance never holds a stale value across a container restart
+ * boundary (irrelevant in practice, since a restart is a new process) or
+ * across a hot credential re-issue within the same process (relevant: the
+ * standalone control channel adopts a re-issued value in-process, and reading
+ * fresh here is what makes that observable without a restart).
+ */
+export declare function createAgentBotHubClient(options: AgentBotHubClientOptions): RoomBoundHubClient;
+/**
+ * Managed-mode production factory: resolve the Hub origin from the same
+ * broker connection the workload identity client already maintains,
+ * independent of any verified `ToolCallContext` — `brokerContext()` is
+ * available whenever this process is paired, exactly the background-safe
+ * property this transport needs. Managed mode only: standalone-production
+ * (Relay) never mounts a workload broker, so this factory is not usable
+ * there — see `createAgentBotHubClientFromHubOrigin`.
+ */
+export declare function createAgentBotHubClientFromWorkloadIdentity(workloadIdentityClient: WorkloadIdentityClient): RoomBoundHubClient;
+/**
+ * Standalone-production factory: there is no workload broker to resolve a
+ * Hub origin from in this mode, so the caller supplies the one already
+ * pinned in the paired standalone identity file (`loadStandaloneIdentity()`
+ * → `relay.privosUrl` — the same origin the Relay OAuth token and WebSocket
+ * are reached at).
+ */
+export declare function createAgentBotHubClientFromHubOrigin(hubOrigin: string): RoomBoundHubClient;
+//# sourceMappingURL=hub-rest-as-bot-client.d.ts.map

package/dist/relay/hub-rest-as-bot-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-rest-as-bot-client.d.ts","sourceRoot":"","sources":["../../src/relay/hub-rest-as-bot-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAQ/E,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IAClC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACzD,qJAAqJ;IACrJ,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,cAAc,GAAG,YAAY,GAAG,OAAO,CAAC;IACpD,UAAU,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAaD,MAAM,WAAW,wBAAwB;IACxC,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,mBAAmB,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,kBAAkB,CA4D7F;AAED;;;;;;;;GAQG;AACH,wBAAgB,2CAA2C,CAAC,sBAAsB,EAAE,sBAAsB,GAAG,kBAAkB,CAU9H;AAED;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAE1F"}

package/dist/relay/hub-rest-as-bot-client.js

@@ -0,0 +1,136 @@
+import { markAgentBotCredentialLive, markAgentBotCredentialRejected, readAgentBotCredential, } from './agent-bot-credential.js';
+/** The credential is absent: there is nothing to send. Distinct from a Hub rejection. */
+export class AgentBotCredentialAbsentError extends Error {
+    constructor() {
+        super('agent_bot_credential_absent');
+        this.name = 'AgentBotCredentialAbsentError';
+    }
+}
+/**
+ * Hub could not be reached, or its origin could not be resolved. Distinct
+ * from a 401: nothing here says the credential itself is wrong. Deliberately
+ * carries no cause detail — a caught network error's message is never safe to
+ * surface, since nothing guarantees it cannot embed request state.
+ */
+export class AgentBotHubUnreachableError extends Error {
+    constructor() {
+        super('agent_bot_hub_unreachable');
+        this.name = 'AgentBotHubUnreachableError';
+    }
+}
+const RETRY_ATTEMPTS = 3;
+const RETRY_BASE_DELAY_MS = 200;
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const isRetryableMethod = (method, retryMode) => {
+    if (retryMode === 'safe-methods')
+        return method === 'GET' || method === 'HEAD';
+    if (retryMode === 'idempotent')
+        return method === 'GET' || method === 'HEAD' || method === 'PUT' || method === 'DELETE';
+    return false;
+};
+/**
+ * Build the bot-credential transport.
+ *
+ * Every call re-reads the credential and re-resolves the Hub origin, so a
+ * long-lived instance never holds a stale value across a container restart
+ * boundary (irrelevant in practice, since a restart is a new process) or
+ * across a hot credential re-issue within the same process (relevant: the
+ * standalone control channel adopts a re-issued value in-process, and reading
+ * fresh here is what makes that observable without a restart).
+ */
+export function createAgentBotHubClient(options) {
+    const doFetch = options.fetchImplementation ?? fetch;
+    async function attempt(url, init, credential) {
+        const { requiredScope: _requiredScope, retryMode: _retryMode, replayable: _replayable, headers, ...rest } = init;
+        const response = await doFetch(url, {
+            ...rest,
+            headers: {
+                ...headers,
+                'x-user-id': credential.botUserId,
+                'x-auth-token': credential.token,
+            },
+        });
+        if (response.status === 401)
+            markAgentBotCredentialRejected();
+        else if (response.ok)
+            markAgentBotCredentialLive();
+        return response;
+    }
+    return {
+        async authorizedFetch(input, init) {
+            const credential = readAgentBotCredential();
+            if (!credential)
+                throw new AgentBotCredentialAbsentError();
+            let hubOrigin;
+            try {
+                hubOrigin = await options.resolveHubOrigin();
+            }
+            catch {
+                hubOrigin = undefined;
+            }
+            if (!hubOrigin)
+                throw new AgentBotHubUnreachableError();
+            const url = `${hubOrigin}${input}`;
+            const method = (init.method || 'GET').toUpperCase();
+            const retryable = isRetryableMethod(method, init.retryMode);
+            const maxAttempts = retryable ? RETRY_ATTEMPTS : 1;
+            for (let index = 0; index < maxAttempts; index += 1) {
+                try {
+                    const response = await attempt(url, init, credential);
+                    // A 401 is a definitive rejection: retrying with the SAME stale
+                    // credential cannot succeed, so it is never retried.
+                    if (response.status === 401)
+                        return response;
+                    if (response.status >= 500 && retryable && index < maxAttempts - 1) {
+                        await delay(RETRY_BASE_DELAY_MS * 2 ** index);
+                        continue;
+                    }
+                    return response;
+                }
+                catch {
+                    // Network/DNS/timeout failure. The caught error is discarded
+                    // entirely and never inspected: nothing guarantees its message
+                    // cannot embed request state, and none of it is safe to surface.
+                    if (!retryable || index >= maxAttempts - 1)
+                        throw new AgentBotHubUnreachableError();
+                    await delay(RETRY_BASE_DELAY_MS * 2 ** index);
+                }
+            }
+            // Unreachable in practice (the loop above always returns or throws),
+            // kept only so this function has an exhaustive static return type.
+            throw new AgentBotHubUnreachableError();
+        },
+    };
+}
+/**
+ * Managed-mode production factory: resolve the Hub origin from the same
+ * broker connection the workload identity client already maintains,
+ * independent of any verified `ToolCallContext` — `brokerContext()` is
+ * available whenever this process is paired, exactly the background-safe
+ * property this transport needs. Managed mode only: standalone-production
+ * (Relay) never mounts a workload broker, so this factory is not usable
+ * there — see `createAgentBotHubClientFromHubOrigin`.
+ */
+export function createAgentBotHubClientFromWorkloadIdentity(workloadIdentityClient) {
+    return createAgentBotHubClient({
+        resolveHubOrigin: async () => {
+            try {
+                return (await workloadIdentityClient.brokerContext()).hubOrigin;
+            }
+            catch {
+                return undefined;
+            }
+        },
+    });
+}
+/**
+ * Standalone-production factory: there is no workload broker to resolve a
+ * Hub origin from in this mode, so the caller supplies the one already
+ * pinned in the paired standalone identity file (`loadStandaloneIdentity()`
+ * → `relay.privosUrl` — the same origin the Relay OAuth token and WebSocket
+ * are reached at).
+ */
+export function createAgentBotHubClientFromHubOrigin(hubOrigin) {
+    return createAgentBotHubClient({ resolveHubOrigin: async () => hubOrigin });
+}
+//# sourceMappingURL=hub-rest-as-bot-client.js.map

package/dist/relay/hub-rest-as-bot-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-rest-as-bot-client.js","sourceRoot":"","sources":["../../src/relay/hub-rest-as-bot-client.ts"],"names":[],"mappings":"AAoBA,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,GACtB,MAAM,2BAA2B,CAAC;AAcnC,yFAAyF;AACzF,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACvD;QACC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC7C,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACrD;QACC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC3C,CAAC;CACD;AAED,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE/F,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,SAA6C,EAAW,EAAE;IACpG,IAAI,SAAS,KAAK,cAAc;QAAE,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IAC/E,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,CAAC;IACxH,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAQF;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAmB,IAAI,KAAK,CAAC;IAErD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAA2B,EAAE,UAAgD;QAChH,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACjH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACnC,GAAG,IAAI;YACP,OAAO,EAAE;gBACR,GAAI,OAA8C;gBAClD,WAAW,EAAE,UAAU,CAAC,SAAS;gBACjC,cAAc,EAAE,UAAU,CAAC,KAAK;aAChC;SACD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,8BAA8B,EAAE,CAAC;aACzD,IAAI,QAAQ,CAAC,EAAE;YAAE,0BAA0B,EAAE,CAAC;QACnD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO;QACN,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI;YAChC,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;YAC5C,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAE3D,IAAI,SAA6B,CAAC;YAClC,IAAI,CAAC;gBACJ,SAAS,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS,GAAG,SAAS,CAAC;YACvB,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,2BAA2B,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;YAEnC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YAEnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;oBACtD,gEAAgE;oBAChE,qDAAqD;oBACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;wBAAE,OAAO,QAAQ,CAAC;oBAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,SAAS,IAAI,KAAK,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;wBACpE,MAAM,KAAK,CAAC,mBAAmB,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;wBAC9C,SAAS;oBACV,CAAC;oBACD,OAAO,QAAQ,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,6DAA6D;oBAC7D,+DAA+D;oBAC/D,iEAAiE;oBACjE,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,WAAW,GAAG,CAAC;wBAAE,MAAM,IAAI,2BAA2B,EAAE,CAAC;oBACpF,MAAM,KAAK,CAAC,mBAAmB,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;gBAC/C,CAAC;YACF,CAAC;YACD,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,IAAI,2BAA2B,EAAE,CAAC;QACzC,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2CAA2C,CAAC,sBAA8C;IACzG,OAAO,uBAAuB,CAAC;QAC9B,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC;gBACJ,OAAO,CAAC,MAAM,sBAAsB,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oCAAoC,CAAC,SAAiB;IACrE,OAAO,uBAAuB,CAAC,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/dist/relay/standalone-control.d.ts

@@ -3,7 +3,8 @@ import { type LoadedStandaloneIdentity } from './standalone-identity.js';
 export declare const STANDALONE_SECRET_ROTATE_METHOD = "notifications/privos.standaloneSecretRotate";
 export declare const STANDALONE_TRUST_ROTATE_METHOD = "notifications/privos.standaloneTrustRotate";
 export declare const STANDALONE_CAPABILITIES_CHANGED_METHOD = "notifications/privos.standaloneCapabilitiesChanged";
-export declare function isStandaloneControlMethod(method: unknown): method is typeof STANDALONE_SECRET_ROTATE_METHOD | typeof STANDALONE_TRUST_ROTATE_METHOD | typeof STANDALONE_CAPABILITIES_CHANGED_METHOD;
+export declare const STANDALONE_AGENT_BOT_CREDENTIAL_METHOD = "notifications/privos.agentBotCredential";
+export declare function isStandaloneControlMethod(method: unknown): method is typeof STANDALONE_SECRET_ROTATE_METHOD | typeof STANDALONE_TRUST_ROTATE_METHOD | typeof STANDALONE_CAPABILITIES_CHANGED_METHOD | typeof STANDALONE_AGENT_BOT_CREDENTIAL_METHOD;
 export type StandaloneEffectiveCapabilities = Readonly<{
     scopes: readonly string[];
     grantEpoch: number;

package/dist/relay/standalone-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standalone-control.d.ts","sourceRoot":"","sources":["../../src/relay/standalone-control.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEN,KAAK,sBAAsB,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAIN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,+BAA+B,gDAAgD,CAAC;AAC7F,eAAO,MAAM,8BAA8B,+CAA+C,CAAC;AAC3F,eAAO,MAAM,sCAAsC,uDAAuD,CAAC;AAQ3G,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAC/D,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,sCAAsC,CAE/C;AAED,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACtD,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAYH,qBAAa,sBAAuB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI3B;AA+ID,MAAM,WAAW,iCAAiC;IACjD,cAAc,IAAI,QAAQ,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,IAAI,sBAAsB,CAAC;IACnC,yBAAyB,IAAI,+BAA+B,CAAC;IAC7D,qBAAqB,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,+BAA+B,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACrG;;;OAGG;IACH,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC3F;AAED,MAAM,MAAM,wCAAwC,GAAG,QAAQ,CAAC;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE,CAAC,CAAC;AAkDH;;;;;GAKG;AACH,wBAAgB,uCAAuC,CACtD,MAAM,EAAE,wBAAwB,EAChC,OAAO,GAAE,wCAA6C,GACpD,iCAAiC,CA6GnC;AAED,gFAAgF;AAChF,wBAAgB,qCAAqC,CACpD,OAAO,GAAE,wCAA6C,GACpD,iCAAiC,CAGnC"}
+{"version":3,"file":"standalone-control.d.ts","sourceRoot":"","sources":["../../src/relay/standalone-control.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEN,KAAK,sBAAsB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAIN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,+BAA+B,gDAAgD,CAAC;AAC7F,eAAO,MAAM,8BAA8B,+CAA+C,CAAC;AAC3F,eAAO,MAAM,sCAAsC,uDAAuD,CAAC;AAC3G,eAAO,MAAM,sCAAsC,4CAA4C,CAAC;AAShG,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAC/D,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,sCAAsC,GAC7C,OAAO,sCAAsC,CAE/C;AAED,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACtD,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAaH,qBAAa,sBAAuB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI3B;AA+ID,MAAM,WAAW,iCAAiC;IACjD,cAAc,IAAI,QAAQ,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,IAAI,sBAAsB,CAAC;IACnC,yBAAyB,IAAI,+BAA+B,CAAC;IAC7D,qBAAqB,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,+BAA+B,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACrG;;;OAGG;IACH,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC3F;AAED,MAAM,MAAM,wCAAwC,GAAG,QAAQ,CAAC;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE,CAAC,CAAC;AA+DH;;;;;GAKG;AACH,wBAAgB,uCAAuC,CACtD,MAAM,EAAE,wBAAwB,EAChC,OAAO,GAAE,wCAA6C,GACpD,iCAAiC,CAwInC;AAED,gFAAgF;AAChF,wBAAgB,qCAAqC,CACpD,OAAO,GAAE,wCAA6C,GACpD,iCAAiC,CAGnC"}

package/dist/relay/standalone-control.js

@@ -21,14 +21,17 @@
  */
 import crypto from 'node:crypto';
 import { assertRuntimeDispatchTrustConfigurationV3, } from '../workload/dispatch-assertion.js';
+import { setAdoptedAgentBotCredential } from './agent-bot-credential.js';
 import { loadStandaloneIdentity, rotateStandaloneIdentity, standaloneHubFingerprint, } from './standalone-identity.js';
 export const STANDALONE_SECRET_ROTATE_METHOD = 'notifications/privos.standaloneSecretRotate';
 export const STANDALONE_TRUST_ROTATE_METHOD = 'notifications/privos.standaloneTrustRotate';
 export const STANDALONE_CAPABILITIES_CHANGED_METHOD = 'notifications/privos.standaloneCapabilitiesChanged';
+export const STANDALONE_AGENT_BOT_CREDENTIAL_METHOD = 'notifications/privos.agentBotCredential';
 const CONTROL_METHODS = new Set([
     STANDALONE_SECRET_ROTATE_METHOD,
     STANDALONE_TRUST_ROTATE_METHOD,
     STANDALONE_CAPABILITIES_CHANGED_METHOD,
+    STANDALONE_AGENT_BOT_CREDENTIAL_METHOD,
 ]);
 export function isStandaloneControlMethod(method) {
     return typeof method === 'string' && CONTROL_METHODS.has(method);
@@ -39,6 +42,7 @@ const CONTROL_TYPE_BY_METHOD = {
     [STANDALONE_SECRET_ROTATE_METHOD]: 'standalone-secret-rotate',
     [STANDALONE_TRUST_ROTATE_METHOD]: 'standalone-trust-rotate',
     [STANDALONE_CAPABILITIES_CHANGED_METHOD]: 'standalone-capabilities-changed',
+    [STANDALONE_AGENT_BOT_CREDENTIAL_METHOD]: 'standalone-agent-bot-credential',
 };
 const MAX_CONTROL_COMPACT_BYTES = 32_768;
 const DEFAULT_REPLAY_CAPACITY = 64;
@@ -206,6 +210,16 @@ function assertTrustRotateData(value, current) {
         throw new StandaloneControlError('standalone_control_trust_rotate_identity_mismatch');
     }
 }
+function assertAgentBotCredentialData(value) {
+    if (!isRecord(value) ||
+        !exactKeys(value, ['botUserId', 'token']) ||
+        typeof value.botUserId !== 'string' ||
+        !value.botUserId ||
+        typeof value.token !== 'string' ||
+        !value.token) {
+        throw new StandaloneControlError('standalone_control_agent_bot_credential_data_invalid');
+    }
+}
 function assertCapabilitiesChangedData(value) {
     if (!isRecord(value) ||
         !exactKeys(value, ['scopes', 'grantEpoch']) ||
@@ -277,6 +291,29 @@ export function createStandaloneRelayIdentityController(loaded, options = {}) {
         });
         options.onRotated?.(current);
     }
+    async function applyAgentBotCredential(assertionCompact) {
+        if (typeof assertionCompact !== 'string')
+            throw new StandaloneControlError('standalone_control_assertion_invalid');
+        const verified = verifyStandaloneControlAssertion({
+            method: STANDALONE_AGENT_BOT_CREDENTIAL_METHOD,
+            compact: assertionCompact,
+            trust: current.trust,
+            replay,
+            now: now(),
+            clockSkewSeconds,
+        });
+        assertAgentBotCredentialData(verified.data);
+        const { botUserId, token } = verified.data;
+        // Persist into the identity file so the credential survives a restart,
+        // then adopt it in-process so the running app uses it HOT — no restart.
+        // Env always overrides the adopted value (operator override preserved).
+        const rotated = await rotateStandaloneIdentity((identity) => ({ ...identity, agentBotCredential: { botUserId, token }, rotatedAt: Date.now() }), { filePath: current.filePath });
+        current = rotated;
+        setAdoptedAgentBotCredential({ botUserId, token });
+        // The token is never logged; only that a delivery landed.
+        options.logger?.('standalone.identity.agent_bot_credential_delivered', { filePath: current.filePath });
+        options.onRotated?.(current);
+    }
     async function applyCapabilitiesChanged(assertionCompact) {
         if (typeof assertionCompact !== 'string')
             throw new StandaloneControlError('standalone_control_assertion_invalid');
@@ -324,6 +361,8 @@ export function createStandaloneRelayIdentityController(loaded, options = {}) {
                 await applySecretRotate(assertion);
             else if (method === STANDALONE_TRUST_ROTATE_METHOD)
                 await applyTrustRotate(assertion);
+            else if (method === STANDALONE_AGENT_BOT_CREDENTIAL_METHOD)
+                await applyAgentBotCredential(assertion);
             else
                 await applyCapabilitiesChanged(assertion);
             return 'handled';

package/dist/relay/standalone-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"standalone-control.js","sourceRoot":"","sources":["../../src/relay/standalone-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACN,yCAAyC,GAEzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GAGxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,+BAA+B,GAAG,6CAA6C,CAAC;AAC7F,MAAM,CAAC,MAAM,8BAA8B,GAAG,4CAA4C,CAAC;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,oDAAoD,CAAC;AAE3G,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACpD,+BAA+B;IAC/B,8BAA8B;IAC9B,sCAAsC;CACtC,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,MAAe;IAIxD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAQD,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAU,CAAC;AAC9E,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAU,CAAC;AACtH,MAAM,sBAAsB,GAAqC;IAChE,CAAC,+BAA+B,CAAC,EAAE,0BAA0B;IAC7D,CAAC,8BAA8B,CAAC,EAAE,yBAAyB;IAC3D,CAAC,sCAAsC,CAAC,EAAE,iCAAiC;CAC3E,CAAC;AACF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACtC,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACtH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,4BAA4B;IAEJ;IADZ,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,YAA6B,WAAW,uBAAuB;QAAlC,aAAQ,GAAR,QAAQ,CAA0B;IAAG,CAAC;IACnE,OAAO,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW;QAClD,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;YACnE,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAID,SAAS,gCAAgC,CAAQ,KAOhD;IACA,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QAC/G,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAChI,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC7D,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACtH,IACC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EACzE,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACvC,MAAM,CAAC,GAAG,KAAK,OAAO;QACtB,MAAM,CAAC,GAAG,KAAK,mCAAmC;QAClD,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5B,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,EAChC,CAAC;QACF,wEAAwE;QACxE,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;QACzC,OAAO,CAAC,eAAe,KAAK,CAAC;QAC7B,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,OAAO,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC1D,OAAO,CAAC,GAAG,KAAK,eAAe,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAC9D,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,OAAO,CAAC,GAAG;QACZ,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,CAAC,OAAO,CAAC,KAAK;QACd,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EACtB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,SAAS,CAAC,UAAU,KAAK,EAAE;QAC3B,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,EACvH,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IACC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,gBAAgB;QACxC,GAAG,IAAI,KAAK,CAAC,GAAG;QAChB,GAAG,IAAI,GAAG;QACV,GAAG,GAAG,GAAG,GAAG,EAAE,EACb,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAa,EAAE,CAAC;AACxC,CAAC;AAsBD,SAAS,sBAAsB,CAAC,KAAc;IAC7C,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,YAAY,EAClB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,OAA+B;IAC7E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC;QACJ,yCAAyC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAA+B,CAAC;IACnD,IACC,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW;QAC1D,IAAI,CAAC,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY;QAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ;QACpD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAC7E,CAAC;QACF,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,IAAI,sBAAsB,CAAC,mDAAmD,CAAC,CAAC;IACvF,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc;IACpD,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACvD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAC3B,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uCAAuC,CACtD,MAAgC,EAChC,UAAoD,EAAE;IAEtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAClD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,YAAY,GAAoC,MAAM,CAAC,MAAM,CAAC;QACjE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,yBAAyB,IAAI,CAAC;QACjE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmD,CAAC;IAE7E,KAAK,UAAU,iBAAiB,CAAC,gBAAyB;QACzD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,+BAA+B;YACvC,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC7C,CAAC,QAAQ,EAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EACpG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACF,OAAO,GAAG,OAAO,CAAC;QAClB,OAAO,CAAC,MAAM,EAAE,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,gBAAyB;QACxD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,8BAA8B;YACtC,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC7C,CAAC,QAAQ,EAAwB,EAAE,CAAC,CAAC;YACpC,GAAG,QAAQ;YACX,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,wBAAwB,CAAC,SAAS,CAAC,MAAM,CAAC;YACvD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,EACF,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACF,OAAO,GAAG,OAAO,CAAC;QAClB,OAAO,CAAC,MAAM,EAAE,CAAC,mCAAmC,EAAE;YACrD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,gBAAyB;QAChE,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,sCAAsC;YAC9C,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAoC,MAAM,CAAC,MAAM,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;YAC/C,iEAAiE;YACjE,OAAO;QACR,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC;gBACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACR,4DAA4D;YAC7D,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;QACnC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;QAC7B,yBAAyB,EAAE,GAAG,EAAE,CAAC,YAAY;QAC7C,qBAAqB,EAAE,CAAC,QAAQ,EAAE,EAAE;YACnC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM;YAC7C,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,IAAI,MAAM,KAAK,+BAA+B;gBAAE,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;iBAC9E,IAAI,MAAM,KAAK,8BAA8B;gBAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;;gBACjF,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qCAAqC,CACpD,UAAoD,EAAE;IAEtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,OAAO,uCAAuC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"standalone-control.js","sourceRoot":"","sources":["../../src/relay/standalone-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACN,yCAAyC,GAEzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GAGxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,+BAA+B,GAAG,6CAA6C,CAAC;AAC7F,MAAM,CAAC,MAAM,8BAA8B,GAAG,4CAA4C,CAAC;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,oDAAoD,CAAC;AAC3G,MAAM,CAAC,MAAM,sCAAsC,GAAG,yCAAyC,CAAC;AAEhG,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACpD,+BAA+B;IAC/B,8BAA8B;IAC9B,sCAAsC;IACtC,sCAAsC;CACtC,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,MAAe;IAKxD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAQD,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAU,CAAC;AAC9E,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAU,CAAC;AACtH,MAAM,sBAAsB,GAAqC;IAChE,CAAC,+BAA+B,CAAC,EAAE,0BAA0B;IAC7D,CAAC,8BAA8B,CAAC,EAAE,yBAAyB;IAC3D,CAAC,sCAAsC,CAAC,EAAE,iCAAiC;IAC3E,CAAC,sCAAsC,CAAC,EAAE,iCAAiC;CAC3E,CAAC;AACF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACtC,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACtH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,4BAA4B;IAEJ;IADZ,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,YAA6B,WAAW,uBAAuB;QAAlC,aAAQ,GAAR,QAAQ,CAA0B;IAAG,CAAC;IACnE,OAAO,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW;QAClD,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;YACnE,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAID,SAAS,gCAAgC,CAAQ,KAOhD;IACA,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QAC/G,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAChI,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC7D,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACtH,IACC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EACzE,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACvC,MAAM,CAAC,GAAG,KAAK,OAAO;QACtB,MAAM,CAAC,GAAG,KAAK,mCAAmC;QAClD,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5B,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,EAChC,CAAC;QACF,wEAAwE;QACxE,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;QACzC,OAAO,CAAC,eAAe,KAAK,CAAC;QAC7B,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,OAAO,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC1D,OAAO,CAAC,GAAG,KAAK,eAAe,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAC9D,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,OAAO,CAAC,GAAG;QACZ,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,CAAC,OAAO,CAAC,KAAK;QACd,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EACtB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,SAAS,CAAC,UAAU,KAAK,EAAE;QAC3B,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,EACvH,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IACC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,gBAAgB;QACxC,GAAG,IAAI,KAAK,CAAC,GAAG;QAChB,GAAG,IAAI,GAAG;QACV,GAAG,GAAG,GAAG,GAAG,EAAE,EACb,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAa,EAAE,CAAC;AACxC,CAAC;AAsBD,SAAS,sBAAsB,CAAC,KAAc;IAC7C,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,YAAY,EAClB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,OAA+B;IAC7E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC;QACJ,yCAAyC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAA+B,CAAC;IACnD,IACC,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW;QAC1D,IAAI,CAAC,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY;QAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ;QACpD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAC7E,CAAC;QACF,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,IAAI,sBAAsB,CAAC,mDAAmD,CAAC,CAAC;IACvF,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IACnD,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,SAAS;QAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,KAAK,CAAC,KAAK,EACX,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sDAAsD,CAAC,CAAC;IAC1F,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc;IACpD,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACvD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAC3B,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uCAAuC,CACtD,MAAgC,EAChC,UAAoD,EAAE;IAEtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAClD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,YAAY,GAAoC,MAAM,CAAC,MAAM,CAAC;QACjE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,yBAAyB,IAAI,CAAC;QACjE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmD,CAAC;IAE7E,KAAK,UAAU,iBAAiB,CAAC,gBAAyB;QACzD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,+BAA+B;YACvC,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC7C,CAAC,QAAQ,EAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EACpG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACF,OAAO,GAAG,OAAO,CAAC;QAClB,OAAO,CAAC,MAAM,EAAE,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,gBAAyB;QACxD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,8BAA8B;YACtC,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC7C,CAAC,QAAQ,EAAwB,EAAE,CAAC,CAAC;YACpC,GAAG,QAAQ;YACX,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,wBAAwB,CAAC,SAAS,CAAC,MAAM,CAAC;YACvD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,EACF,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACF,OAAO,GAAG,OAAO,CAAC;QAClB,OAAO,CAAC,MAAM,EAAE,CAAC,mCAAmC,EAAE;YACrD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,gBAAyB;QAC/D,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,sCAAsC;YAC9C,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3C,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC7C,CAAC,QAAQ,EAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EACtH,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACF,OAAO,GAAG,OAAO,CAAC;QAClB,4BAA4B,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,0DAA0D;QAC1D,OAAO,CAAC,MAAM,EAAE,CAAC,oDAAoD,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvG,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,gBAAyB;QAChE,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,sCAAsC;YAC9C,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAoC,MAAM,CAAC,MAAM,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;YAC/C,iEAAiE;YACjE,OAAO;QACR,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC;gBACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACR,4DAA4D;YAC7D,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;QACnC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;QAC7B,yBAAyB,EAAE,GAAG,EAAE,CAAC,YAAY;QAC7C,qBAAqB,EAAE,CAAC,QAAQ,EAAE,EAAE;YACnC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM;YAC7C,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,IAAI,MAAM,KAAK,+BAA+B;gBAAE,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;iBAC9E,IAAI,MAAM,KAAK,8BAA8B;gBAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;iBACjF,IAAI,MAAM,KAAK,sCAAsC;gBAAE,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;;gBAChG,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qCAAqC,CACpD,UAAoD,EAAE;IAEtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,OAAO,uCAAuC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC"}

package/dist/relay/standalone-identity.d.ts

@@ -15,6 +15,15 @@ export type StandaloneIdentityV2 = Readonly<{
     pairedAt: number;
     /** Unix ms of the most recent secret or trust rotation, if any. */
     rotatedAt?: number;
+    /**
+     * The app's installation-bot credential, delivered over the standalone
+     * control channel and persisted here so it survives a restart. Opaque pair —
+     * never logged. Absent until Hub delivers it.
+     */
+    agentBotCredential?: Readonly<{
+        botUserId: string;
+        token: string;
+    }>;
 }>;
 export type LoadedStandaloneIdentity = Readonly<{
     filePath: string;

package/dist/relay/standalone-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standalone-identity.d.ts","sourceRoot":"","sources":["../../src/relay/standalone-identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEN,KAAK,sBAAsB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,eAAO,MAAM,gCAAgC,sCAAsC,CAAC;AAapF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB,CAAC;IAC9B,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,KAAK,EAAE,QAAQ,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,EAAE,sBAAsB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GACpC,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,uBAAuB,GACvB,8BAA8B,CAAC;AAElC,qBAAa,uBAAwB,SAAQ,KAAK;aAEhC,IAAI,EAAE,2BAA2B;gBAAjC,IAAI,EAAE,2BAA2B,EACjD,OAAO,EAAE,MAAM;CAKhB;AAaD,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD,qGAAqG;AACrG,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAqCnG;AAeD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CAgChG;AAED,uGAAuG;AACvG,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAErF;AAMD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC3C,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,oBAAoB,EAC/D,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}
+{"version":3,"file":"standalone-identity.d.ts","sourceRoot":"","sources":["../../src/relay/standalone-identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEN,KAAK,sBAAsB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,eAAO,MAAM,gCAAgC,sCAAsC,CAAC;AAapF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB,CAAC;IAC9B,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,QAAQ,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,KAAK,EAAE,QAAQ,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,EAAE,sBAAsB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GACpC,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,uBAAuB,GACvB,8BAA8B,CAAC;AAElC,qBAAa,uBAAwB,SAAQ,KAAK;aAEhC,IAAI,EAAE,2BAA2B;gBAAjC,IAAI,EAAE,2BAA2B,EACjD,OAAO,EAAE,MAAM;CAKhB;AAaD,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD,qGAAqG;AACrG,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAkDnG;AAeD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CAgChG;AAED,uGAAuG;AACvG,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAErF;AAMD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC3C,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,oBAAoB,EAC/D,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}

package/dist/relay/standalone-identity.js

@@ -24,7 +24,7 @@ const IDENTITY_REQUIRED_KEYS = [
     'fingerprint',
     'pairedAt',
 ];
-const IDENTITY_OPTIONAL_KEYS = ['mcpAppId', 'rotatedAt'];
+const IDENTITY_OPTIONAL_KEYS = ['mcpAppId', 'rotatedAt', 'agentBotCredential'];
 export class StandaloneIdentityError extends Error {
     code;
     constructor(code, message) {
@@ -69,6 +69,17 @@ export function assertStandaloneIdentityShape(value) {
         (value.rotatedAt !== undefined && !Number.isFinite(value.rotatedAt))) {
         throw new StandaloneIdentityError('IDENTITY_FILE_INVALID', 'Standalone identity file has an invalid field.');
     }
+    if (value.agentBotCredential !== undefined) {
+        const credential = value.agentBotCredential;
+        if (!isRecord(credential) ||
+            Object.keys(credential).sort().join(',') !== 'botUserId,token' ||
+            typeof credential.botUserId !== 'string' ||
+            !credential.botUserId ||
+            typeof credential.token !== 'string' ||
+            !credential.token) {
+            throw new StandaloneIdentityError('IDENTITY_FILE_INVALID', 'Standalone identity agentBotCredential is invalid.');
+        }
+    }
     try {
         new URL(value.relayUrl);
     }

package/dist/relay/standalone-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"standalone-identity.js","sourceRoot":"","sources":["../../src/relay/standalone-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACN,yCAAyC,GAEzC,MAAM,mCAAmC,CAAC;AAE3C,MAAM,CAAC,MAAM,gCAAgC,GAAG,mCAAmC,CAAC;AAEpF,MAAM,sBAAsB,GAAG;IAC9B,gBAAgB;IAChB,UAAU;IACV,UAAU;IACV,cAAc;IACd,OAAO;IACP,aAAa;IACb,UAAU;CACD,CAAC;AACX,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AAkClE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEhC;IADjB,YACiB,IAAiC,EACjD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAA6B;QAIjD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACvC,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,QAA2B;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACtD,OAAO,UAAU,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAiB;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC,CAAC;AAClH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;IACjH,CAAC;IACD,IACC,KAAK,CAAC,cAAc,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,YAAY;QACnB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACpE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;QACF,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,gDAAgD,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACJ,yCAAyC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAChC,uBAAuB,EACvB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAA+B,CAAC;IACpD,IAAI,KAAK,CAAC,WAAW,KAAK,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,oEAAoE,CAAC,CAAC;IAClI,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAkB,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7F,MAAM,IAAI,uBAAuB,CAChC,4BAA4B,EAC5B,4BAA4B,QAAQ,2CAA2C;YAC9E,eAAe,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,KAAK;YACrF,oFAAoF,CACrF,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA+B;IACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAChC,uBAAuB,EACvB,kCAAkC,QAAQ,8EAA8E,CACxH,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,EAAE,2CAA2C,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClL,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,EAAE,4BAA4B,QAAQ,qBAAqB,CAAC,CAAC;IAC3H,CAAC;IACD,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ;QACR,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAClH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;KAC/B,CAAC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,4BAA4B,CAAC,OAA+B;IAC3E,OAAO,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,SAAiB;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,QAA8B,EAC9B,OAA+B;IAE/B,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAChC,8BAA8B,EAC9B,4BAA4B,QAAQ,kGAAkG,CACtI,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAA+D,EAC/D,OAA+B;IAE/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"standalone-identity.js","sourceRoot":"","sources":["../../src/relay/standalone-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACN,yCAAyC,GAEzC,MAAM,mCAAmC,CAAC;AAE3C,MAAM,CAAC,MAAM,gCAAgC,GAAG,mCAAmC,CAAC;AAEpF,MAAM,sBAAsB,GAAG;IAC9B,gBAAgB;IAChB,UAAU;IACV,UAAU;IACV,cAAc;IACd,OAAO;IACP,aAAa;IACb,UAAU;CACD,CAAC;AACX,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,oBAAoB,CAAU,CAAC;AAwCxF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEhC;IADjB,YACiB,IAAiC,EACjD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAA6B;QAIjD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACvC,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,QAA2B;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACtD,OAAO,UAAU,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAiB;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC,CAAC;AAClH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;IACjH,CAAC;IACD,IACC,KAAK,CAAC,cAAc,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,YAAY;QACnB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACpE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;QACF,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,gDAAgD,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;QAC5C,IACC,CAAC,QAAQ,CAAC,UAAU,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iBAAiB;YAC9D,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ;YACxC,CAAC,UAAU,CAAC,SAAS;YACrB,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YACpC,CAAC,UAAU,CAAC,KAAK,EAChB,CAAC;YACF,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,oDAAoD,CAAC,CAAC;QAClH,CAAC;IACF,CAAC;IACD,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACJ,yCAAyC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAChC,uBAAuB,EACvB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAA+B,CAAC;IACpD,IAAI,KAAK,CAAC,WAAW,KAAK,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,oEAAoE,CAAC,CAAC;IAClI,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAkB,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7F,MAAM,IAAI,uBAAuB,CAChC,4BAA4B,EAC5B,4BAA4B,QAAQ,2CAA2C;YAC9E,eAAe,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,KAAK;YACrF,oFAAoF,CACrF,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA+B;IACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAChC,uBAAuB,EACvB,kCAAkC,QAAQ,8EAA8E,CACxH,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,EAAE,2CAA2C,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClL,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,EAAE,4BAA4B,QAAQ,qBAAqB,CAAC,CAAC;IAC3H,CAAC;IACD,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ;QACR,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAClH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;KAC/B,CAAC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,4BAA4B,CAAC,OAA+B;IAC3E,OAAO,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,SAAiB;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,QAA8B,EAC9B,OAA+B;IAE/B,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAChC,8BAA8B,EAC9B,4BAA4B,QAAQ,kGAAkG,CACtI,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAA+D,EAC/D,OAA+B;IAE/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC7C,CAAC"}

package/dist/runtime-mode.d.ts

@@ -5,7 +5,7 @@ export type RuntimeModeResolution = Readonly<{
     workloadSocketPath: string;
     standaloneIdentityFilePath: string;
 }>;
-export type RuntimeModeErrorCode = 'AMBIGUOUS_RUNTIME_IDENTITY' | 'PRODUCTION_WITHOUT_IDENTITY';
+export type RuntimeModeErrorCode = 'AMBIGUOUS_RUNTIME_IDENTITY' | 'PRODUCTION_WITHOUT_IDENTITY' | 'TRANSPORT_OVERRIDE_NOT_ALLOWED';
 export declare class RuntimeModeError extends Error {
     readonly code: RuntimeModeErrorCode;
     constructor(code: RuntimeModeErrorCode, message: string);

package/dist/runtime-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-mode.d.ts","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAE9E,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0BAA0B,EAAE,MAAM,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,4BAA4B,GAAG,6BAA6B,CAAC;AAEhG,qBAAa,gBAAiB,SAAQ,KAAK;aAEzB,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EAC1C,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD,CAAC,CAAC;AAEH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,qBAAqB,CAuDjG"}
+{"version":3,"file":"runtime-mode.d.ts","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAE9E,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0BAA0B,EAAE,MAAM,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAC7B,4BAA4B,GAC5B,6BAA6B,GAC7B,gCAAgC,CAAC;AAEpC,qBAAa,gBAAiB,SAAQ,KAAK;aAEzB,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EAC1C,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD,CAAC,CAAC;AAEH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,qBAAqB,CAuDjG"}

package/dist/runtime-mode.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-mode.js","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAahH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEzB;IADjB,YACiB,IAA0B,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAsB;QAI1C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAcD,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC;IAC/G,MAAM,0BAA0B,GAC/B,OAAO,CAAC,0BAA0B,IAAI,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC;IAC/G,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,wBAAwB,GAC7B,OAAO,CAAC,wBAAwB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1G,MAAM,cAAc,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;IAE/E,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,gBAAgB,CACzB,4BAA4B,EAC5B,4CAA4C,kBAAkB,mCAAmC;YAChG,IAAI,0BAA0B,mEAAmE;YACjG,8GAA8G,CAC/G,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,uCAAuC,kBAAkB,EAAE;YACnE,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,uCAAuC,0BAA0B,EAAE;YAC3E,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CACzB,6BAA6B,EAC7B,yEAAyE;YACxE,IAAI,kBAAkB,2CAA2C,0BAA0B,KAAK;YAChG,gGAAgG;YAChG,0EAA0E,CAC3E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,gGAAgG;QACxG,kBAAkB;QAClB,0BAA0B;KAC1B,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runtime-mode.js","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAgBhH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEzB;IADjB,YACiB,IAA0B,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAsB;QAI1C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAcD,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC;IAC/G,MAAM,0BAA0B,GAC/B,OAAO,CAAC,0BAA0B,IAAI,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC;IAC/G,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,wBAAwB,GAC7B,OAAO,CAAC,wBAAwB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1G,MAAM,cAAc,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;IAE/E,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,gBAAgB,CACzB,4BAA4B,EAC5B,4CAA4C,kBAAkB,mCAAmC;YAChG,IAAI,0BAA0B,mEAAmE;YACjG,8GAA8G,CAC/G,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,uCAAuC,kBAAkB,EAAE;YACnE,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,uCAAuC,0BAA0B,EAAE;YAC3E,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CACzB,6BAA6B,EAC7B,yEAAyE;YACxE,IAAI,kBAAkB,2CAA2C,0BAA0B,KAAK;YAChG,gGAAgG;YAChG,0EAA0E,CAC3E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,gGAAgG;QACxG,kBAAkB;QAClB,0BAA0B;KAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/serve-app.d.ts

@@ -0,0 +1,81 @@
+import type { Server } from 'node:http';
+import { type Express } from 'express';
+import type { AppDescriptor } from './app-descriptor.js';
+import { type ReadinessCheckResult } from './direct/http-ingress.js';
+import { type RoomBoundHubClient } from './relay/hub-rest-as-bot-client.js';
+import { connectRelay, type RelayHandle } from './relay/relay-client.js';
+import { createStandaloneRelayIdentityController } from './relay/standalone-control.js';
+import { loadStandaloneIdentity } from './relay/standalone-identity.js';
+import { resolveRuntimeMode, type RuntimeMode } from './runtime-mode.js';
+import type { AppMcpHandler, UiResourceProvider } from './runtime.js';
+import { getWorkloadIdentityClient, type WorkloadIdentityClient } from './workload/workload-identity.js';
+/** Fallback listen port when no explicit `port`, `HTTP_PORT`, or `PORT` is set. */
+export declare const DEFAULT_SERVE_APP_PORT = 8080;
+/** Dev-only transport selector — the API form of the demo's `PRIVOS_TRANSPORT`. */
+export type ServeAppTransportOverride = 'http' | 'relay';
+/**
+ * Everything an app's handler factory needs, resolved for the active mode. The
+ * app builds its `McpHandler` from this and never touches transport internals.
+ */
+export interface ServeAppHandlerContext {
+    mode: RuntimeMode;
+    /**
+     * Hub REST transport authenticating as this app's own installation bot,
+     * wired to the correct Hub-origin source for the mode. Same
+     * `RoomBoundHubClient` shape in every mode.
+     */
+    agentBotHub: RoomBoundHubClient;
+    /**
+     * The managed workload identity SINGLETON — present only in `managed` mode.
+     * Managed-ingress room authority is WeakMap-keyed by this exact instance, so
+     * the handler MUST use this one (never construct a fresh `WorkloadIdentityClient`).
+     */
+    workloadIdentityClient?: WorkloadIdentityClient;
+    /** Resolve the Hub's own origin (managed: broker; standalone: paired file; dev: `PRIVOS_URL`). */
+    resolveHubOrigin(): Promise<string | undefined>;
+}
+export interface ServeAppOptions {
+    descriptor: AppDescriptor | (() => AppDescriptor | Promise<AppDescriptor>);
+    ui?: UiResourceProvider;
+    /** Build the app's MCP handler from the resolved runtime context. */
+    createHandler: (context: ServeAppHandlerContext) => AppMcpHandler | Promise<AppMcpHandler>;
+    /** Explicit listen port. Precedence: explicit > `HTTP_PORT` > `PORT` > {@link DEFAULT_SERVE_APP_PORT}. */
+    port?: number;
+    /** Explicit bind host. Default `0.0.0.0`, except `development` which defaults to loopback `127.0.0.1`. */
+    host?: string;
+    /** DEVELOPMENT-ONLY. Any value under managed or standalone-production is a boot error. */
+    transportOverride?: ServeAppTransportOverride;
+    /** Standalone `/ready` manifest input. Default: parse `${cwd}/privos-app.json` fresh each check. */
+    resolveManifest?: () => unknown | Promise<unknown>;
+    /**
+     * Express escape hatch — mount app-owned routes (/public, /ui, diagnostics)
+     * BEFORE the MCP router, so the router's CORS middleware (ACAO:* + OPTIONS
+     * short-circuit) never stamps or swallows them.
+     */
+    configure?: (app: Express) => void | Promise<void>;
+    /** Own SIGTERM/SIGINT (stop relay + close server). Default true. */
+    installSignalHandlers?: boolean;
+    logger?: (event: string, fields: Record<string, unknown>) => void;
+    /** Test-only seams; never set in production. */
+    __test?: ServeAppTestSeams;
+}
+/** Internal seams so unit tests can inject mode, workload posture, and relay without real sockets. */
+export interface ServeAppTestSeams {
+    env?: NodeJS.ProcessEnv;
+    resolveRuntimeMode?: typeof resolveRuntimeMode;
+    getWorkloadIdentityClient?: typeof getWorkloadIdentityClient;
+    loadStandaloneIdentity?: typeof loadStandaloneIdentity;
+    createStandaloneRelayIdentityController?: typeof createStandaloneRelayIdentityController;
+    connectRelay?: typeof connectRelay;
+}
+export interface ServeAppHandle {
+    mode: RuntimeMode;
+    server: Server;
+    /** Present only in standalone-production (MCP rides Relay). */
+    relayHandle?: RelayHandle;
+    /** The active `/ready` check for the resolved mode. */
+    readiness(): Promise<ReadinessCheckResult>;
+    close(): Promise<void>;
+}
+export declare function serveApp(options: ServeAppOptions): Promise<ServeAppHandle>;
+//# sourceMappingURL=serve-app.d.ts.map

package/dist/serve-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-app.d.ts","sourceRoot":"","sources":["../src/serve-app.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAEhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAA4B,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAIN,KAAK,kBAAkB,EACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACN,uCAAuC,EAEvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,sBAAsB,EAEtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAoB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EACN,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,MAAM,iCAAiC,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,mFAAmF;AACnF,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,CAAC;IAChC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC/B,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,qEAAqE;IACrE,aAAa,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3F,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,oGAAoG;IACpG,eAAe,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAClE,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,sGAAsG;AACtG,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,yBAAyB,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAC7D,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,uCAAuC,CAAC,EAAE,OAAO,uCAAuC,CAAC;IACzF,YAAY,CAAC,EAAE,OAAO,YAAY,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,uDAAuD;IACvD,SAAS,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAoBD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAyLhF"}

package/dist/serve-app.js

@@ -0,0 +1,277 @@
+/**
+ * `serveApp` — the single entrypoint that hides transport + trust bootstrap
+ * across all three runtime modes. A developer writes ONE app, declares its
+ * descriptor/ui/handler, and calls `serveApp(...)`; the SDK resolves the mode
+ * (`resolveRuntimeMode`) and wires the right transport, the workload/agent-bot
+ * hub client, and the readiness/health surface internally. App code never
+ * imports `connectRelay`, `loadStandaloneIdentity`, the identity controller,
+ * readiness checks, or the workload broker directly.
+ *
+ * What stays VISIBLE by design (hide plumbing, not trust): serveApp NEVER
+ * creates or rotates an identity file and NEVER invokes pairing on a missing
+ * one — it surfaces `StandaloneIdentityError` / `RuntimeModeError` verbatim.
+ * The pairing fingerprint/TOFU ceremony lives in `pairOverWebSocket` and the
+ * app's own pair scripts, and stays there.
+ *
+ * Mode matrix:
+ *  - managed: the `getWorkloadIdentityClient()` SINGLETON + agent-bot hub from
+ *    the workload broker + a Direct HTTP `createDirectRouter` with
+ *    `workloadSecurity: 'required'` HARD-CODED (never 'auto': 'auto' accepts
+ *    unsigned traffic whenever the socket is absent, including a managed
+ *    container whose socket vanishes mid-life).
+ *  - development: no workload client; the Direct HTTP router accepts unsigned
+ *    traffic, so it binds loopback (127.0.0.1) by default — exposing it on
+ *    0.0.0.0 requires an explicit `host`. `transportOverride: 'relay'` steps
+ *    aside for an app-owned dev relay loop (the interactive pairing prompt is
+ *    app-local by design), serving only health/ready/ui/configure over HTTP.
+ *  - standalone-production: `loadStandaloneIdentity` (fatal if missing/invalid)
+ *    + the standalone identity controller + agent-bot hub from the paired Hub
+ *    origin + `connectRelay` (MCP rides the Relay WebSocket, not HTTP) + the
+ *    SDK readiness check. Any persisted agent-bot credential is adopted at boot.
+ *
+ * `/health` and `/ready` exist in ALL modes (marketplace Docker HEALTHCHECK and
+ * the cluster monitor probe them). Ambiguous identity or production-without-
+ * identity fails closed via `RuntimeModeError`, unchanged.
+ */
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import express from 'express';
+import { createDirectRouter } from './direct/express-router.js';
+import { resolveHttpIngressListen } from './direct/http-ingress.js';
+import { setAdoptedAgentBotCredential } from './relay/agent-bot-credential.js';
+import { createAgentBotHubClient, createAgentBotHubClientFromHubOrigin, createAgentBotHubClientFromWorkloadIdentity, } from './relay/hub-rest-as-bot-client.js';
+import { connectRelay } from './relay/relay-client.js';
+import { createStandaloneRelayIdentityController, } from './relay/standalone-control.js';
+import { loadStandaloneIdentity, } from './relay/standalone-identity.js';
+import { createStandaloneReadinessCheck } from './relay/standalone-readiness.js';
+import { resolveRuntimeMode, RuntimeModeError } from './runtime-mode.js';
+import { getWorkloadIdentityClient, } from './workload/workload-identity.js';
+/** Fallback listen port when no explicit `port`, `HTTP_PORT`, or `PORT` is set. */
+export const DEFAULT_SERVE_APP_PORT = 8080;
+function defaultLogger(event, fields) {
+    if (event.includes('error') || event.includes('fail') || event.includes('rejected')) {
+        console.error(`[serveApp] ✗ ${event}`, fields);
+    }
+    else {
+        console.log(`[serveApp] · ${event}`);
+    }
+}
+/** Dev-only Hub origin: the legacy relay `PRIVOS_URL`, the only Hub address available outside a paired/managed runtime. */
+function developmentHubOrigin(env) {
+    const url = env.PRIVOS_URL;
+    return url && /^https?:\/\//.test(url) ? url.replace(/\/+$/, '') : undefined;
+}
+function defaultManifestResolver() {
+    return JSON.parse(readFileSync(path.resolve(process.cwd(), 'privos-app.json'), 'utf8'));
+}
+export async function serveApp(options) {
+    const env = options.__test?.env ?? process.env;
+    const logger = options.logger ?? defaultLogger;
+    const resolveMode = options.__test?.resolveRuntimeMode ?? resolveRuntimeMode;
+    // Fail closed on ambiguous / production-without-identity, exactly as before.
+    const resolution = resolveMode({ env });
+    const mode = resolution.mode;
+    logger('serveApp.mode_resolved', { mode, reason: resolution.reason });
+    if (options.transportOverride !== undefined && mode !== 'development') {
+        // H1: transportOverride is the API form of PRIVOS_TRANSPORT and is a
+        // development affordance only. Accepting it under a production mode would
+        // let it override the mode's fixed, trusted transport — a boot error.
+        throw new RuntimeModeError('TRANSPORT_OVERRIDE_NOT_ALLOWED', `transportOverride is development-only; runtime mode is '${mode}'. Remove transportOverride, ` +
+            'or run without the managed workload socket / standalone identity file for local development.');
+    }
+    // Per-mode wiring, all resolved BEFORE the handler is built so the handler
+    // context is complete when createHandler runs.
+    let workloadIdentityClient;
+    let agentBotHub;
+    let resolveHubOrigin;
+    let loaded;
+    let identityController;
+    let mountDirectRouter = false;
+    if (mode === 'managed') {
+        const getClient = options.__test?.getWorkloadIdentityClient ?? getWorkloadIdentityClient;
+        workloadIdentityClient = getClient();
+        resolveHubOrigin = async () => {
+            try {
+                return (await workloadIdentityClient.brokerContext()).hubOrigin;
+            }
+            catch {
+                return undefined;
+            }
+        };
+        agentBotHub = createAgentBotHubClientFromWorkloadIdentity(workloadIdentityClient);
+        mountDirectRouter = true;
+    }
+    else if (mode === 'standalone-production') {
+        const load = options.__test?.loadStandaloneIdentity ?? loadStandaloneIdentity;
+        loaded = load();
+        // Boot-seed a persisted agent-bot credential so a delivered credential
+        // survives restart and is usable before any live control-channel push.
+        if (loaded.identity.agentBotCredential)
+            setAdoptedAgentBotCredential(loaded.identity.agentBotCredential);
+        const makeController = options.__test?.createStandaloneRelayIdentityController ?? createStandaloneRelayIdentityController;
+        identityController = makeController(loaded, {
+            logger: (event, fields) => logger(event, fields),
+        });
+        resolveHubOrigin = async () => loaded.relay.privosUrl;
+        agentBotHub = createAgentBotHubClientFromHubOrigin(loaded.relay.privosUrl);
+        mountDirectRouter = false; // MCP rides Relay, not HTTP.
+    }
+    else {
+        resolveHubOrigin = async () => developmentHubOrigin(env);
+        agentBotHub = createAgentBotHubClient({ resolveHubOrigin });
+        // Default dev transport is Direct HTTP; 'relay' steps aside for an
+        // app-owned dev relay loop and serves only the HTTP support surface.
+        mountDirectRouter = options.transportOverride !== 'relay';
+    }
+    const handler = await options.createHandler({
+        mode,
+        agentBotHub,
+        workloadIdentityClient,
+        resolveHubOrigin,
+    });
+    // A ref-cell for the relay handle so the readiness closure can observe a
+    // connection that is opened AFTER the HTTP server begins listening (M5).
+    const relayRef = {};
+    const readiness = buildReadiness({
+        mode,
+        workloadIdentityClient,
+        relayRef,
+        resolveManifest: options.resolveManifest ?? defaultManifestResolver,
+    });
+    // Mount order: health/ready → configure → router. The router's CORS
+    // middleware stamps ACAO:* and short-circuits OPTIONS on everything mounted
+    // after it, so app-owned configure routes MUST come first.
+    const app = express();
+    app.get('/health', (_req, res) => {
+        res.status(200).json({ ok: true, status: 'alive', mode });
+    });
+    app.get('/ready', async (_req, res, next) => {
+        try {
+            const result = await readiness();
+            const status = result.ok ? 200 : (result.status ?? 503);
+            res.status(status).json({ ok: result.ok, status: result.ok ? 'ready' : 'not_ready', ...(result.body ?? {}) });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    if (options.configure)
+        await options.configure(app);
+    if (mountDirectRouter) {
+        app.use(createDirectRouter({
+            descriptor: options.descriptor,
+            handler,
+            ui: options.ui,
+            // H2: managed hard-codes 'required' (never accept unsigned traffic).
+            // Development leaves the default 'auto', which with no workload
+            // socket accepts unsigned — safe only because dev binds loopback.
+            ...(mode === 'managed' ? { workloadSecurity: 'required', workloadIdentityClient } : {}),
+        }));
+    }
+    const listen = resolveHttpIngressListen({ env, defaultPort: DEFAULT_SERVE_APP_PORT });
+    // serveApp ALWAYS serves the HTTP support surface (/health + /ready in every
+    // mode), so HTTP_INGRESS=off is not honored here: never fall through to
+    // resolveHttpIngressListen's disabled port 0 (which would bind a random port).
+    const port = options.port ?? (listen.enabled ? listen.port : DEFAULT_SERVE_APP_PORT);
+    // H2: unsigned dev traffic must not leak off-host; loopback unless opted out.
+    const host = options.host ?? (mode === 'development' ? '127.0.0.1' : '0.0.0.0');
+    // Listen BEFORE any async identity bootstrap (M5): the cluster's
+    // waitForHealthy is a 30s window and must see the port up promptly.
+    const server = await new Promise((resolve, reject) => {
+        const created = app.listen(port, host, () => {
+            logger('serveApp.listening', { mode, host, port, mountDirectRouter });
+            resolve(created);
+        });
+        created.on('error', reject);
+    });
+    // Standalone connects the Relay AFTER the HTTP surface is live. connectRelay
+    // is non-blocking (returns a handle, connects in the background).
+    if (mode === 'standalone-production') {
+        const doConnect = options.__test?.connectRelay ?? connectRelay;
+        relayRef.current = doConnect({
+            privosUrl: loaded.relay.privosUrl,
+            standaloneIdentity: identityController,
+            descriptor: options.descriptor,
+            handler,
+            ui: options.ui,
+            logger: (event, fields) => logger(event, fields),
+        });
+    }
+    // Managed: warm the workload attestation in the background (the post-listen
+    // bootstrap the SDK's startHttpIngress does) and keep it fresh, so /ready
+    // reads a converged LAST-KNOWN-GOOD cache instead of forcing a synchronous
+    // broker token mint on every probe. dispose() stops the monitor.
+    if (mode === 'managed' && workloadIdentityClient) {
+        void workloadIdentityClient.getEffectiveCapabilities({ forceRefresh: true }).catch(() => undefined);
+        workloadIdentityClient.startCapabilityMonitor(30_000);
+    }
+    let signalHandlers = [];
+    const handle = {
+        mode,
+        server,
+        relayHandle: relayRef.current,
+        readiness,
+        async close() {
+            for (const { signal, handler: fn } of signalHandlers)
+                process.removeListener(signal, fn);
+            signalHandlers = [];
+            if (relayRef.current)
+                await relayRef.current.stop();
+            await new Promise((resolve, reject) => {
+                server.close((error) => (error ? reject(error) : resolve()));
+            });
+            workloadIdentityClient?.dispose();
+        },
+    };
+    if (options.installSignalHandlers ?? true) {
+        for (const signal of ['SIGTERM', 'SIGINT']) {
+            const fn = () => {
+                logger('serveApp.shutdown', { signal });
+                handle.close().catch((error) => {
+                    logger('serveApp.shutdown_failed', { error: String(error) });
+                    process.exitCode = 1;
+                });
+            };
+            process.once(signal, fn);
+            signalHandlers.push({ signal, handler: fn });
+        }
+    }
+    return handle;
+}
+function buildReadiness(input) {
+    if (input.mode === 'managed') {
+        const client = input.workloadIdentityClient;
+        // Read the LAST-KNOWN-GOOD attestation (no broker round-trip). The Docker
+        // HEALTHCHECK probes /ready every 30s with a 3s timeout, so it must not
+        // force a synchronous token mint that a transient broker latency spike
+        // could push past the timeout and flap the container. Freshness comes from
+        // the background capability monitor `serveApp` starts after listen.
+        return async () => {
+            const caps = client.peekEffectiveCapabilities();
+            const ok = caps.status === 'paired' || caps.status === 'active';
+            return {
+                ok,
+                status: ok ? 200 : 503,
+                body: {
+                    mode: 'managed',
+                    workload: caps.status,
+                    scopes: caps.scopes.length,
+                    ...(caps.reason ? { reason: caps.reason } : {}),
+                },
+            };
+        };
+    }
+    if (input.mode === 'standalone-production') {
+        const check = createStandaloneReadinessCheck({
+            isRelayAuthenticated: () => input.relayRef.current?.isConnected() ?? false,
+            resolveManifest: input.resolveManifest,
+        });
+        return async () => {
+            const result = await check();
+            return { ok: result.ok, status: result.status, body: result.body };
+        };
+    }
+    // development: trivial 200 — no trust to attest, unsigned local surface.
+    return async () => ({ ok: true, status: 200, body: { mode: 'development' } });
+}
+//# sourceMappingURL=serve-app.js.map

package/dist/serve-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-app.js","sourceRoot":"","sources":["../src/serve-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,OAAyB,MAAM,SAAS,CAAC;AAGhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAA6B,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACN,uBAAuB,EACvB,oCAAoC,EACpC,2CAA2C,GAE3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACN,uCAAuC,GAEvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,sBAAsB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EACN,yBAAyB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAyE3C,SAAS,aAAa,CAAC,KAAa,EAAE,MAA+B;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;AACF,CAAC;AAED,2HAA2H;AAC3H,SAAS,oBAAoB,CAAC,GAAsB;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;IAC3B,OAAO,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,uBAAuB;IAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,kBAAkB,IAAI,kBAAkB,CAAC;IAE7E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,IAAI,gBAAgB,CACzB,gCAAgC,EAChC,2DAA2D,IAAI,+BAA+B;YAC7F,8FAA8F,CAC/F,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,sBAA0D,CAAC;IAC/D,IAAI,WAA+B,CAAC;IACpC,IAAI,gBAAmD,CAAC;IACxD,IAAI,MAA4C,CAAC;IACjD,IAAI,kBAAiE,CAAC;IACtE,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,yBAAyB,IAAI,yBAAyB,CAAC;QACzF,sBAAsB,GAAG,SAAS,EAAE,CAAC;QACrC,gBAAgB,GAAG,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC;gBACJ,OAAO,CAAC,MAAM,sBAAuB,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC,CAAC;QACF,WAAW,GAAG,2CAA2C,CAAC,sBAAsB,CAAC,CAAC;QAClF,iBAAiB,GAAG,IAAI,CAAC;IAC1B,CAAC;SAAM,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,sBAAsB,IAAI,sBAAsB,CAAC;QAC9E,MAAM,GAAG,IAAI,EAAE,CAAC;QAChB,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB;YAAE,4BAA4B,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACzG,MAAM,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,uCAAuC,IAAI,uCAAuC,CAAC;QACpG,kBAAkB,GAAG,cAAc,CAAC,MAAM,EAAE;YAC3C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;SAChD,CAAC,CAAC;QACH,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,MAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACvD,WAAW,GAAG,oCAAoC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3E,iBAAiB,GAAG,KAAK,CAAC,CAAC,6BAA6B;IACzD,CAAC;SAAM,CAAC;QACP,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzD,WAAW,GAAG,uBAAuB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5D,mEAAmE;QACnE,qEAAqE;QACrE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI;QACJ,WAAW;QACX,sBAAsB;QACtB,gBAAgB;KAChB,CAAC,CAAC;IAEH,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC;QAChC,IAAI;QACJ,sBAAsB;QACtB,QAAQ;QACR,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,uBAAuB;KACnE,CAAC,CAAC;IAEH,oEAAoE;IACpE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,CAAC;QACb,CAAC;IACF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,SAAS;QAAE,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,iBAAiB,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CACN,kBAAkB,CAAC;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,qEAAqE;YACrE,gEAAgE;YAChE,kEAAkE;YAClE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAmB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtF,6EAA6E;IAC7E,wEAAwE;IACxE,+EAA+E;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACrF,8EAA8E;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEhF,iEAAiE;IACjE,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,YAAY,CAAC;QAC/D,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC;YAC5B,SAAS,EAAE,MAAO,CAAC,KAAK,CAAC,SAAS;YAClC,kBAAkB,EAAE,kBAAkB;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;SAChD,CAAC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,IAAI,KAAK,SAAS,IAAI,sBAAsB,EAAE,CAAC;QAClD,KAAK,sBAAsB,CAAC,wBAAwB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpG,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,cAAc,GAAsD,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAmB;QAC9B,IAAI;QACJ,MAAM;QACN,WAAW,EAAE,QAAQ,CAAC,OAAO;QAC7B,SAAS;QACT,KAAK,CAAC,KAAK;YACV,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,cAAc;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzF,cAAc,GAAG,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,OAAO;gBAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,sBAAsB,EAAE,OAAO,EAAE,CAAC;QACnC,CAAC;KACD,CAAC;IAEF,IAAI,OAAO,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,GAAG,EAAE;gBACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC9B,MAAM,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC7D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACtB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAKvB;IACA,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAuB,CAAC;QAC7C,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;YAChD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;YAChE,OAAO;gBACN,EAAE;gBACF,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBACtB,IAAI,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI,CAAC,MAAM;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;oBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/C;aACD,CAAC;QACH,CAAC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,8BAA8B,CAAC;YAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,KAAK;YAC1E,eAAe,EAAE,KAAK,CAAC,eAAe;SACtC,CAAC,CAAC;QACH,OAAO,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privos_ai/app-server",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Business-agnostic PrivOS MCP App server runtime — Direct HTTP + Relay WebSocket",
   "type": "module",
   "main": "./dist/index.js",