@qduc/term2 0.15.0 → 0.16.0

package/dist/gateway/trusted-clients.js

@@ -0,0 +1,157 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+export class TrustedClientsError extends Error {
+    constructor(message = 'trusted client store is unavailable') {
+        super(message);
+        this.name = 'TrustedClientsError';
+    }
+}
+export class TrustedClientsStore {
+    #filePath;
+    #file;
+    constructor(filePath) {
+        if (!path.isAbsolute(filePath) || filePath.includes('\u0000'))
+            throw new TrustedClientsError();
+        this.#filePath = filePath;
+        this.#file = this.#load();
+    }
+    get filePath() {
+        return this.#filePath;
+    }
+    get size() {
+        return Object.keys(this.#file.clients).length;
+    }
+    entries() {
+        return Object.entries(this.#file.clients).map(([kid, client]) => ({
+            kid,
+            publicKeyPem: client.publicKeyPem,
+            fingerprint: client.fingerprint,
+        }));
+    }
+    add(publicKeyPem) {
+        const normalized = normalizePublicKey(publicKeyPem);
+        const client = {
+            publicKeyPem: normalized.publicKeyPem,
+            pairedAt: new Date().toISOString(),
+            fingerprint: normalized.fingerprint,
+        };
+        const next = {
+            version: 1,
+            clients: { ...this.#file.clients, [normalized.fingerprint]: client },
+        };
+        this.#write(next);
+        this.#file = next;
+        return { kid: normalized.fingerprint, ...normalized };
+    }
+    static normalizePublicKey(publicKeyPem) {
+        const normalized = normalizePublicKey(publicKeyPem);
+        return { kid: normalized.fingerprint, ...normalized };
+    }
+    #load() {
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(this.#filePath, 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { version: 1, clients: {} };
+            throw new TrustedClientsError();
+        }
+        if (!isTrustedClientsFile(parsed))
+            throw new TrustedClientsError();
+        return parsed;
+    }
+    #write(file) {
+        const directory = path.dirname(this.#filePath);
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        try {
+            fs.chmodSync(directory, 0o700);
+        }
+        catch {
+            throw new TrustedClientsError();
+        }
+        const tempPath = `${this.#filePath}.${process.pid}.${randomUUID()}.tmp`;
+        let fd;
+        let renamed = false;
+        try {
+            fd = fs.openSync(tempPath, 'w', 0o600);
+            fs.writeFileSync(fd, JSON.stringify(file, null, 2), { encoding: 'utf8' });
+            fs.fsyncSync(fd);
+            fs.closeSync(fd);
+            fd = undefined;
+            fs.renameSync(tempPath, this.#filePath);
+            renamed = true;
+            fs.chmodSync(this.#filePath, 0o600);
+            const directoryFd = fs.openSync(directory, 'r');
+            try {
+                fs.fsyncSync(directoryFd);
+            }
+            finally {
+                fs.closeSync(directoryFd);
+            }
+        }
+        catch {
+            throw new TrustedClientsError();
+        }
+        finally {
+            if (fd !== undefined) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch {
+                    // Preserve the original store failure.
+                }
+            }
+            if (!renamed) {
+                try {
+                    fs.unlinkSync(tempPath);
+                }
+                catch {
+                    // Best effort; no secret is exposed through the error surface.
+                }
+            }
+        }
+    }
+}
+function normalizePublicKey(publicKeyPem) {
+    if (typeof publicKeyPem !== 'string' || publicKeyPem.length === 0 || publicKeyPem.length > 16_384)
+        throw new TrustedClientsError('public key is invalid');
+    if (/PRIVATE KEY/i.test(publicKeyPem))
+        throw new TrustedClientsError('public key is invalid');
+    let key;
+    try {
+        key = crypto.createPublicKey(publicKeyPem);
+    }
+    catch {
+        throw new TrustedClientsError('public key is invalid');
+    }
+    if (key.asymmetricKeyType !== 'rsa')
+        throw new TrustedClientsError('public key is invalid');
+    const der = key.export({ type: 'spki', format: 'der' });
+    const normalized = key.export({ type: 'spki', format: 'pem' }).toString();
+    return {
+        publicKeyPem: normalized,
+        fingerprint: crypto.createHash('sha256').update(der).digest('hex'),
+    };
+}
+function isTrustedClientsFile(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    if (candidate.version !== 1 || !candidate.clients || typeof candidate.clients !== 'object')
+        return false;
+    return Object.entries(candidate.clients).every(([kid, client]) => {
+        if (!/^[a-f0-9]{64}$/.test(kid) || !client || typeof client !== 'object' || Array.isArray(client))
+            return false;
+        const record = client;
+        return (typeof record.publicKeyPem === 'string' &&
+            record.publicKeyPem.length > 0 &&
+            record.publicKeyPem.length <= 16_384 &&
+            typeof record.pairedAt === 'string' &&
+            typeof record.fingerprint === 'string' &&
+            record.fingerprint === kid);
+    });
+}
+//# sourceMappingURL=trusted-clients.js.map

package/dist/gateway/trusted-clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-clients.js","sourceRoot":"","sources":["../../source/gateway/trusted-clients.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,GAAG,qCAAqC;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IACrB,SAAS,CAAS;IAC3B,KAAK,CAAqB;IAE1B,YAAY,QAAgB;QAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAC/F,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAChD,CAAC;IAED,OAAO;QACL,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,GAAG;YACH,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,GAAG,CAAC,YAAoB;QACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAkB;YAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC;QACF,MAAM,IAAI,GAAuB;YAC/B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE;SACrE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,YAAoB;QAC5C,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IACxD,CAAC;IAED,KAAK;QACH,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC3F,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,IAAwB;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QACxE,IAAI,EAAsB,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1E,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,GAAG,SAAS,CAAC;YACf,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,MAAM;QAC/F,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IACzD,IAAI,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IAC9F,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1E,OAAO;QACL,YAAY,EAAE,UAAU;QACxB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,SAAS,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzG,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;QAC1F,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAChH,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,OAAO,CACL,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YAC9B,MAAM,CAAC,YAAY,CAAC,MAAM,IAAI,MAAM;YACpC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,MAAM,CAAC,WAAW,KAAK,GAAG,CAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gateway/worker-boundary.d.ts

@@ -1,5 +1,5 @@
 import { ExecutionContext } from '../services/execution-context.js';
-import type { GatewaySessionComposition, ProviderBrokerCapability, SecretFreeWorkerSettings, SessionBinding } from './contracts.js';
+import type { GatewaySessionComposition, ProviderBrokerCapability, SecretFreeWorkerSettings, SessionSettingsSnapshot, SessionBinding } from './contracts.js';
 export declare class WorkerBoundaryError extends Error {
     readonly code: 'provider_unavailable' | 'invalid_broker' | 'unsafe_environment' | 'sandbox_unavailable';
     constructor(code: WorkerBoundaryError['code']);
@@ -12,7 +12,7 @@ export declare function assertProviderBrokerReady(capability: ProviderBrokerCapa
 export declare function createSessionScopedProviderBroker(base: ProviderBrokerCapability, sessionId: string, options?: {
     maxRequestsPerTurn?: number;
 }): ProviderBrokerCapability;
-export declare function createSecretFreeWorkerSettings(capability: ProviderBrokerCapability, canonicalRoot: string): SecretFreeWorkerSettings;
+export declare function createSecretFreeWorkerSettings(capability: ProviderBrokerCapability | undefined, canonicalRoot: string, snapshot?: SessionSettingsSnapshot): SecretFreeWorkerSettings;
 export declare function createSanitizedWorkerEnv(input: {
     sessionId: string;
     tmpDir: string;
@@ -22,8 +22,9 @@ export declare function createSanitizedWorkerEnv(input: {
 export declare function assertExplicitSanitizedEnv(env: Readonly<Record<string, string>>): void;
 export type GatewaySessionCompositionOptions = {
     binding: SessionBinding;
-    providerBroker: ProviderBrokerCapability;
-    providerProbe: WorkerBoundaryProbe;
+    providerBroker?: ProviderBrokerCapability;
+    providerProbe?: WorkerBoundaryProbe;
+    settingsSnapshot?: SessionSettingsSnapshot;
     tmpDir: string;
     env?: Readonly<Record<string, string>>;
     sandboxAvailable?: boolean;
@@ -32,7 +33,7 @@ export type GatewaySessionCompositionOptions = {
         executionContext: ExecutionContext;
         settings: SecretFreeWorkerSettings;
         env: Readonly<Record<string, string>>;
-        providerBroker: ProviderBrokerCapability;
+        providerBroker?: ProviderBrokerCapability;
     }) => GatewaySessionComposition['runtime'];
 };
 /** Composes the session-owned capabilities without changing process cwd or env. */

package/dist/gateway/worker-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-boundary.d.ts","sourceRoot":"","sources":["../../source/gateway/worker-boundary.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAKxB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;IACxG,YAAY,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAI5C;CACF;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,wBAAwB,GAAG,SAAS,EAChD,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,wBAAwB,CAU1B;AAED,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,wBAAwB,EAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5C,wBAAwB,CA+C1B;AAED,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,wBAAwB,EACpC,aAAa,EAAE,MAAM,GACpB,wBAAwB,CAQ1B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAqBnC;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CActF;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC7C,OAAO,EAAE,cAAc,CAAC;IACxB,cAAc,EAAE,wBAAwB,CAAC;IACzC,aAAa,EAAE,mBAAmB,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,QAAQ,EAAE,wBAAwB,CAAC;QACnC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACtC,cAAc,EAAE,wBAAwB,CAAC;KAC1C,KAAK,yBAAyB,CAAC,SAAS,CAAC,CAAC;CAC5C,CAAC;AAEF,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CA4B1G"}
+{"version":3,"file":"worker-boundary.d.ts","sourceRoot":"","sources":["../../source/gateway/worker-boundary.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAKxB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;IACxG,YAAY,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAI5C;CACF;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,wBAAwB,GAAG,SAAS,EAChD,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,wBAAwB,CAU1B;AAED,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,wBAAwB,EAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5C,wBAAwB,CA+C1B;AAED,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,wBAAwB,GAAG,SAAS,EAChD,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,uBAAuB,GACjC,wBAAwB,CAiB1B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAqBnC;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CActF;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC7C,OAAO,EAAE,cAAc,CAAC;IACxB,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,QAAQ,EAAE,wBAAwB,CAAC;QACnC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACtC,cAAc,CAAC,EAAE,wBAAwB,CAAC;KAC3C,KAAK,yBAAyB,CAAC,SAAS,CAAC,CAAC;CAC5C,CAAC;AAEF,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAoC1G"}

package/dist/gateway/worker-boundary.js

@@ -72,13 +72,23 @@ export function createSessionScopedProviderBroker(base, sessionId, options = {})
     };
     return scoped;
 }
-export function createSecretFreeWorkerSettings(capability, canonicalRoot) {
+export function createSecretFreeWorkerSettings(capability, canonicalRoot, snapshot) {
+    if (!capability && !snapshot)
+        throw new WorkerBoundaryError('provider_unavailable');
     return Object.freeze({
-        providerId: capability.providerId,
-        modelId: capability.modelId,
-        brokerCapabilityId: capability.capabilityId,
+        providerId: snapshot?.providerId ?? capability.providerId,
+        modelId: snapshot?.modelId ?? capability.modelId,
+        ...(capability ? { brokerCapabilityId: capability.capabilityId } : {}),
         executionRoot: canonicalRoot,
         envPolicyVersion: 1,
+        ...(snapshot
+            ? {
+                reasoningEffort: snapshot.reasoningEffort,
+                mode: snapshot.mode,
+                toolPolicy: snapshot.effectiveToolPolicy,
+                ...(snapshot.defaultsRevision === undefined ? {} : { defaultsRevision: snapshot.defaultsRevision }),
+            }
+            : {}),
     });
 }
 export function createSanitizedWorkerEnv(input) {
@@ -118,11 +128,10 @@ export function assertExplicitSanitizedEnv(env) {
 export function composeGatewaySession(options) {
     if (options.sandboxAvailable !== true)
         throw new WorkerBoundaryError('sandbox_unavailable');
-    const baseProviderBroker = assertProviderBrokerReady(options.providerBroker, options.providerProbe);
-    const providerBroker = createSessionScopedProviderBroker(baseProviderBroker, options.binding.sessionId, {
-        maxRequestsPerTurn: options.maxProviderRequestsPerTurn,
-    });
-    const settings = createSecretFreeWorkerSettings(providerBroker, options.binding.canonicalRoot);
+    const providerBroker = options.providerBroker
+        ? createSessionScopedProviderBroker(assertProviderBrokerReady(options.providerBroker, options.providerProbe), options.binding.sessionId, { maxRequestsPerTurn: options.maxProviderRequestsPerTurn })
+        : undefined;
+    const settings = createSecretFreeWorkerSettings(providerBroker, options.binding.canonicalRoot, options.settingsSnapshot);
     const env = options.env ?? createSanitizedWorkerEnv({ sessionId: options.binding.sessionId, tmpDir: options.tmpDir });
     assertExplicitSanitizedEnv(env);
     const executionContext = ExecutionContext.pin(options.binding.canonicalRoot);
@@ -134,6 +143,7 @@ export function composeGatewaySession(options) {
         executionContext,
         settings,
         providerBroker,
+        ...(options.settingsSnapshot ? { sessionSettingsSnapshot: options.settingsSnapshot } : {}),
         env,
         spawnOptions: { cwd: options.binding.canonicalRoot, env, gatewayMode: true },
         runtime,
@@ -142,7 +152,7 @@ export function composeGatewaySession(options) {
                 return;
             disposed = true;
             runtime?.dispose();
-            providerBroker.revoke?.();
+            providerBroker?.revoke?.();
         },
     };
 }

package/dist/gateway/worker-boundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-boundary.js","sourceRoot":"","sources":["../../source/gateway/worker-boundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAQpE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC5G,MAAM,kBAAkB,GAAG,yDAAyD,CAAC;AAErF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA2F;IACxG,YAAY,IAAiC;QAC3C,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAOD,MAAM,UAAU,yBAAyB,CACvC,UAAgD,EAChD,KAAsC;IAEtC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC7F,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACxF,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IAClG,IAAI,SAAS,IAAI,UAAU,IAAI,OAAO,IAAI,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IACtG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,IAA8B,EAC9B,SAAiB,EACjB,OAAO,GAAoC,EAAE;IAE7C,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACtD,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,IAAI,kBAAkB,KAAK,SAAS,IAAI,EAAE,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC5E,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAQ,EAAE;QAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,KAAgC,CAAC;QACnD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAClC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM;YAClC,SAAS,IAAI,SAAS;YACtB,KAAK,IAAI,SAAS;YAClB,QAAQ,IAAI,SAAS,EACrB,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAA8E;QACxF,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,IAAI,CAAC,SAAS,IAAI,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAC3E,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,cAAc,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,EAAE,KAAK,SAAS,CAAC,EAAE,KAAK;YAC5B,IAAI,CAAC,SAAS,IAAI,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAC3E,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,cAAc,EAAE,CAAC;YACjB,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,kBAAkB,EAAE,GAAG,EAAE;YACvB,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE;YACX,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,UAAoC,EACpC,aAAqB;IAErB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,kBAAkB,EAAE,UAAU,CAAC,YAAY;QAC3C,aAAa,EAAE,aAAa;QAC5B,gBAAgB,EAAE,CAAC;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,IACE,CAAC,KAAK,CAAC,SAAS;QAChB,CAAC,KAAK,CAAC,MAAM;QACb,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE/D,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IACtD,MAAM,GAAG,GAA2B;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe;QACnC,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,SAAS;KAClC,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAqC;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IACE,CAAC,GAAG,CAAC,MAAM;QACX,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,aAAa;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAkBD,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,OAAyC;IAC7E,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI;QAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAC5F,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACpG,MAAM,cAAc,GAAG,iCAAiC,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;QACtG,kBAAkB,EAAE,OAAO,CAAC,0BAA0B;KACvD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,8BAA8B,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtH,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7F,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,gBAAgB;QAChB,QAAQ;QACR,cAAc;QACd,GAAG;QACH,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE;QAC5E,OAAO;QACP,OAAO;YACL,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,CAAC;YAClB,cAAqE,CAAC,MAAM,EAAE,EAAE,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"worker-boundary.js","sourceRoot":"","sources":["../../source/gateway/worker-boundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AASpE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC5G,MAAM,kBAAkB,GAAG,yDAAyD,CAAC;AAErF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA2F;IACxG,YAAY,IAAiC;QAC3C,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAOD,MAAM,UAAU,yBAAyB,CACvC,UAAgD,EAChD,KAAsC;IAEtC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC7F,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACxF,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IAClG,IAAI,SAAS,IAAI,UAAU,IAAI,OAAO,IAAI,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IACtG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,IAA8B,EAC9B,SAAiB,EACjB,OAAO,GAAoC,EAAE;IAE7C,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACtD,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,IAAI,kBAAkB,KAAK,SAAS,IAAI,EAAE,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC5E,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAQ,EAAE;QAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,KAAgC,CAAC;QACnD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAClC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM;YAClC,SAAS,IAAI,SAAS;YACtB,KAAK,IAAI,SAAS;YAClB,QAAQ,IAAI,SAAS,EACrB,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAA8E;QACxF,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,IAAI,CAAC,SAAS,IAAI,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAC3E,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,cAAc,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,EAAE,KAAK,SAAS,CAAC,EAAE,KAAK;YAC5B,IAAI,CAAC,SAAS,IAAI,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAC3E,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,cAAc,EAAE,CAAC;YACjB,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,kBAAkB,EAAE,GAAG,EAAE;YACvB,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE;YACX,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,UAAgD,EAChD,aAAqB,EACrB,QAAkC;IAElC,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,UAAW,CAAC,UAAU;QAC1D,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,UAAW,CAAC,OAAO;QACjD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,aAAa,EAAE,aAAa;QAC5B,gBAAgB,EAAE,CAAC;QACnB,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,mBAAmB;gBACxC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;aACpG;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,IACE,CAAC,KAAK,CAAC,SAAS;QAChB,CAAC,KAAK,CAAC,MAAM;QACb,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE/D,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IACtD,MAAM,GAAG,GAA2B;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe;QACnC,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,SAAS;KAClC,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAqC;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IACE,CAAC,GAAG,CAAC,MAAM;QACX,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,aAAa;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAmBD,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,OAAyC;IAC7E,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI;QAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc;QAC3C,CAAC,CAAC,iCAAiC,CAC/B,yBAAyB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,EACxE,OAAO,CAAC,OAAO,CAAC,SAAS,EACzB,EAAE,kBAAkB,EAAE,OAAO,CAAC,0BAA0B,EAAE,CAC3D;QACH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,8BAA8B,CAC7C,cAAc,EACd,OAAO,CAAC,OAAO,CAAC,aAAa,EAC7B,OAAO,CAAC,gBAAgB,CACzB,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtH,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7F,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,gBAAgB;QAChB,QAAQ;QACR,cAAc;QACd,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG;QACH,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE;QAC5E,OAAO;QACP,OAAO;YACL,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,CAAC;YAClB,cAAmF,EAAE,MAAM,EAAE,EAAE,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/gateway/workspace-admission.d.ts

@@ -8,12 +8,17 @@ export declare function loadGatewayManifest(filename: string, expectedSha256?: s
 export type WorkspaceBoundaryEvidence = {
     mountedRoot: string;
     writable: boolean;
+    policy?: 'read_only_launcher';
 };
 export type WorkspaceBoundaryProbe = (canonicalRoot: string, access: WorkspaceGrant['access']) => WorkspaceBoundaryEvidence | false;
 export type WorkspaceAdmissionOptions = {
     allowSsh?: boolean;
     allowWrite?: boolean;
     boundaryProbe?: WorkspaceBoundaryProbe;
+    /** Dynamic (browser-selected) grants to restore after a restart. */
+    initialDynamicGrants?: readonly WorkspaceGrant[];
+    /** Durable sink invoked on every dynamic-grant mutation (register/remove). */
+    onDynamicGrantChange?: (grants: readonly WorkspaceGrant[]) => void;
 };
 export declare class WorkspaceAdmission {
     #private;
@@ -21,7 +26,12 @@ export declare class WorkspaceAdmission {
     get manifestVersion(): number;
     replaceManifest(manifest: GatewayManifest): void;
     listAliases(ownerUserId: string): WorkspaceAlias[];
+    /** Add a server-validated local root without weakening manifest admission. */
+    registerDynamicLocalGrant(grant: WorkspaceGrant): number;
+    removeDynamicLocalGrant(workspaceId: string): void;
     admit(claims: GatewayAssertionClaims, requestedManifestVersion?: number): SessionBinding;
+    /** Validate and construct a binding without reserving an active session. */
+    prepare(claims: GatewayAssertionClaims, requestedManifestVersion?: number): SessionBinding;
     /**
      * Reconstruct an immutable binding from the gateway-owned session index after
      * a daemon restart. The index supplies only opaque identity/version fields;
@@ -34,4 +44,5 @@ export declare class WorkspaceAdmission {
     remove(sessionId: string): void;
     static assertPath(binding: SessionBinding, requestedPath: string): string;
 }
+export declare function validateDynamicGrant(value: unknown): value is WorkspaceGrant;
 //# sourceMappingURL=workspace-admission.d.ts.map

package/dist/gateway/workspace-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-admission.d.ts","sourceRoot":"","sources":["../../source/gateway/workspace-admission.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EACT,kBAAkB,GAClB,2BAA2B,GAC3B,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,cAAc,GACd,4BAA4B,GAC5B,8BAA8B,GAC9B,uBAAuB,GACvB,mBAAmB,GACnB,wBAAwB,GACxB,4BAA4B,GAC5B,0BAA0B,GAC1B,mBAAmB,GACnB,+BAA+B,CAAC;IAEpC,YAAY,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAIhD;CACF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAoBvE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,eAAe,CAW9F;AAkED,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CACnC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,KAC7B,yBAAyB,GAAG,KAAK,CAAC;AAEvC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC,CAAC;AAEF,qBAAa,kBAAkB;;IAO7B,YAAY,QAAQ,EAAE,eAAe,EAAE,OAAO,GAAE,yBAAyB,GAAG,OAAY,EAMvF;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAE/C;IAED,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,EAAE,CAIjD;IAED,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,wBAAwB,SAAyB,GAAG,cAAc,CAsCvG;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc,CAgCzG;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CAKjE;IAED,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CAIlG;IAED,QAAQ,IAAI,KAAK,CAEhB;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE9B;IAED,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAexE;CACF"}
+{"version":3,"file":"workspace-admission.d.ts","sourceRoot":"","sources":["../../source/gateway/workspace-admission.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EACT,kBAAkB,GAClB,2BAA2B,GAC3B,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,cAAc,GACd,4BAA4B,GAC5B,8BAA8B,GAC9B,uBAAuB,GACvB,mBAAmB,GACnB,wBAAwB,GACxB,4BAA4B,GAC5B,0BAA0B,GAC1B,mBAAmB,GACnB,+BAA+B,CAAC;IAEpC,YAAY,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAIhD;CACF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAoBvE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,eAAe,CAW9F;AAkED,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CACnC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,KAC7B,yBAAyB,GAAG,KAAK,CAAC;AAEvC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;CACpE,CAAC;AAEF,qBAAa,kBAAkB;;IAa7B,YAAY,QAAQ,EAAE,eAAe,EAAE,OAAO,GAAE,yBAAyB,GAAG,OAAY,EAqBvF;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAI/C;IAED,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,EAAE,CAIjD;IAED,8EAA8E;IAC9E,yBAAyB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAoBvD;IAED,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAKjD;IAMD,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,wBAAwB,SAAuB,GAAG,cAAc,CAOrG;IAED,4EAA4E;IAC5E,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE,wBAAwB,SAAuB,GAAG,cAAc,CAkCvG;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc,CAiCzG;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CAKjE;IAED,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CAIlG;IAED,QAAQ,IAAI,KAAK,CAEhB;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAG9B;IASD,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAexE;CACF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAe5E"}

package/dist/gateway/workspace-admission.js

@@ -107,45 +107,99 @@ function validateSshTargets(value) {
     });
 }
 export class WorkspaceAdmission {
+    /** Live (runtime-backed) session bindings; the one-per-workspace constraint applies here. */
     #sessions = new Map();
+    /** Restored bindings from the persisted index (read-only history, no runtime). */
+    #restored = new Map();
+    #dynamicGrants = new Map();
+    #dynamicRevision = 0;
     #manifest;
     #allowSsh;
     #allowWrite;
     #boundaryProbe;
+    #onDynamicGrantChange;
     constructor(manifest, options = {}) {
         const resolved = typeof options === 'boolean' ? { allowSsh: options } : options;
         this.#allowSsh = resolved.allowSsh === true;
         this.#allowWrite = resolved.allowWrite === true;
         this.#boundaryProbe = resolved.boundaryProbe;
+        this.#onDynamicGrantChange = resolved.onDynamicGrantChange;
         this.#manifest = validateGatewayManifest(manifest);
+        for (const grant of resolved.initialDynamicGrants ?? []) {
+            // Each dynamic grant represents one prior register(), which bumped the
+            // revision; restoring them reproduces the manifestVersion the sessions
+            // recorded as grantVersion.
+            if (!validateDynamicGrant(grant) ||
+                this.#dynamicGrants.has(grant.workspaceId) ||
+                this.#manifest.grants.some((candidate) => candidate.workspaceId === grant.workspaceId)) {
+                throw new WorkspaceAdmissionError('manifest_invalid');
+            }
+            this.#dynamicGrants.set(grant.workspaceId, Object.freeze({ ...grant }));
+            this.#dynamicRevision += 1;
+        }
     }
     get manifestVersion() {
-        return this.#manifest.version;
+        return this.#manifest.version + this.#dynamicRevision;
     }
     replaceManifest(manifest) {
         this.#manifest = validateGatewayManifest(manifest);
+        this.#dynamicGrants.clear();
+        this.#dynamicRevision = 0;
     }
     listAliases(ownerUserId) {
-        return this.#manifest.grants
+        return [...this.#manifest.grants, ...this.#dynamicGrants.values()]
             .filter((grant) => grant.enabled && grant.kind === 'local' && grant.ownerUserId === ownerUserId)
             .map(({ workspaceId, access, label }) => ({ workspaceId, access, label }));
     }
-    admit(claims, requestedManifestVersion = this.#manifest.version) {
+    /** Add a server-validated local root without weakening manifest admission. */
+    registerDynamicLocalGrant(grant) {
+        if (grant.kind !== 'local' ||
+            !grant.localRoot ||
+            !path.isAbsolute(grant.localRoot) ||
+            !grant.ownerUserId ||
+            !isProvisionedLabel(grant.label) ||
+            !/^[A-Za-z0-9_-]{1,256}$/.test(grant.workspaceId) ||
+            (grant.access !== 'read' && grant.access !== 'read_write') ||
+            grant.enabled !== true ||
+            [...this.#manifest.grants, ...this.#dynamicGrants.values()].some((candidate) => candidate.workspaceId === grant.workspaceId)) {
+            throw new WorkspaceAdmissionError('manifest_invalid');
+        }
+        this.#dynamicGrants.set(grant.workspaceId, Object.freeze({ ...grant }));
+        this.#dynamicRevision += 1;
+        this.#persistDynamicGrants();
+        return this.manifestVersion;
+    }
+    removeDynamicLocalGrant(workspaceId) {
+        if (this.#dynamicGrants.delete(workspaceId)) {
+            this.#dynamicRevision -= 1;
+            this.#persistDynamicGrants();
+        }
+    }
+    #persistDynamicGrants() {
+        this.#onDynamicGrantChange?.([...this.#dynamicGrants.values()]);
+    }
+    admit(claims, requestedManifestVersion = this.manifestVersion) {
+        const binding = this.prepare(claims, requestedManifestVersion);
+        if ([...this.#sessions.values()].some((session) => session.workspaceId === binding.workspaceId)) {
+            throw new WorkspaceAdmissionError('workspace_session_exists');
+        }
+        this.#sessions.set(binding.sessionId, binding);
+        return binding;
+    }
+    /** Validate and construct a binding without reserving an active session. */
+    prepare(claims, requestedManifestVersion = this.manifestVersion) {
         if (claims.purpose !== 'session_create')
             throw new WorkspaceAdmissionError('workspace_not_found');
-        if (requestedManifestVersion !== this.#manifest.version)
+        if (requestedManifestVersion !== this.manifestVersion)
             throw new WorkspaceAdmissionError('manifest_version_mismatch');
         const workspaceId = claims.workspaceId;
         if (!workspaceId)
             throw new WorkspaceAdmissionError('workspace_not_found');
-        const grant = this.#manifest.grants.find((candidate) => candidate.workspaceId === workspaceId);
+        const grant = this.#grantFor(workspaceId);
         if (!grant)
             throw new WorkspaceAdmissionError('workspace_not_found');
         if (grant.ownerUserId !== claims.sub)
             throw new WorkspaceAdmissionError('workspace_owner_mismatch');
-        if ([...this.#sessions.values()].some((session) => session.workspaceId === workspaceId)) {
-            throw new WorkspaceAdmissionError('workspace_session_exists');
-        }
         if (!grant.enabled)
             throw new WorkspaceAdmissionError('workspace_disabled');
         if (grant.kind === 'ssh') {
@@ -168,11 +222,10 @@ export class WorkspaceAdmission {
             sessionId: randomUUID(),
             ownerUserId: claims.sub,
             workspaceId: grant.workspaceId,
-            grantVersion: this.#manifest.version,
+            grantVersion: this.manifestVersion,
             canonicalRoot,
             access: grant.access,
         };
-        this.#sessions.set(binding.sessionId, binding);
         return Object.freeze(binding);
     }
     /**
@@ -181,7 +234,7 @@ export class WorkspaceAdmission {
      * the manifest and boundary probe remain the authority for the root.
      */
     restore(sessionId, ownerUserId, workspaceId, grantVersion) {
-        const current = this.#sessions.get(sessionId);
+        const current = this.#sessions.get(sessionId) ?? this.#restored.get(sessionId);
         if (current) {
             if (current.ownerUserId !== ownerUserId || current.workspaceId !== workspaceId)
                 throw new WorkspaceAdmissionError('session_owner_mismatch');
@@ -189,9 +242,9 @@ export class WorkspaceAdmission {
                 throw new WorkspaceAdmissionError('manifest_version_mismatch');
             return current;
         }
-        if (grantVersion !== this.#manifest.version)
+        if (grantVersion > this.manifestVersion || grantVersion < this.#manifest.version)
             throw new WorkspaceAdmissionError('manifest_version_mismatch');
-        const grant = this.#manifest.grants.find((candidate) => candidate.workspaceId === workspaceId);
+        const grant = this.#grantFor(workspaceId);
         if (!grant)
             throw new WorkspaceAdmissionError('workspace_not_found');
         if (grant.ownerUserId !== ownerUserId)
@@ -212,15 +265,15 @@ export class WorkspaceAdmission {
             sessionId,
             ownerUserId,
             workspaceId: grant.workspaceId,
-            grantVersion: this.#manifest.version,
+            grantVersion,
             canonicalRoot,
             access: grant.access,
         };
-        this.#sessions.set(sessionId, binding);
+        this.#restored.set(sessionId, binding);
         return Object.freeze(binding);
     }
     getSession(sessionId, ownerUserId) {
-        const session = this.#sessions.get(sessionId);
+        const session = this.#sessions.get(sessionId) ?? this.#restored.get(sessionId);
         if (!session)
             throw new WorkspaceAdmissionError('session_not_found');
         if (session.ownerUserId !== ownerUserId)
@@ -238,6 +291,11 @@ export class WorkspaceAdmission {
     }
     remove(sessionId) {
         this.#sessions.delete(sessionId);
+        this.#restored.delete(sessionId);
+    }
+    #grantFor(workspaceId) {
+        return (this.#dynamicGrants.get(workspaceId) ??
+            this.#manifest.grants.find((candidate) => candidate.workspaceId === workspaceId));
     }
     static assertPath(binding, requestedPath) {
         if (!requestedPath || requestedPath.includes('\u0000') || path.isAbsolute(requestedPath)) {
@@ -259,6 +317,21 @@ export class WorkspaceAdmission {
         return resolved;
     }
 }
+export function validateDynamicGrant(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const grant = value;
+    return (typeof grant.workspaceId === 'string' &&
+        /^[A-Za-z0-9_-]{1,256}$/.test(grant.workspaceId) &&
+        typeof grant.ownerUserId === 'string' &&
+        grant.ownerUserId.length > 0 &&
+        isProvisionedLabel(grant.label) &&
+        grant.kind === 'local' &&
+        typeof grant.localRoot === 'string' &&
+        path.isAbsolute(grant.localRoot) &&
+        (grant.access === 'read' || grant.access === 'read_write') &&
+        grant.enabled === true);
+}
 function canonicalizeGrantRoot(grant) {
     if (!grant.localRoot)
         throw new WorkspaceAdmissionError('workspace_root_unavailable');

package/dist/gateway/workspace-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-admission.js","sourceRoot":"","sources":["../../source/gateway/workspace-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAeuB;IAEpC,YAAY,IAAqC;QAC/C,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,IAAK,SAAS,CAAC,OAAkB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1E,IACE,SAAS,CAAC,MAAM,KAAK,SAAS;QAC9B,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EACnF,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAiB;QACpC,MAAM;QACN,UAAU,EAAE,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC;QACpD,MAAM,EAAE,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,cAAuB;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,cAAc,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACtG,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,GAAgB;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC1B,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW;QAClB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;QAChC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QAChD,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC;QAC1D,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAElC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtG,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QAC/D,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5E,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAClF,UAAU,EAAE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC/E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC1C,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;YACzC,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS;YAEnC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QACxD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAc;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAC1G,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAkBD,MAAM,OAAO,kBAAkB;IACpB,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,SAAS,CAAkB;IAClB,SAAS,CAAU;IACnB,WAAW,CAAU;IACrB,cAAc,CAA0B;IAEjD,YAAY,QAAyB,EAAE,OAAO,GAAwC,EAAE;QACtF,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAChF,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,QAAyB;QACvC,IAAI,CAAC,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,WAAW,CAAC,WAAmB;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC;aAC/F,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,MAA8B,EAAE,wBAAwB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO;QACrF,IAAI,MAAM,CAAC,OAAO,KAAK,gBAAgB;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAClG,IAAI,wBAAwB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO;YACrD,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QACpG,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;YACvE,MAAM,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,OAAO,GAAmB;YAC9B,SAAS,EAAE,UAAU,EAAE;YACvB,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YACpC,aAAa;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAiB,EAAE,WAAmB,EAAE,WAAmB,EAAE,YAAoB;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;gBAC5E,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY;gBAAE,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,CAAC,CAAC;YAC1G,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,YAAY,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,CAAC,CAAC;QAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QACrG,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,aAAa;YACrD,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5E,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ;YAC9C,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,MAAM,OAAO,GAAmB;YAC9B,SAAS;YACT,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YACpC,aAAa;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,WAAmB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QACrG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sBAAsB,CAAC,SAAiB,EAAE,WAAmB,EAAE,WAAmB;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QACrG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,OAAuB,EAAE,aAAqB;QAC9D,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC9G,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,KAAqB;IAClD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IACtF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1G,CAAC"}
+{"version":3,"file":"workspace-admission.js","sourceRoot":"","sources":["../../source/gateway/workspace-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAeuB;IAEpC,YAAY,IAAqC;QAC/C,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,IAAK,SAAS,CAAC,OAAkB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1E,IACE,SAAS,CAAC,MAAM,KAAK,SAAS;QAC9B,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EACnF,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAiB;QACpC,MAAM;QACN,UAAU,EAAE,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC;QACpD,MAAM,EAAE,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,cAAuB;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,cAAc,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACtG,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,GAAgB;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC1B,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW;QAClB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;QAChC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QAChD,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC;QAC1D,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAElC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtG,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QAC/D,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACxD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5E,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAClF,UAAU,EAAE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC/E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC1C,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;YACzC,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS;YAEnC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QACxD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAc;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAC1G,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAuBD,MAAM,OAAO,kBAAkB;IAC7B,6FAA6F;IACpF,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,kFAAkF;IACzE,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5D,gBAAgB,GAAG,CAAC,CAAC;IACrB,SAAS,CAAkB;IAClB,SAAS,CAAU;IACnB,WAAW,CAAU;IACrB,cAAc,CAA0B;IACxC,qBAAqB,CAA+C;IAE7E,YAAY,QAAyB,EAAE,OAAO,GAAwC,EAAE;QACtF,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAChF,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,oBAAoB,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;YACxD,uEAAuE;YACvE,uEAAuE;YACvE,4BAA4B;YAC5B,IACE,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EACtF,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACxD,CAAC;IAED,eAAe,CAAC,QAAyB;QACvC,IAAI,CAAC,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,WAAW,CAAC,WAAmB;QAC7B,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;aAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC;aAC/F,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,8EAA8E;IAC9E,yBAAyB,CAAC,KAAqB;QAC7C,IACE,KAAK,CAAC,IAAI,KAAK,OAAO;YACtB,CAAC,KAAK,CAAC,SAAS;YAChB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;YACjC,CAAC,KAAK,CAAC,WAAW;YAClB,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACjD,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC;YAC1D,KAAK,CAAC,OAAO,KAAK,IAAI;YACtB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC9D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC3D,EACD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,uBAAuB,CAAC,WAAmB;QACzC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAA8B,EAAE,wBAAwB,GAAG,IAAI,CAAC,eAAe;QACnF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAC5E,OAAO,CAAC,MAA8B,EAAE,wBAAwB,GAAG,IAAI,CAAC,eAAe;QACrF,IAAI,MAAM,CAAC,OAAO,KAAK,gBAAgB;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAClG,IAAI,wBAAwB,KAAK,IAAI,CAAC,eAAe;YACnD,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QACpG,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;YACvE,MAAM,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,OAAO,GAAmB;YAC9B,SAAS,EAAE,UAAU,EAAE;YACvB,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,IAAI,CAAC,eAAe;YAClC,aAAa;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAiB,EAAE,WAAmB,EAAE,WAAmB,EAAE,YAAoB;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;gBAC5E,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY;gBAAE,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,CAAC,CAAC;YAC1G,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO;YAC9E,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;QACrG,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,aAAa;YACrD,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5E,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ;YAC9C,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,MAAM,OAAO,GAAmB;YAC9B,SAAS;YACT,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY;YACZ,aAAa;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,WAAmB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QACrG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sBAAsB,CAAC,SAAiB,EAAE,WAAmB,EAAE,WAAmB;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QACrG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,WAAmB;QAC3B,OAAO,CACL,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,OAAuB,EAAE,aAAqB;QAC9D,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC9G,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAuB,CAAC;IACtC,OAAO,CACL,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAChD,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAC5B,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;QAChC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC;QAC1D,KAAK,CAAC,OAAO,KAAK,IAAI,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAqB;IAClD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IACtF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1G,CAAC"}

package/dist/gateway/workspace-boundary-probe.d.ts

@@ -0,0 +1,18 @@
+import type { WorkspaceBoundaryProbe } from './workspace-admission.js';
+export type WorkspaceBoundaryProbeFs = {
+    realpathSync(path: string): string;
+    statSync(path: string): {
+        isDirectory(): boolean;
+    };
+    accessSync(path: string, mode: number): void;
+};
+/**
+ * Proves a local workspace using the canonical path and the OS user's access
+ * checks. The launcher policy is deliberately part of the probe: a writable
+ * filesystem is not a writable gateway grant when --allow-write is absent.
+ */
+export declare function createRealWorkspaceBoundaryProbe(options: {
+    allowWrite: boolean;
+    fs?: WorkspaceBoundaryProbeFs;
+}): WorkspaceBoundaryProbe;
+//# sourceMappingURL=workspace-boundary-probe.d.ts.map

package/dist/gateway/workspace-boundary-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-boundary-probe.d.ts","sourceRoot":"","sources":["../../source/gateway/workspace-boundary-probe.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA6B,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElG,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,WAAW,IAAI,OAAO,CAAA;KAAE,CAAC;IACnD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C,CAAC;AAIF;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,EAAE,CAAC,EAAE,wBAAwB,CAAC;CAC/B,GAAG,sBAAsB,CAiBzB"}