@qduc/term2 0.14.0 → 0.16.0

package/dist/gateway/persistence/storage.js

@@ -0,0 +1,87 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { GatewayPersistenceError } from './contracts.js';
+const OPAQUE_ID = /^[A-Za-z0-9_-]{1,256}$/;
+export function assertOpaqueStorageId(value, field = 'id') {
+    if (!OPAQUE_ID.test(value) || value === '.' || value === '..') {
+        throw new GatewayPersistenceError('unsafe_root', `invalid opaque ${field}`);
+    }
+}
+/** Hashes IDs before they become path components; the original ID is never a path. */
+export function storageHash(value) {
+    return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function assertDirectoryNotSymlink(directory) {
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new GatewayPersistenceError('unsafe_root', 'gateway data root must be a real directory');
+    }
+}
+function ensurePrivateDirectory(directory) {
+    if (!fs.existsSync(directory))
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    assertDirectoryNotSymlink(directory);
+    try {
+        fs.chmodSync(directory, 0o700);
+    }
+    catch {
+        throw new GatewayPersistenceError('unsafe_root', 'gateway data root permissions could not be restricted');
+    }
+}
+export function createGatewayStorageLayout(dataRoot) {
+    if (!path.isAbsolute(dataRoot) || dataRoot.includes('\u0000')) {
+        throw new GatewayPersistenceError('unsafe_root', 'gateway data root must be an absolute path');
+    }
+    try {
+        ensurePrivateDirectory(dataRoot);
+        const root = fs.realpathSync(dataRoot);
+        if (root !== dataRoot)
+            throw new Error('root is not canonical');
+        const sessionsPath = path.join(root, 'sessions');
+        ensurePrivateDirectory(sessionsPath);
+        const layout = {
+            root,
+            indexPath: path.join(root, 'index.sqlite'),
+            sessionsPath,
+            sessionPath(ownerUserId, workspaceId, sessionId) {
+                assertOpaqueStorageId(ownerUserId, 'owner');
+                assertOpaqueStorageId(workspaceId, 'workspace');
+                assertOpaqueStorageId(sessionId, 'session');
+                const ownerPath = path.join(sessionsPath, storageHash(ownerUserId));
+                const workspacePath = path.join(ownerPath, storageHash(workspaceId));
+                const sessionPath = path.join(workspacePath, storageHash(sessionId));
+                ensurePrivateDirectory(ownerPath);
+                ensurePrivateDirectory(workspacePath);
+                ensurePrivateDirectory(sessionPath);
+                return sessionPath;
+            },
+            existingSessionPath(ownerUserId, workspaceId, sessionId) {
+                assertOpaqueStorageId(ownerUserId, 'owner');
+                assertOpaqueStorageId(workspaceId, 'workspace');
+                assertOpaqueStorageId(sessionId, 'session');
+                const sessionPath = path.join(sessionsPath, storageHash(ownerUserId), storageHash(workspaceId), storageHash(sessionId));
+                if (!fs.existsSync(sessionPath))
+                    return null;
+                assertDirectoryNotSymlink(sessionPath);
+                return sessionPath;
+            },
+        };
+        return Object.freeze(layout);
+    }
+    catch (error) {
+        if (error instanceof GatewayPersistenceError)
+            throw error;
+        throw new GatewayPersistenceError('unsafe_root', 'gateway data root is unreadable or unsafe');
+    }
+}
+export function fsyncDirectory(directory) {
+    const fd = fs.openSync(directory, 'r');
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/gateway/persistence/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../source/gateway/persistence/storage.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAE3C,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAK,GAAG,IAAI;IAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,uBAAuB,CAAC,aAAa,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAUD,SAAS,yBAAyB,CAAC,SAAiB;IAClD,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,uBAAuB,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,uBAAuB,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC;QACH,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,MAAM,GAAyB;YACnC,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;YAC1C,YAAY;YACZ,WAAW,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS;gBAC7C,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC5C,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAChD,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;gBACpE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrE,sBAAsB,CAAC,SAAS,CAAC,CAAC;gBAClC,sBAAsB,CAAC,aAAa,CAAC,CAAC;gBACtC,sBAAsB,CAAC,WAAW,CAAC,CAAC;gBACpC,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS;gBACrD,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC5C,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAChD,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,YAAY,EACZ,WAAW,CAAC,WAAW,CAAC,EACxB,WAAW,CAAC,WAAW,CAAC,EACxB,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;gBACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC7C,yBAAyB,CAAC,WAAW,CAAC,CAAC;gBACvC,OAAO,WAAW,CAAC;YACrB,CAAC;SACF,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,aAAa,EAAE,2CAA2C,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/gateway/replay-ledger.d.ts

@@ -0,0 +1,30 @@
+export type ReplayKey = {
+    iss: string;
+    jti: string;
+    purpose: string;
+    sub: string;
+    sessionId?: string;
+    exp: number;
+};
+export interface ReplayLedger {
+    /** Atomically records a key, returning false when it was already recorded. */
+    record(key: ReplayKey, nowSeconds?: number): boolean;
+    purge(nowSeconds?: number): void;
+    close(): void;
+}
+/** Durable replay authority. The database, not the process cache, is authoritative. */
+export declare class SqliteReplayLedger implements ReplayLedger {
+    #private;
+    constructor(filename: string);
+    record(key: ReplayKey, nowSeconds?: number): boolean;
+    purge(nowSeconds?: number): void;
+    close(): void;
+}
+/** Small deterministic ledger useful for unit tests and embedded callers. */
+export declare class MemoryReplayLedger implements ReplayLedger {
+    #private;
+    record(key: ReplayKey, nowSeconds?: number): boolean;
+    purge(nowSeconds?: number): void;
+    close(): void;
+}
+//# sourceMappingURL=replay-ledger.d.ts.map

package/dist/gateway/replay-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-ledger.d.ts","sourceRoot":"","sources":["../../source/gateway/replay-ledger.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,uFAAuF;AACvF,qBAAa,kBAAmB,YAAW,YAAY;;IAKrD,YAAY,QAAQ,EAAE,MAAM,EAmC3B;IAED,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,SAAgC,GAAG,OAAO,CAS1E;IAED,KAAK,CAAC,UAAU,SAAgC,GAAG,IAAI,CAEtD;IAED,KAAK,IAAI,IAAI,CAEZ;CACF;AAED,6EAA6E;AAC7E,qBAAa,kBAAmB,YAAW,YAAY;;IAGrD,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,SAAgC,GAAG,OAAO,CAM1E;IAED,KAAK,CAAC,UAAU,SAAgC,GAAG,IAAI,CAEtD;IAED,KAAK,IAAI,IAAI,CAEZ;CACF"}

package/dist/gateway/replay-ledger.js

@@ -0,0 +1,83 @@
+import { DatabaseSync } from 'node:sqlite';
+/** Durable replay authority. The database, not the process cache, is authoritative. */
+export class SqliteReplayLedger {
+    #db;
+    #insert;
+    #purge;
+    constructor(filename) {
+        this.#db = new DatabaseSync(filename);
+        this.#db.exec(`
+      PRAGMA journal_mode = WAL;
+      CREATE TABLE IF NOT EXISTS gateway_assertion_replay_v2 (
+        iss TEXT NOT NULL,
+        jti TEXT NOT NULL,
+        purpose TEXT NOT NULL,
+        sub TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        exp INTEGER NOT NULL,
+        recorded_at INTEGER NOT NULL,
+        PRIMARY KEY (iss, jti)
+      );
+      CREATE INDEX IF NOT EXISTS gateway_assertion_replay_v2_exp
+        ON gateway_assertion_replay_v2(exp);
+    `);
+        // Import rows from the pre-correction table when upgrading an existing
+        // daemon. The v2 table is the sole authority and collapses duplicate jtis.
+        try {
+            this.#db.exec(`
+        INSERT OR IGNORE INTO gateway_assertion_replay_v2
+          (iss, jti, purpose, sub, session_id, exp, recorded_at)
+        SELECT iss, jti, purpose, sub, session_id, exp, recorded_at
+        FROM gateway_assertion_replay
+      `);
+        }
+        catch {
+            // Fresh databases do not have the pre-correction table.
+        }
+        this.#insert = this.#db.prepare(`
+      INSERT INTO gateway_assertion_replay_v2
+        (iss, jti, purpose, sub, session_id, exp, recorded_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+        this.#purge = this.#db.prepare('DELETE FROM gateway_assertion_replay_v2 WHERE exp < ?');
+    }
+    record(key, nowSeconds = Math.floor(Date.now() / 1000)) {
+        this.purge(nowSeconds);
+        try {
+            this.#insert.run(key.iss, key.jti, key.purpose, key.sub, key.sessionId ?? '', key.exp, nowSeconds);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof Error && /constraint|unique/i.test(error.message))
+                return false;
+            throw error;
+        }
+    }
+    purge(nowSeconds = Math.floor(Date.now() / 1000)) {
+        this.#purge.run(nowSeconds);
+    }
+    close() {
+        this.#db.close();
+    }
+}
+/** Small deterministic ledger useful for unit tests and embedded callers. */
+export class MemoryReplayLedger {
+    #entries = new Map();
+    record(key, nowSeconds = Math.floor(Date.now() / 1000)) {
+        this.purge(nowSeconds);
+        const composite = [key.iss, key.jti].join('\u0000');
+        if (this.#entries.has(composite))
+            return false;
+        this.#entries.set(composite, key.exp);
+        return true;
+    }
+    purge(nowSeconds = Math.floor(Date.now() / 1000)) {
+        for (const [key, exp] of this.#entries)
+            if (exp < nowSeconds)
+                this.#entries.delete(key);
+    }
+    close() {
+        this.#entries.clear();
+    }
+}
+//# sourceMappingURL=replay-ledger.js.map

package/dist/gateway/replay-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-ledger.js","sourceRoot":"","sources":["../../source/gateway/replay-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkB3C,uFAAuF;AACvF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAe;IAClB,OAAO,CAAsC;IAC7C,MAAM,CAAsC;IAErD,YAAY,QAAgB;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;;;;;;;;;;;;;;KAcb,CAAC,CAAC;QACH,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;;;;;OAKb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;;KAI/B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,CAAC,GAAc,EAAE,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,kBAAkB;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,MAAM,CAAC,GAAc,EAAE,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,GAAG,GAAG,UAAU;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/gateway/runtime-factory.d.ts

@@ -0,0 +1,93 @@
+import type { ConversationAgentClient } from '../services/conversation-agent-client.js';
+import type { ILoggingService, ISettingsService, ISessionContextService } from '../services/service-interfaces.js';
+import { SkillsService } from '../services/skills/skills-service.js';
+import { type WorkerBoundaryProbe } from './worker-boundary.js';
+import type { GatewaySessionComposition, ProviderBrokerCapability, SecretFreeWorkerSettings, SessionSettingsSnapshot, SessionBinding } from './contracts.js';
+import { ServerSession, type ServerSessionOptions } from './server-session.js';
+import type { ToolOwnershipRegistry } from '../services/approval/tool-ownership-registry.js';
+import type { PostExecutePauseCapability } from '../services/session/post-execute-pause-capability.js';
+import type { SessionAccessState } from '../services/session/session-access-state.js';
+import type { ProviderContinuity } from '../services/provider-continuity.js';
+import type { OpenAICandidateObserver } from '../services/openai-candidate-observer.js';
+import type { ToolExecutionLifecyclePort } from '../tools/types.js';
+export type RuntimeResourcePolicy = Readonly<{
+    maxLiveSessions: number;
+    maxQueuedSubmissions: number;
+    preparedLeaseTtlMs: number;
+    maxActiveTurnMs: number;
+    maxProviderRequestsPerTurn: number;
+    maxParallelToolCalls: number;
+    maxToolOutputBytes: number;
+    maxShellJobs: 0;
+    shutdownGraceMs: number;
+    maxLiveSessionsPerOwner: number;
+}>;
+export declare const DEFAULT_RUNTIME_RESOURCE_POLICY: RuntimeResourcePolicy;
+export declare class RuntimeFactoryError extends Error {
+    readonly code: 'invalid_binding' | 'resource_limit' | 'provider_unavailable' | 'sandbox_unavailable' | 'closed' | 'client_factory_missing';
+    constructor(code: RuntimeFactoryError['code']);
+}
+export type GatewayAgentClientFactory = (input: {
+    sessionId: string;
+    binding: SessionBinding;
+    settings: ISettingsService;
+    defaults: SecretFreeWorkerSettings;
+    logger: ILoggingService;
+    sessionContextService: ISessionContextService;
+    executionContext: GatewaySessionComposition['executionContext'];
+    skillsService: SkillsService;
+    providerBroker?: ProviderBrokerCapability;
+    toolOwnership: ToolOwnershipRegistry;
+    postExecutePauseCapability: PostExecutePauseCapability;
+    sessionAccess: SessionAccessState;
+    providerContinuity: ProviderContinuity;
+    requestCapture: OpenAICandidateObserver;
+    toolLifecycle?: ToolExecutionLifecyclePort;
+    env: Readonly<Record<string, string>>;
+    spawnOptions: GatewaySessionComposition['spawnOptions'];
+    policy: RuntimeResourcePolicy;
+    gatewayMode: true;
+    allowBackgroundShell: boolean;
+    maxToolOutputBytes: number;
+    sessionSettingsSnapshot: SessionSettingsSnapshot;
+}) => ConversationAgentClient;
+export type RuntimeFactoryOptions = {
+    policy?: Partial<RuntimeResourcePolicy>;
+    /** Legacy fixture capability. Omit this for the real provider stack. */
+    providerBroker?: ProviderBrokerCapability;
+    providerProbe?: WorkerBoundaryProbe;
+    tmpDir: string;
+    sandboxAvailable: true;
+    createAgentClient: GatewayAgentClientFactory;
+    createLogger?: (sessionId: string, context: ISessionContextService) => ILoggingService;
+    createSettings?: (defaults: SecretFreeWorkerSettings, tmpDir: string, snapshot: SessionSettingsSnapshot) => ISettingsService;
+    /** The launcher's authority is read to create a snapshot, never shared with a session. */
+    settingsAuthority?: ISettingsService;
+    createSettingsSnapshot?: (binding: SessionBinding) => SessionSettingsSnapshot;
+    modelCatalogLogger?: ILoggingService;
+    createSessionContext?: () => ISessionContextService;
+    createSkills?: (logger: ILoggingService, canonicalRoot: string) => SkillsService;
+    onResourceReleased?: (sessionId: string) => void;
+    /** Test seam; production uses the adapter's conservative bound. */
+    activeCancelTimeoutMs?: number;
+};
+export declare function resolveRuntimeResourcePolicy(input?: Partial<RuntimeResourcePolicy>): RuntimeResourcePolicy;
+/**
+ * Owns the complete term2-facing per-session graph. The agent-client callback
+ * is the provider-adapter seam: it receives only the session-scoped broker and
+ * never receives host credentials or an ambient environment.
+ */
+export declare class RuntimeFactory {
+    #private;
+    constructor(options: RuntimeFactoryOptions);
+    get policy(): RuntimeResourcePolicy;
+    get liveSessionCount(): number;
+    get settingsAuthority(): ISettingsService | undefined;
+    get modelCatalogLogger(): ILoggingService | undefined;
+    get usesRealProviderStack(): boolean;
+    create(binding: SessionBinding, options?: {
+        eventSink?: ServerSessionOptions['eventSink'];
+    }): Promise<ServerSession>;
+    shutdown(graceMs?: number): Promise<void>;
+}
+//# sourceMappingURL=runtime-factory.d.ts.map

package/dist/gateway/runtime-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-factory.d.ts","sourceRoot":"","sources":["../../source/gateway/runtime-factory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAInH,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,0BAA0B,EAAE,MAAM,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC,CAAC;AAEH,eAAO,MAAM,+BAA+B,EAAE,qBAW5C,CAAC;AAEH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EACT,iBAAiB,GACjB,gBAAgB,GAChB,sBAAsB,GACtB,qBAAqB,GACrB,QAAQ,GACR,wBAAwB,CAAC;IAC7B,YAAY,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAI5C;CACF;AAED,MAAM,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,wBAAwB,CAAC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,gBAAgB,EAAE,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IAChE,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,aAAa,EAAE,qBAAqB,CAAC;IACrC,0BAA0B,EAAE,0BAA0B,CAAC;IACvD,aAAa,EAAE,kBAAkB,CAAC;IAClC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,cAAc,EAAE,uBAAuB,CAAC;IACxC,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtC,YAAY,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,WAAW,EAAE,IAAI,CAAC;IAClB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,KAAK,uBAAuB,CAAC;AAE9B,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,wEAAwE;IACxE,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,IAAI,CAAC;IACvB,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,KAAK,eAAe,CAAC;IACvF,cAAc,CAAC,EAAE,CACf,QAAQ,EAAE,wBAAwB,EAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,uBAAuB,KAC9B,gBAAgB,CAAC;IACtB,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;IACrC,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,uBAAuB,CAAC;IAC9E,kBAAkB,CAAC,EAAE,eAAe,CAAC;IACrC,oBAAoB,CAAC,EAAE,MAAM,sBAAsB,CAAC;IACpD,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,KAAK,aAAa,CAAC;IACjF,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,mEAAmE;IACnE,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,wBAAgB,4BAA4B,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,qBAAqB,CAmB1G;AA+CD;;;;GAIG;AACH,qBAAa,cAAc;;IAQzB,YAAY,OAAO,EAAE,qBAAqB,EAIzC;IAED,IAAI,MAAM,IAAI,qBAAqB,CAElC;IACD,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IACD,IAAI,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAEpD;IACD,IAAI,kBAAkB,IAAI,eAAe,GAAG,SAAS,CAEpD;IACD,IAAI,qBAAqB,IAAI,OAAO,CAEnC;IAEK,MAAM,CACV,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAA;KAAE,GAC1D,OAAO,CAAC,aAAa,CAAC,CAyIxB;IAEK,QAAQ,CAAC,OAAO,SAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpE;CACF"}

package/dist/gateway/runtime-factory.js

@@ -0,0 +1,242 @@
+import path from 'node:path';
+import { realpathSync, statSync } from 'node:fs';
+import { ConversationService } from '../services/conversation/conversation-service.js';
+import { createOwnedSessionClientFactory } from '../services/session/session-client-factory.js';
+import { SessionContextService } from '../services/session/session-context-service.js';
+import { LoggingService } from '../services/logging/logging-service.js';
+import { SettingsService } from '../services/settings/settings-service.js';
+import { SkillsService } from '../services/skills/skills-service.js';
+import { composeGatewaySession } from './worker-boundary.js';
+import { createSessionSettingsSnapshot } from './launcher-seam.js';
+import { ServerSession } from './server-session.js';
+export const DEFAULT_RUNTIME_RESOURCE_POLICY = Object.freeze({
+    maxLiveSessions: 16,
+    maxQueuedSubmissions: 32,
+    preparedLeaseTtlMs: 10_000,
+    maxActiveTurnMs: 300_000,
+    maxProviderRequestsPerTurn: 64,
+    maxParallelToolCalls: 1,
+    maxToolOutputBytes: 1_048_576,
+    maxShellJobs: 0,
+    shutdownGraceMs: 5_000,
+    maxLiveSessionsPerOwner: 4,
+});
+export class RuntimeFactoryError extends Error {
+    code;
+    constructor(code) {
+        super('gateway runtime factory rejected');
+        this.name = 'RuntimeFactoryError';
+        this.code = code;
+    }
+}
+export function resolveRuntimeResourcePolicy(input) {
+    const merged = { ...DEFAULT_RUNTIME_RESOURCE_POLICY, ...(input ?? {}) };
+    const finitePositive = (value) => Number.isSafeInteger(value) && value > 0;
+    if (!finitePositive(merged.maxLiveSessions) ||
+        !finitePositive(merged.maxQueuedSubmissions) ||
+        merged.maxQueuedSubmissions > 32 ||
+        !finitePositive(merged.preparedLeaseTtlMs) ||
+        !finitePositive(merged.maxActiveTurnMs) ||
+        !finitePositive(merged.maxProviderRequestsPerTurn) ||
+        !finitePositive(merged.maxParallelToolCalls) ||
+        !finitePositive(merged.maxToolOutputBytes) ||
+        merged.maxShellJobs !== 0 ||
+        !finitePositive(merged.shutdownGraceMs) ||
+        !finitePositive(merged.maxLiveSessionsPerOwner)) {
+        throw new RuntimeFactoryError('resource_limit');
+    }
+    return Object.freeze(merged);
+}
+function assertBinding(binding) {
+    if (!binding ||
+        !binding.sessionId ||
+        !binding.ownerUserId ||
+        !binding.workspaceId ||
+        !Number.isSafeInteger(binding.grantVersion) ||
+        !path.isAbsolute(binding.canonicalRoot) ||
+        (binding.access !== 'read' && binding.access !== 'read_write'))
+        throw new RuntimeFactoryError('invalid_binding');
+    try {
+        if (realpathSync(binding.canonicalRoot) !== binding.canonicalRoot ||
+            !statSync(binding.canonicalRoot).isDirectory()) {
+            throw new Error();
+        }
+    }
+    catch {
+        throw new RuntimeFactoryError('invalid_binding');
+    }
+}
+function createDefaultSettings(defaults, tmpDir, maxParallelToolCalls = 1, snapshot) {
+    const settings = new SettingsService({
+        settingsDir: path.join(tmpDir, 'settings'),
+        disableFilePersistence: true,
+        disableLogging: true,
+        env: {},
+        cli: {},
+    });
+    settings.set('agent.provider', defaults.providerId, { persist: false });
+    settings.set('agent.model', defaults.modelId, { persist: false });
+    if (snapshot) {
+        settings.set('agent.reasoningEffort', snapshot.reasoningEffort, { persist: false });
+    }
+    settings.set('agent.maxParallelToolCalls', maxParallelToolCalls, { persist: false });
+    return settings;
+}
+/**
+ * Owns the complete term2-facing per-session graph. The agent-client callback
+ * is the provider-adapter seam: it receives only the session-scoped broker and
+ * never receives host credentials or an ambient environment.
+ */
+export class RuntimeFactory {
+    #options;
+    #policy;
+    #sessions = new Map();
+    #owners = new Map();
+    #creating = new Set();
+    #closed = false;
+    constructor(options) {
+        if (!options.createAgentClient)
+            throw new RuntimeFactoryError('client_factory_missing');
+        this.#options = options;
+        this.#policy = resolveRuntimeResourcePolicy(options.policy);
+    }
+    get policy() {
+        return this.#policy;
+    }
+    get liveSessionCount() {
+        return this.#sessions.size;
+    }
+    get settingsAuthority() {
+        return this.#options.settingsAuthority;
+    }
+    get modelCatalogLogger() {
+        return this.#options.modelCatalogLogger;
+    }
+    get usesRealProviderStack() {
+        return !this.#options.providerBroker;
+    }
+    async create(binding, options) {
+        assertBinding(binding);
+        if (this.#closed)
+            throw new RuntimeFactoryError('closed');
+        if (this.#sessions.has(binding.sessionId) || this.#creating.has(binding.sessionId)) {
+            throw new RuntimeFactoryError('invalid_binding');
+        }
+        if (this.#sessions.size >= this.#policy.maxLiveSessions)
+            throw new RuntimeFactoryError('resource_limit');
+        const ownerCount = this.#owners.get(binding.ownerUserId) ?? 0;
+        if (ownerCount >= this.#policy.maxLiveSessionsPerOwner)
+            throw new RuntimeFactoryError('resource_limit');
+        this.#creating.add(binding.sessionId);
+        let composition;
+        const sessionSettingsSnapshot = this.#options.createSettingsSnapshot?.(binding) ??
+            (this.#options.settingsAuthority
+                ? createSessionSettingsSnapshot({
+                    settings: this.#options.settingsAuthority,
+                    // A launcher must opt in to write access through its explicit
+                    // snapshot callback; binding access alone is not authority.
+                    effectiveToolPolicy: { allowWrite: false },
+                })
+                : undefined);
+        if (!this.#options.providerBroker && !sessionSettingsSnapshot) {
+            this.#creating.delete(binding.sessionId);
+            throw new RuntimeFactoryError('provider_unavailable');
+        }
+        try {
+            composition = composeGatewaySession({
+                binding,
+                providerBroker: this.#options.providerBroker,
+                providerProbe: this.#options.providerProbe,
+                settingsSnapshot: sessionSettingsSnapshot,
+                tmpDir: path.join(this.#options.tmpDir, binding.sessionId),
+                sandboxAvailable: this.#options.sandboxAvailable,
+                maxProviderRequestsPerTurn: this.#policy.maxProviderRequestsPerTurn,
+            });
+        }
+        catch (error) {
+            this.#creating.delete(binding.sessionId);
+            throw error;
+        }
+        const context = this.#options.createSessionContext?.() ?? new SessionContextService();
+        const logger = this.#options.createLogger?.(binding.sessionId, context) ??
+            new LoggingService({
+                disableLogging: true,
+                suppressConsoleOutput: true,
+                sessionContextService: context,
+            });
+        const settings = this.#options.createSettings?.(composition.settings, path.join(this.#options.tmpDir, binding.sessionId), sessionSettingsSnapshot) ??
+            createDefaultSettings(composition.settings, path.join(this.#options.tmpDir, binding.sessionId), this.#policy.maxParallelToolCalls, sessionSettingsSnapshot);
+        composition.sessionSettingsService = settings;
+        const skills = this.#options.createSkills?.(logger, binding.canonicalRoot) ?? new SkillsService(logger, binding.canonicalRoot);
+        const sessionClientFactory = createOwnedSessionClientFactory(settings, (sessionId, toolOwnership, postExecutePauseCapability, access, _continuationProjectionMode, providerContinuity, requestCapture, toolLifecycle) => this.#options.createAgentClient({
+            sessionId,
+            binding,
+            settings,
+            defaults: composition.settings,
+            logger,
+            sessionContextService: context,
+            executionContext: composition.executionContext,
+            skillsService: skills,
+            providerBroker: composition.providerBroker,
+            sessionSettingsSnapshot: sessionSettingsSnapshot,
+            toolOwnership,
+            postExecutePauseCapability,
+            sessionAccess: access,
+            providerContinuity,
+            requestCapture,
+            toolLifecycle,
+            env: composition.env,
+            spawnOptions: composition.spawnOptions,
+            policy: this.#policy,
+            gatewayMode: true,
+            allowBackgroundShell: this.#policy.maxShellJobs > 0,
+            maxToolOutputBytes: this.#policy.maxToolOutputBytes,
+        }), undefined, { allowBackgroundShell: this.#policy.maxShellJobs > 0 });
+        let service;
+        try {
+            service = new ConversationService({
+                sessionClientFactory,
+                sessionId: binding.sessionId,
+                deps: { logger, settingsService: settings, sessionContextService: context, skillsService: skills },
+                queueCapacity: this.#policy.maxQueuedSubmissions,
+                preparedLeaseTtlMs: this.#policy.preparedLeaseTtlMs,
+                activeCancelTimeoutMs: this.#options.activeCancelTimeoutMs,
+                discardOnFailure: true,
+            });
+            const session = new ServerSession({
+                binding,
+                service,
+                composition,
+                policy: this.#policy,
+                eventSink: options?.eventSink,
+                onDispose: () => {
+                    this.#sessions.delete(binding.sessionId);
+                    const next = (this.#owners.get(binding.ownerUserId) ?? 1) - 1;
+                    if (next <= 0)
+                        this.#owners.delete(binding.ownerUserId);
+                    else
+                        this.#owners.set(binding.ownerUserId, next);
+                    this.#options.onResourceReleased?.(binding.sessionId);
+                },
+            });
+            this.#sessions.set(binding.sessionId, session);
+            this.#owners.set(binding.ownerUserId, ownerCount + 1);
+            this.#creating.delete(binding.sessionId);
+            return session;
+        }
+        catch (error) {
+            this.#creating.delete(binding.sessionId);
+            service?.dispose();
+            await Promise.resolve(composition.dispose());
+            throw error;
+        }
+    }
+    async shutdown(graceMs = this.#policy.shutdownGraceMs) {
+        this.#closed = true;
+        await Promise.race([
+            Promise.all([...this.#sessions.values()].map((session) => session.dispose('shutdown'))).then(() => undefined),
+            new Promise((resolve) => setTimeout(resolve, Math.max(1, graceMs))),
+        ]);
+    }
+}
+//# sourceMappingURL=runtime-factory.js.map

package/dist/gateway/runtime-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-factory.js","sourceRoot":"","sources":["../../source/gateway/runtime-factory.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAEvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAEhG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAA4B,MAAM,sBAAsB,CAAC;AAQvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,aAAa,EAA6B,MAAM,qBAAqB,CAAC;AAqB/E,MAAM,CAAC,MAAM,+BAA+B,GAA0B,MAAM,CAAC,MAAM,CAAC;IAClF,eAAe,EAAE,EAAE;IACnB,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,MAAM;IAC1B,eAAe,EAAE,OAAO;IACxB,0BAA0B,EAAE,EAAE;IAC9B,oBAAoB,EAAE,CAAC;IACvB,kBAAkB,EAAE,SAAS;IAC7B,YAAY,EAAE,CAAC;IACf,eAAe,EAAE,KAAK;IACtB,uBAAuB,EAAE,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAMgB;IAC7B,YAAY,IAAiC;QAC3C,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAoDD,MAAM,UAAU,4BAA4B,CAAC,KAAsC;IACjF,MAAM,MAAM,GAAG,EAAE,GAAG,+BAA+B,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACxE,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAC5F,IACE,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;QACvC,CAAC,cAAc,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC5C,MAAM,CAAC,oBAAoB,GAAG,EAAE;QAChC,CAAC,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC1C,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;QACvC,CAAC,cAAc,CAAC,MAAM,CAAC,0BAA0B,CAAC;QAClD,CAAC,cAAc,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC5C,CAAC,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC1C,MAAM,CAAC,YAAY,KAAK,CAAC;QACzB,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;QACvC,CAAC,cAAc,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,OAAuB;IAC5C,IACE,CAAC,OAAO;QACR,CAAC,OAAO,CAAC,SAAS;QAClB,CAAC,OAAO,CAAC,WAAW;QACpB,CAAC,OAAO,CAAC,WAAW;QACpB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3C,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC;QACvC,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC;QAE9D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,IACE,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,aAAa;YAC7D,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAkC,EAClC,MAAc,EACd,oBAAoB,GAAG,CAAC,EACxB,QAAkC;IAElC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;QACnC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;QAC1C,sBAAsB,EAAE,IAAI;QAC5B,cAAc,EAAE,IAAI;QACpB,GAAG,EAAE,EAAE;QACP,GAAG,EAAE,EAAE;KACR,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,eAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,4BAA4B,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAChB,QAAQ,CAAwB;IAChC,OAAO,CAAwB;IAC/B,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,OAA8B;QACxC,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACzC,CAAC;IACD,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC1C,CAAC;IACD,IAAI,qBAAqB;QACvB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAuB,EACvB,OAA2D;QAE3D,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QACzG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,uBAAuB;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtC,IAAI,WAAqD,CAAC;QAC1D,MAAM,uBAAuB,GAC3B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,OAAO,CAAC;YAC/C,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;gBAC9B,CAAC,CAAC,6BAA6B,CAAC;oBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB;oBACzC,8DAA8D;oBAC9D,4DAA4D;oBAC5D,mBAAmB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;iBAC3C,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,WAAW,GAAG,qBAAqB,CAAC;gBAClC,OAAO;gBACP,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;gBAC5C,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAC1C,gBAAgB,EAAE,uBAAuB;gBACzC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC;gBAC1D,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;gBAChD,0BAA0B,EAAE,IAAI,CAAC,OAAO,CAAC,0BAA0B;aACpE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACtF,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;YACxD,IAAI,cAAc,CAAC;gBACjB,cAAc,EAAE,IAAI;gBACpB,qBAAqB,EAAE,IAAI;gBAC3B,qBAAqB,EAAE,OAAO;aAC/B,CAAC,CAAC;QACL,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAC5B,WAAW,CAAC,QAAQ,EACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAClD,uBAAwB,CACzB;YACD,qBAAqB,CACnB,WAAW,CAAC,QAAQ,EACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAClD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EACjC,uBAAuB,CACxB,CAAC;QACJ,WAAW,CAAC,sBAAsB,GAAG,QAAQ,CAAC;QAC9C,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAClH,MAAM,oBAAoB,GAAG,+BAA+B,CAC1D,QAAQ,EACR,CACE,SAAS,EACT,aAAa,EACb,0BAA0B,EAC1B,MAAM,EACN,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,EAAE,CACF,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAC9B,SAAS;YACT,OAAO;YACP,QAAQ;YACR,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM;YACN,qBAAqB,EAAE,OAAO;YAC9B,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,uBAAuB,EAAE,uBAAwB;YACjD,aAAa;YACb,0BAA0B;YAC1B,aAAa,EAAE,MAAM;YACrB,kBAAkB;YAClB,cAAc;YACd,aAAa;YACb,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC;YACnD,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;SACpD,CAAC,EACJ,SAAS,EACT,EAAE,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CACxD,CAAC;QACF,IAAI,OAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,mBAAmB,CAAC;gBAChC,oBAAoB;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;gBAClG,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB;gBAChD,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;gBACnD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB;gBAC1D,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBAChC,OAAO;gBACP,OAAO;gBACP,WAAW;gBACX,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,SAAS,EAAE,GAAG,EAAE;oBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBACzC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9D,IAAI,IAAI,IAAI,CAAC;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;;wBACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACxD,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,CAAC;YACnB,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe;QACnD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC7G,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/gateway/safe-log.d.ts

@@ -0,0 +1,15 @@
+import type { GatewaySafeLogMetadata } from './contracts.js';
+export declare class GatewayLogError extends Error {
+    constructor();
+}
+export declare function principalRef(ownerUserId: string, key: string | Buffer): string;
+export declare function createSafeLogMetadata(input: Omit<GatewaySafeLogMetadata, 'schemaVersion' | 'correlationId'> & {
+    correlationId?: string;
+}): GatewaySafeLogMetadata;
+export type GatewayAuditWriter = (record: GatewaySafeLogMetadata) => Promise<void>;
+export declare class GatewayAuditLog {
+    private readonly writer;
+    constructor(writer: GatewayAuditWriter);
+    write(record: GatewaySafeLogMetadata): Promise<void>;
+}
+//# sourceMappingURL=safe-log.d.ts.map

package/dist/gateway/safe-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-log.d.ts","sourceRoot":"","sources":["../../source/gateway/safe-log.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAgE7D,qBAAa,eAAgB,SAAQ,KAAK;IACxC,cAGC;CACF;AAED,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,eAAe,GAAG,eAAe,CAAC,GAAG;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACA,sBAAsB,CA4BxB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,kBAAkB,EAAI;IACrD,KAAK,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzD;CACF"}