@rockhopper-co/mcp-server 2.1.34-staging.07e6531 → 2.1.36-staging.6dd7c1c

package/dist/api-client.d.ts

@@ -99,6 +99,33 @@ export declare class ApiClient {
      * denial sends them to fix the wrong thing.
      */
     setAuthExpiredHandler(handler: () => void): void;
+    /**
+     * ENG-2816 — a signing key for state that must survive a round trip through
+     * the client, derived from this session's credential and never the
+     * credential itself.
+     *
+     * **Why the token is the key material.** The 2026-07-28 confirmation lane
+     * hands the client a `requestState` string and reads it back on a SECOND
+     * request, and the gateway builds a fresh server per request across two
+     * production replicas (measured 2026-08-19: `rockhopper-production-mcp`
+     * runs `desiredCount: 2`). So nothing in process memory is there on the way
+     * back, and a shared secret is the only thing every replica already agrees
+     * on. The PAT is exactly that: the same session presents the same token to
+     * whichever replica answers, and a DIFFERENT principal derives a different
+     * key — which is the spec's user-binding requirement satisfied by
+     * construction rather than by a separate `bind` callback.
+     *
+     * **The token does not leave.** It is the HMAC key, so what the caller
+     * receives is a 32-byte digest and what the client eventually holds is a
+     * signature over a payload. Neither is invertible, and `token` stays
+     * private. `domain` separates one use from another so a key minted for the
+     * enrolment picker can never verify anything else.
+     *
+     * A rotated PAT invalidates a confirmation that is already in flight. That
+     * fails CLOSED — the pick is refused and the user searches again — which is
+     * the same answer this tool gives any state it cannot verify.
+     */
+    deriveStateKey(domain: string): Buffer;
     /**
      * KI-096: optional `responseSchema` validates the response shape with
      * zod. When supplied, drift between backend's actual response and the

package/dist/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,6BAA6B,EAC7B,cAAc,EACd,aAAa,EACb,YAAY,EACZ,IAAI,EACJ,kBAAkB,EAClB,WAAW,EACX,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AA8BpB,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE;QAClB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0EAA0E;QAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,mEAAmE;QACnE,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE7B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;CAQzB;AAsBD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,sBAAsB,CAAgB;IAC9C,OAAO,CAAC,kBAAkB,CAAC,CAAa;IACxC,OAAO,CAAC,mBAAmB,CAAS;gBAExB,MAAM,EAAE,eAAe;IAUnC;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIhD;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI;IAIhD;;;;;;;OAOG;YACW,OAAO;IAmJf,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC;IAMnC;;;;;;;;;;OAUG;IACG,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAOzD,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIhD,eAAe,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IASvE;;;;;OAKG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5C,iBAAiB,CAAC,MAAM,CAAC,EAAE;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;KACpD,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAUrB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM9D;;;;;;;;;;;;;;;;;;OAkBG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAC7B,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,gBAAgB,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUhC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,kBAAkB,CAAC,MAAM,CAAC,EAAE;QAChC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QACtC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;WAKG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAanC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOpE;;;;;;;;OAQG;IACG,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAO5E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,kBAAkB,CAAC,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO7B;;;;;;;;OAQG;IACG,oBAAoB,CACxB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACvD,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAAC,gBAAgB,CAAC;IAYtB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzD,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAMrE;;;;;OAKG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ1D;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAexB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI7C,aAAa,CAAC,IAAI,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOf,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,QAAQ,CAAC;IAOpB;;;;;;;OAOG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAajD,oBAAoB,CACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,EAAE,CAAC;IAMrB,0BAA0B,CAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,EAAE,CAAC;IAMrB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAInD,mBAAmB,CACvB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,EAAE,CAAC;IAM5B;;;;;;OAMG;IACG,mBAAmB,CAAC,IAAI,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,YAAY,EAAE,CAAC;KAC7B,GAAG,OAAO,CAAC,aAAa,CAAC;IAOpB,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACvB,OAAO,CAAC,aAAa,CAAC;IAYzB;;;;;;OAMG;IACG,6BAA6B,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAOhC;;;;;;;;;;;;OAYG;IACG,+BAA+B,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,6BAA6B,CAAC;IAQnC,aAAa,CAAC,IAAI,EAAE;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,OAAO,EAAE;YACP,YAAY,EAAE,MAAM,CAAC;YACrB,YAAY,EAAE,MAAM,CAAC;YACrB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,GAAG,OAAO,CAAC,WAAW,CAAC;IAOlB,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,WAAW,CAAC;IAYjB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAS5D;;;;;;;OAOG;IACG,kBAAkB,CACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACtB,OAAO,CAAC,YAAY,CAAC;CAUzB"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,6BAA6B,EAC7B,cAAc,EACd,aAAa,EACb,YAAY,EACZ,IAAI,EACJ,kBAAkB,EAClB,WAAW,EACX,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AA8BpB,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE;QAClB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0EAA0E;QAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,mEAAmE;QACnE,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE7B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;CAQzB;AAsBD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,sBAAsB,CAAgB;IAC9C,OAAO,CAAC,kBAAkB,CAAC,CAAa;IACxC,OAAO,CAAC,mBAAmB,CAAS;gBAExB,MAAM,EAAE,eAAe;IAUnC;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIhD;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI;IAIhD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAItC;;;;;;;OAOG;YACW,OAAO;IAmJf,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC;IAMnC;;;;;;;;;;OAUG;IACG,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAOzD,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIhD,eAAe,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IASvE;;;;;OAKG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5C,iBAAiB,CAAC,MAAM,CAAC,EAAE;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;KACpD,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAUrB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM9D;;;;;;;;;;;;;;;;;;OAkBG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAC7B,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,gBAAgB,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUhC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,kBAAkB,CAAC,MAAM,CAAC,EAAE;QAChC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QACtC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;WAKG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAanC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOpE;;;;;;;;OAQG;IACG,iBAAiB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAO5E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,kBAAkB,CAAC,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO7B;;;;;;;;OAQG;IACG,oBAAoB,CACxB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACvD,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAAC,gBAAgB,CAAC;IAYtB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzD,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAMrE;;;;;OAKG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ1D;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAexB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI7C,aAAa,CAAC,IAAI,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOf,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,QAAQ,CAAC;IAOpB;;;;;;;OAOG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAajD,oBAAoB,CACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,EAAE,CAAC;IAMrB,0BAA0B,CAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,EAAE,CAAC;IAMrB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAInD,mBAAmB,CACvB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,EAAE,CAAC;IAM5B;;;;;;OAMG;IACG,mBAAmB,CAAC,IAAI,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,YAAY,EAAE,CAAC;KAC7B,GAAG,OAAO,CAAC,aAAa,CAAC;IAOpB,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACvB,OAAO,CAAC,aAAa,CAAC;IAYzB;;;;;;OAMG;IACG,6BAA6B,CACjC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAOhC;;;;;;;;;;;;OAYG;IACG,+BAA+B,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,6BAA6B,CAAC;IAQnC,aAAa,CAAC,IAAI,EAAE;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,OAAO,EAAE;YACP,YAAY,EAAE,MAAM,CAAC;YACrB,YAAY,EAAE,MAAM,CAAC;YACrB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,GAAG,OAAO,CAAC,WAAW,CAAC;IAOlB,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,WAAW,CAAC;IAYjB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAS5D;;;;;;;OAOG;IACG,kBAAkB,CACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACtB,OAAO,CAAC,YAAY,CAAC;CAUzB"}

package/dist/api-client.js

@@ -1,4 +1,4 @@
-import { randomUUID } from 'node:crypto';
+import { createHmac, randomUUID } from 'node:crypto';
 import { getCorrelationId } from './correlation.js';
 import { log } from './logger.js';
 import { CellHistoryEntryArraySchema, EnrolledFileSchema, FileChatSchema, FoldStatusSchema, } from './zod-schemas.js';
@@ -125,6 +125,35 @@ export class ApiClient {
     setAuthExpiredHandler(handler) {
         this.authExpiredHandler = handler;
     }
+    /**
+     * ENG-2816 — a signing key for state that must survive a round trip through
+     * the client, derived from this session's credential and never the
+     * credential itself.
+     *
+     * **Why the token is the key material.** The 2026-07-28 confirmation lane
+     * hands the client a `requestState` string and reads it back on a SECOND
+     * request, and the gateway builds a fresh server per request across two
+     * production replicas (measured 2026-08-19: `rockhopper-production-mcp`
+     * runs `desiredCount: 2`). So nothing in process memory is there on the way
+     * back, and a shared secret is the only thing every replica already agrees
+     * on. The PAT is exactly that: the same session presents the same token to
+     * whichever replica answers, and a DIFFERENT principal derives a different
+     * key — which is the spec's user-binding requirement satisfied by
+     * construction rather than by a separate `bind` callback.
+     *
+     * **The token does not leave.** It is the HMAC key, so what the caller
+     * receives is a 32-byte digest and what the client eventually holds is a
+     * signature over a payload. Neither is invertible, and `token` stays
+     * private. `domain` separates one use from another so a key minted for the
+     * enrolment picker can never verify anything else.
+     *
+     * A rotated PAT invalidates a confirmation that is already in flight. That
+     * fails CLOSED — the pick is refused and the user searches again — which is
+     * the same answer this tool gives any state it cannot verify.
+     */
+    deriveStateKey(domain) {
+        return createHmac('sha256', this.token).update(domain).digest();
+    }
     /**
      * KI-096: optional `responseSchema` validates the response shape with
      * zod. When supplied, drift between backend's actual response and the

package/dist/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAwBlC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,QAE/B;IACC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAC5C,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,2BAA2B,CAAC;AAClC,CAAC;AAmCD;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACxB;;;;;;;;OAQG;IACM,IAAI,CAAgB;IAC7B;;;;;;;;;;OAUG;IACM,MAAM,CAAgB;IAC/B,YACE,MAAc,EACd,OAAe,EACf,IAAoB,EACpB,MAAsB;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,KAAwB;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,KAAK,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,OAAO,SAAS;IACH,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,aAAa,CAAU;IACvB,OAAO,CAAS;IAChB,SAAS,CAAS;IAC3B,sBAAsB,CAAgB;IACtC,kBAAkB,CAAc;IAChC,mBAAmB,GAAG,KAAK,CAAC;IAEpC,YAAY,MAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,iBAAiB,EAAE,OAAO,IAAI,KAAK,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,SAAS,IAAI,UAAU,EAAE,CAAC;QACrE,IAAI,CAAC,sBAAsB;YACzB,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,IAAI,IAAI,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,UAAyB;QACvC,IAAI,CAAC,sBAAsB,GAAG,UAAU,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,OAAmB;QACvC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,OAAO,CACnB,IAAY,EACZ,IAAkB,EAClB,cAA2B;QAE3B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,wEAAwE;QACxE,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;oBACrC,cAAc,EAAE,kBAAkB;oBAClC,gEAAgE;oBAChE,oEAAoE;oBACpE,mEAAmE;oBACnE,oEAAoE;oBACpE,kBAAkB,EAChB,IAAI,CAAC,aAAa,IAAI,gBAAgB,EAAE,IAAI,UAAU,EAAE;oBAC1D,4DAA4D;oBAC5D,iEAAiE;oBACjE,kEAAkE;oBAClE,iEAAiE;oBACjE,4DAA4D;oBAC5D,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;wBAC3B,CAAC,CAAC;4BACE,sBAAsB,EAAE,IAAI,CAAC,OAAO;4BACpC,yBAAyB,EAAE,IAAI,CAAC,SAAS;4BACzC,GAAG,CAAC,IAAI,CAAC,sBAAsB;gCAC7B,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,sBAAsB,EAAE;gCACpD,CAAC,CAAC,EAAE,CAAC;yBACR;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,IAAI,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,CAAC,KAAK,CACP,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,EACzF,iBAAiB,CAClB,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,kEAAkE;YAClE,uCAAuC;YACvC,qEAAqE;YACrE,kEAAkE;YAClE,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;YACpE,MAAM,cAAc,GAClB,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAChD,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,QAAQ;oBACR,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,YAAY,CAAC;YACrB,GAAG,CAAC,IAAI,CACN;gBACE,KAAK,EAAE,oBAAoB;gBAC3B,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU;gBACV,cAAc;aACf,EACD,oBAAoB,CACrB,CAAC;YACF,oDAAoD;YACpD,yEAAyE;YACzE,yDAAyD;YACzD,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,IAAI,CAAC,kBAAkB;gBACvB,CAAC,IAAI,CAAC,mBAAmB,EACzB,CAAC;gBACD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBAChC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAA0B,CAAC;oBACnC,MAAM,EAAE,iBAAiB;oBACzB,iBAAiB,EAAE,sBAAsB,CAAC,QAAQ,CAAC;oBACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,OAAO,QAAQ,EAAE;iBACnE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,QAAQ,CAAC,MAAM,EACf,kBAAkB,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,MAAM,IAAI,EAAE,EACrE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAC7B,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAChC,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,EACrF,aAAa,CACd,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,kEAAkE;gBAClE,8DAA8D;gBAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrC,oEAAoE;gBACpE,iEAAiE;gBACjE,8CAA8C;gBAC9C,GAAG,CAAC,IAAI,CACN;oBACE,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ;oBACxC,GAAG,EAAE,KAAK,EAAE,OAAO;iBACpB,EACD,0BAA0B,CAC3B,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,IAAI;oBACxD,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,KAAK,EAAE,OAAO,GAAG;oBAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,kBAAkB,CACnD,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,gBAAgB;IAEhB,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,0CAA0C;IAE1C;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB;QACzB,OAAO,IAAI,CAAC,OAAO,CAA0B,yBAAyB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAsB,sBAAsB,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CACjB,sBAAsB,EACtB,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;IACJ,CAAC;IAED,gBAAgB;IAEhB;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAO,UAAU,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,EAAE,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CACjB,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAe,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,+CAA+C;IAE/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAItB;QACC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,OAAO,CACjB,uBAAuB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAUxB;QACC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,EAAE,UAAU;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,MAAM,EAAE,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CACjB,yBAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,0CAA0C;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,OAAO,IAAI,CAAC,OAAO,CAAkB,6BAA6B,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAwB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAmB,2BAA2B,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAIxB;QACC,OAAO,IAAI,CAAC,OAAO,CAAmB,iBAAiB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,oBAAoB,CACxB,IAAuD,EACvD,kBAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAAmB,uBAAuB,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;gBAC9C,kBAAkB,EAAE,CAAC,GAAG,kBAAkB,CAAC;aAC5C,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IAExB,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAgB,uBAAuB,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,iBAAyB;QAC5C,OAAO,IAAI,CAAC,OAAO,CACjB,+BAA+B,iBAAiB,EAAE,CACnD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CACjB,uBAAuB,QAAQ,cAAc,EAC7C,SAAS,EACT,gBAAkD,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,SAAiB,EACjB,WAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YAChC,IAAI,EAAE,WAAW;YACjB,SAAS;YACT,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CACjB,uBAAuB,QAAQ,iBAAiB,KAAK,EAAE,EACvD,SAAS,EACT,2BAAqE,CACtE,CAAC;IACJ,CAAC;IAED,+BAA+B;IAE/B,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAa,cAAc,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAW,qBAAqB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAKnB;QACC,OAAO,IAAI,CAAC,OAAO,CAAW,YAAY,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,IAAoD;QAEpD,OAAO,IAAI,CAAC,OAAO,CAAW,cAAc,MAAM,UAAU,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,OAAO,IAAI,CAAC,OAAO,CACjB,cAAc,MAAM,EAAE,EACtB;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACzC,EACD,cAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,kBAAkB;IAElB,KAAK,CAAC,oBAAoB,CACxB,SAAiB;QAEjB,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,SAAS,WAAW,CAC1C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,QAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CACjB,kBAAkB,QAAQ,0BAA0B,CACrD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAgB,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,QAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,QAAQ,aAAa,CAC3C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,IAKzB;QACC,OAAO,IAAI,CAAC,OAAO,CAAgB,mBAAmB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,IAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,QAAQ,UAAU,EACvC;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CACF,CAAC;IACJ,CAAC;IAED,+BAA+B;IAE/B;;;;;;OAMG;IACH,KAAK,CAAC,6BAA6B,CACjC,QAAgB,EAChB,SAAiB;QAEjB,MAAM,IAAI,GAAG,yBAAyB,QAAQ,IAAI,kBAAkB,CAClE,SAAS,CACV,EAAE,CAAC;QACJ,OAAO,IAAI,CAAC,OAAO,CAAuB,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,+BAA+B,CACnC,QAAgB,EAChB,MAAe;QAEf,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,mCAAmC,QAAQ,GAAG,EAAE,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,OAAO,CAAgC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,aAAa,CAAC,IAQnB;QACC,OAAO,IAAI,CAAC,OAAO,CAAc,gBAAgB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,IAA6B;QAE7B,OAAO,IAAI,CAAC,OAAO,CACjB,oCAAoC,QAAQ,EAAE,EAC9C;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CACF,CAAC;IACJ,CAAC;IAED,2BAA2B;IAE3B,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAgB,qBAAqB,QAAQ,EAAE,EAAE;YAClE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAE/B;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,QAAgB,EAChB,IAAuB;QAEvB,OAAO,IAAI,CAAC,OAAO,CACjB,mBAAmB,QAAQ,EAAE,EAC7B;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,EACD,kBAAsD,CACvD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAwBlC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,QAE/B;IACC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,2BAA2B,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAC5C,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,2BAA2B,CAAC;AAClC,CAAC;AAmCD;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACxB;;;;;;;;OAQG;IACM,IAAI,CAAgB;IAC7B;;;;;;;;;;OAUG;IACM,MAAM,CAAgB;IAC/B,YACE,MAAc,EACd,OAAe,EACf,IAAoB,EACpB,MAAsB;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,KAAwB;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,KAAK,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,OAAO,SAAS;IACH,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,aAAa,CAAU;IACvB,OAAO,CAAS;IAChB,SAAS,CAAS;IAC3B,sBAAsB,CAAgB;IACtC,kBAAkB,CAAc;IAChC,mBAAmB,GAAG,KAAK,CAAC;IAEpC,YAAY,MAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,iBAAiB,EAAE,OAAO,IAAI,KAAK,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,SAAS,IAAI,UAAU,EAAE,CAAC;QACrE,IAAI,CAAC,sBAAsB;YACzB,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,IAAI,IAAI,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,UAAyB;QACvC,IAAI,CAAC,sBAAsB,GAAG,UAAU,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,OAAmB;QACvC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,MAAc;QAC3B,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,OAAO,CACnB,IAAY,EACZ,IAAkB,EAClB,cAA2B;QAE3B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,wEAAwE;QACxE,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;oBACrC,cAAc,EAAE,kBAAkB;oBAClC,gEAAgE;oBAChE,oEAAoE;oBACpE,mEAAmE;oBACnE,oEAAoE;oBACpE,kBAAkB,EAChB,IAAI,CAAC,aAAa,IAAI,gBAAgB,EAAE,IAAI,UAAU,EAAE;oBAC1D,4DAA4D;oBAC5D,iEAAiE;oBACjE,kEAAkE;oBAClE,iEAAiE;oBACjE,4DAA4D;oBAC5D,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;wBAC3B,CAAC,CAAC;4BACE,sBAAsB,EAAE,IAAI,CAAC,OAAO;4BACpC,yBAAyB,EAAE,IAAI,CAAC,SAAS;4BACzC,GAAG,CAAC,IAAI,CAAC,sBAAsB;gCAC7B,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,sBAAsB,EAAE;gCACpD,CAAC,CAAC,EAAE,CAAC;yBACR;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,IAAI,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,CAAC,KAAK,CACP,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,EACzF,iBAAiB,CAClB,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,kEAAkE;YAClE,uCAAuC;YACvC,qEAAqE;YACrE,kEAAkE;YAClE,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;YACpE,MAAM,cAAc,GAClB,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAChD,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,QAAQ;oBACR,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,YAAY,CAAC;YACrB,GAAG,CAAC,IAAI,CACN;gBACE,KAAK,EAAE,oBAAoB;gBAC3B,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU;gBACV,cAAc;aACf,EACD,oBAAoB,CACrB,CAAC;YACF,oDAAoD;YACpD,yEAAyE;YACzE,yDAAyD;YACzD,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,IAAI,CAAC,kBAAkB;gBACvB,CAAC,IAAI,CAAC,mBAAmB,EACzB,CAAC;gBACD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBAChC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAA0B,CAAC;oBACnC,MAAM,EAAE,iBAAiB;oBACzB,iBAAiB,EAAE,sBAAsB,CAAC,QAAQ,CAAC;oBACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,OAAO,QAAQ,EAAE;iBACnE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,QAAQ,CAAC,MAAM,EACf,kBAAkB,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,MAAM,IAAI,EAAE,EACrE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAC7B,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAChC,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,EACrF,aAAa,CACd,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,kEAAkE;gBAClE,8DAA8D;gBAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrC,oEAAoE;gBACpE,iEAAiE;gBACjE,8CAA8C;gBAC9C,GAAG,CAAC,IAAI,CACN;oBACE,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ;oBACxC,GAAG,EAAE,KAAK,EAAE,OAAO;iBACpB,EACD,0BAA0B,CAC3B,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,IAAI;oBACxD,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,KAAK,EAAE,OAAO,GAAG;oBAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,kBAAkB,CACnD,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,gBAAgB;IAEhB,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,0CAA0C;IAE1C;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB;QACzB,OAAO,IAAI,CAAC,OAAO,CAA0B,yBAAyB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAsB,sBAAsB,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CACjB,sBAAsB,EACtB,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;IACJ,CAAC;IAED,gBAAgB;IAEhB;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAO,UAAU,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,EAAE,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CACjB,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAe,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,+CAA+C;IAE/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAItB;QACC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,OAAO,CACjB,uBAAuB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAUxB;QACC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,EAAE,UAAU;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,MAAM,EAAE,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CACjB,yBAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,0CAA0C;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,OAAO,IAAI,CAAC,OAAO,CAAkB,6BAA6B,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAwB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAmB,2BAA2B,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAIxB;QACC,OAAO,IAAI,CAAC,OAAO,CAAmB,iBAAiB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,oBAAoB,CACxB,IAAuD,EACvD,kBAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAAmB,uBAAuB,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;gBAC9C,kBAAkB,EAAE,CAAC,GAAG,kBAAkB,CAAC;aAC5C,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IAExB,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAgB,uBAAuB,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,iBAAyB;QAC5C,OAAO,IAAI,CAAC,OAAO,CACjB,+BAA+B,iBAAiB,EAAE,CACnD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CACjB,uBAAuB,QAAQ,cAAc,EAC7C,SAAS,EACT,gBAAkD,CACnD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,SAAiB,EACjB,WAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YAChC,IAAI,EAAE,WAAW;YACjB,SAAS;YACT,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CACjB,uBAAuB,QAAQ,iBAAiB,KAAK,EAAE,EACvD,SAAS,EACT,2BAAqE,CACtE,CAAC;IACJ,CAAC;IAED,+BAA+B;IAE/B,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAa,cAAc,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAW,qBAAqB,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAKnB;QACC,OAAO,IAAI,CAAC,OAAO,CAAW,YAAY,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,IAAoD;QAEpD,OAAO,IAAI,CAAC,OAAO,CAAW,cAAc,MAAM,UAAU,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,OAAO,IAAI,CAAC,OAAO,CACjB,cAAc,MAAM,EAAE,EACtB;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACzC,EACD,cAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,kBAAkB;IAElB,KAAK,CAAC,oBAAoB,CACxB,SAAiB;QAEjB,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,SAAS,WAAW,CAC1C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,QAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CACjB,kBAAkB,QAAQ,0BAA0B,CACrD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAgB,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,QAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,QAAQ,aAAa,CAC3C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,IAKzB;QACC,OAAO,IAAI,CAAC,OAAO,CAAgB,mBAAmB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,IAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CACjB,qBAAqB,QAAQ,UAAU,EACvC;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CACF,CAAC;IACJ,CAAC;IAED,+BAA+B;IAE/B;;;;;;OAMG;IACH,KAAK,CAAC,6BAA6B,CACjC,QAAgB,EAChB,SAAiB;QAEjB,MAAM,IAAI,GAAG,yBAAyB,QAAQ,IAAI,kBAAkB,CAClE,SAAS,CACV,EAAE,CAAC;QACJ,OAAO,IAAI,CAAC,OAAO,CAAuB,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,+BAA+B,CACnC,QAAgB,EAChB,MAAe;QAEf,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,mCAAmC,QAAQ,GAAG,EAAE,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,OAAO,CAAgC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,aAAa,CAAC,IAQnB;QACC,OAAO,IAAI,CAAC,OAAO,CAAc,gBAAgB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,IAA6B;QAE7B,OAAO,IAAI,CAAC,OAAO,CACjB,oCAAoC,QAAQ,EAAE,EAC9C;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CACF,CAAC;IACJ,CAAC;IAED,2BAA2B;IAE3B,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAgB,qBAAqB,QAAQ,EAAE,EAAE;YAClE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAE/B;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,QAAgB,EAChB,IAAuB;QAEvB,OAAO,IAAI,CAAC,OAAO,CACjB,mBAAmB,QAAQ,EAAE,EAC7B;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,EACD,kBAAsD,CACvD,CAAC;IACJ,CAAC;CACF"}

package/dist/drive-search.d.ts

@@ -19,11 +19,14 @@
  *
  * 1. {@link SearchBudget} is a HARD per-session ceiling on how many times the
  *    drive can be searched at all.
- * 2. {@link CandidateRegistry} means a confirmation can only ever name a file
- *    THIS session's search actually returned. The confirmed pick is looked up
- *    in server memory by a nonce; nothing that arrives from the client is
- *    trusted to describe a file.
+ * 2. {@link createConfirmationCodec} means a confirmation can only ever name a
+ *    file THIS session's search actually returned. The candidate set rides the
+ *    round trip under an HMAC keyed on the session's own credential and is
+ *    verified fail-closed; nothing the client merely ASSERTS about a file is
+ *    trusted.
  */
+import { type RequestStateCodec } from '@modelcontextprotocol/server';
+import { type ApiClient } from './api-client.js';
 import type { DriveSearchItem } from './types.js';
 /**
  * Searches one session may run, total.
@@ -120,36 +123,51 @@ export interface Candidate {
     enrollmentState: DriveSearchItem['enrollmentState'];
 }
 /**
- * The candidate sets THIS session has actually seen, keyed by a nonce.
+ * How long a confirmation stays answerable, in seconds.
  *
- * Why server memory rather than the round-trip. The 2026-07-28 confirmation
- * lane hands the client a `requestState` string and gets it back on retry, and
- * the SDK is explicit that the returned value is attacker-controlled: it
- * travels through the client, nothing signs it, and `requestState()` hands
- * back whatever came in. Putting the candidate list in there would mean a
- * confirmation could describe ANY file — including one Microsoft never
- * returned for this user — and the tool would then hand its identifiers to
- * `enroll_file`. So the wire carries a lookup key and nothing else, and the
- * files it can name are only ever the ones {@link remember} was given.
+ * Long enough that a person can read ten rows, open a workbook to check, and
+ * come back; short enough that a captured prompt is not answerable tomorrow.
+ * Past it the pick is refused rather than resolved, and the remedy printed by
+ * {@link unknownCandidateAnswer} — search again and confirm against the list
+ * that comes back — is the right one for an expiry as well as for a forgery.
+ */
+export declare const CONFIRMATION_TTL_SECONDS = 1800;
+/**
+ * The candidate set a confirmation is answering, sealed for the round trip.
+ *
+ * **ENG-2816 — why this is signed state and no longer a server-memory Map.**
+ * The original design kept the candidate sets in a per-server `Map` keyed by a
+ * nonce, and put only the nonce on the wire, reasoning that a confirmation
+ * must resolve against something the client cannot author. The reasoning was
+ * right and the CARRIER was wrong: a confirmation is a SECOND request, the
+ * gateway builds a fresh server per request (`mcp-handler.ts` — "Stateless and
+ * per-request"), and production runs two replicas. So the Map that held the
+ * answer had already been discarded by the time the answer arrived, and every
+ * confirmation over the gateway resolved to nothing and was refused as
+ * `unknown_candidate`. It never worked once in the deployed serving; the specs
+ * missed it because a test reuses one server for both rounds.
  *
- * Bounded because a long-lived stdio session is a long-lived process: only the
- * most recent {@link MAX_REMEMBERED} sets are kept.
+ * The security property is unchanged, not relaxed. The wire value is
+ * HMAC-SHA256 over the payload under a key derived from this session's own
+ * credential ({@link ApiClient.deriveStateKey}), verified fail-closed before
+ * the candidates are read. A model that has read a hostile file name still
+ * cannot conjure a `driveMsId` and have this tool bless it — it would have to
+ * forge a signature — and a different principal derives a different key, so
+ * one session's confirmation cannot be replayed into another's.
+ *
+ * Signed, NOT encrypted: the client can decode and read the payload. That is
+ * acceptable here and only here — the payload is the candidate list this same
+ * user was just shown on screen. Never put anything else in it.
  */
-export declare class CandidateRegistry {
-    static readonly MAX_REMEMBERED = 8;
-    private readonly sets;
-    remember(nonce: string, candidates: readonly Candidate[]): void;
-    /**
-     * The candidate this session offered under `nonce` at `index`, or `null`.
-     *
-     * `null` for an unknown nonce and for an out-of-range index alike: both mean
-     * the confirmation is describing something this session did not offer, and
-     * the caller's answer to that is the same refusal.
-     */
-    resolve(nonce: string, index: number): Candidate | null;
-    /** The set offered under `nonce`, for re-rendering the question on retry. */
-    recall(nonce: string): readonly Candidate[] | null;
-}
+export declare function createConfirmationCodec(api: Pick<ApiClient, 'deriveStateKey'>): RequestStateCodec<readonly Candidate[]>;
+/**
+ * The candidate at a 0-based position, or `null`.
+ *
+ * `null` for a non-integer and for an out-of-range index alike: both mean the
+ * confirmation is describing something this search did not offer, and the
+ * caller's answer to that is the same refusal.
+ */
+export declare function candidateAt(candidates: readonly Candidate[], index: number): Candidate | null;
 /** Turn a backend item into a candidate, dropping fields nothing renders. */
 export declare function toCandidate(item: DriveSearchItem): Candidate;
 export interface ClassifiedSearchFailure {

package/dist/drive-search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drive-search.d.ts","sourceRoot":"","sources":["../src/drive-search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,kFAAkF;AAClF,MAAM,MAAM,kBAAkB;AAC5B,0EAA0E;AACxE,YAAY;AACd,qDAAqD;GACnD,YAAY;AACd,+EAA+E;GAC7E,WAAW;AACb;;;;GAIG;GACD,UAAU;AACZ;;;;;;;;;GASG;GACD,WAAW;AACb;;;GAGG;GACD,eAAe;AACjB,8EAA8E;GAC5E,sBAAsB;AACxB,wEAAwE;GACtE,yBAAyB;AAC3B;;;;;;GAMG;GACD,mCAAmC;AACrC,uEAAuE;GACrE,oBAAoB;AACtB,mEAAmE;GACjE,qBAAqB;AACvB,0EAA0E;GACxE,mBAAmB,CAAC;AAExB;;;;;;GAMG;AACH,qBAAa,YAAY;IAGX,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,IAAI,CAAK;gBAEY,KAAK,GAAE,MAAoC;IAExE,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED;;;;OAIG;IACH,KAAK,IAAI,OAAO;CAKjB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,iBAAiB;IAC5B,MAAM,CAAC,QAAQ,CAAC,cAAc,KAAK;IAEnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2C;IAEhE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI;IAS/D;;;;;;OAMG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IASvD,6EAA6E;IAC7E,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,SAAS,EAAE,GAAG,IAAI;CAGnD;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,CAS5D;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,uBAAuB,CAiCzB;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI1D;AAcD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI9D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,QAQuB,CAAC"}
+{"version":3,"file":"drive-search.d.ts","sourceRoot":"","sources":["../src/drive-search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,kFAAkF;AAClF,MAAM,MAAM,kBAAkB;AAC5B,0EAA0E;AACxE,YAAY;AACd,qDAAqD;GACnD,YAAY;AACd,+EAA+E;GAC7E,WAAW;AACb;;;;GAIG;GACD,UAAU;AACZ;;;;;;;;;GASG;GACD,WAAW;AACb;;;GAGG;GACD,eAAe;AACjB,8EAA8E;GAC5E,sBAAsB;AACxB,wEAAwE;GACtE,yBAAyB;AAC3B;;;;;;GAMG;GACD,mCAAmC;AACrC,uEAAuE;GACrE,oBAAoB;AACtB,mEAAmE;GACjE,qBAAqB;AACvB,0EAA0E;GACxE,mBAAmB,CAAC;AAExB;;;;;;GAMG;AACH,qBAAa,YAAY;IAGX,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,IAAI,CAAK;gBAEY,KAAK,GAAE,MAAoC;IAExE,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED;;;;OAIG;IACH,KAAK,IAAI,OAAO;CAKjB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;CACrD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAK7C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,GACrC,iBAAiB,CAAC,SAAS,SAAS,EAAE,CAAC,CAKzC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,KAAK,EAAE,MAAM,GACZ,SAAS,GAAG,IAAI,CAKlB;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,CAS5D;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,uBAAuB,CAiCzB;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI1D;AAcD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI9D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,QAQuB,CAAC"}

package/dist/drive-search.js

@@ -19,11 +19,13 @@
  *
  * 1. {@link SearchBudget} is a HARD per-session ceiling on how many times the
  *    drive can be searched at all.
- * 2. {@link CandidateRegistry} means a confirmation can only ever name a file
- *    THIS session's search actually returned. The confirmed pick is looked up
- *    in server memory by a nonce; nothing that arrives from the client is
- *    trusted to describe a file.
+ * 2. {@link createConfirmationCodec} means a confirmation can only ever name a
+ *    file THIS session's search actually returned. The candidate set rides the
+ *    round trip under an HMAC keyed on the session's own credential and is
+ *    verified fail-closed; nothing the client merely ASSERTS about a file is
+ *    trusted.
  */
+import { createRequestStateCodec, } from '@modelcontextprotocol/server';
 import { RockhopperApiError } from './api-client.js';
 /**
  * Searches one session may run, total.
@@ -74,53 +76,62 @@ export class SearchBudget {
     }
 }
 /**
- * The candidate sets THIS session has actually seen, keyed by a nonce.
+ * How long a confirmation stays answerable, in seconds.
  *
- * Why server memory rather than the round-trip. The 2026-07-28 confirmation
- * lane hands the client a `requestState` string and gets it back on retry, and
- * the SDK is explicit that the returned value is attacker-controlled: it
- * travels through the client, nothing signs it, and `requestState()` hands
- * back whatever came in. Putting the candidate list in there would mean a
- * confirmation could describe ANY file — including one Microsoft never
- * returned for this user — and the tool would then hand its identifiers to
- * `enroll_file`. So the wire carries a lookup key and nothing else, and the
- * files it can name are only ever the ones {@link remember} was given.
+ * Long enough that a person can read ten rows, open a workbook to check, and
+ * come back; short enough that a captured prompt is not answerable tomorrow.
+ * Past it the pick is refused rather than resolved, and the remedy printed by
+ * {@link unknownCandidateAnswer} — search again and confirm against the list
+ * that comes back — is the right one for an expiry as well as for a forgery.
+ */
+export const CONFIRMATION_TTL_SECONDS = 1800;
+/** Domain separator, so this key can never verify some other feature's state. */
+const CONFIRMATION_KEY_DOMAIN = 'rockhopper.drive-search.confirmation.v1';
+/**
+ * The candidate set a confirmation is answering, sealed for the round trip.
+ *
+ * **ENG-2816 — why this is signed state and no longer a server-memory Map.**
+ * The original design kept the candidate sets in a per-server `Map` keyed by a
+ * nonce, and put only the nonce on the wire, reasoning that a confirmation
+ * must resolve against something the client cannot author. The reasoning was
+ * right and the CARRIER was wrong: a confirmation is a SECOND request, the
+ * gateway builds a fresh server per request (`mcp-handler.ts` — "Stateless and
+ * per-request"), and production runs two replicas. So the Map that held the
+ * answer had already been discarded by the time the answer arrived, and every
+ * confirmation over the gateway resolved to nothing and was refused as
+ * `unknown_candidate`. It never worked once in the deployed serving; the specs
+ * missed it because a test reuses one server for both rounds.
+ *
+ * The security property is unchanged, not relaxed. The wire value is
+ * HMAC-SHA256 over the payload under a key derived from this session's own
+ * credential ({@link ApiClient.deriveStateKey}), verified fail-closed before
+ * the candidates are read. A model that has read a hostile file name still
+ * cannot conjure a `driveMsId` and have this tool bless it — it would have to
+ * forge a signature — and a different principal derives a different key, so
+ * one session's confirmation cannot be replayed into another's.
  *
- * Bounded because a long-lived stdio session is a long-lived process: only the
- * most recent {@link MAX_REMEMBERED} sets are kept.
+ * Signed, NOT encrypted: the client can decode and read the payload. That is
+ * acceptable here and only here — the payload is the candidate list this same
+ * user was just shown on screen. Never put anything else in it.
  */
-export class CandidateRegistry {
-    static MAX_REMEMBERED = 8;
-    sets = new Map();
-    remember(nonce, candidates) {
-        this.sets.set(nonce, candidates);
-        while (this.sets.size > CandidateRegistry.MAX_REMEMBERED) {
-            const oldest = this.sets.keys().next().value;
-            if (oldest === undefined)
-                break;
-            this.sets.delete(oldest);
-        }
-    }
-    /**
-     * The candidate this session offered under `nonce` at `index`, or `null`.
-     *
-     * `null` for an unknown nonce and for an out-of-range index alike: both mean
-     * the confirmation is describing something this session did not offer, and
-     * the caller's answer to that is the same refusal.
-     */
-    resolve(nonce, index) {
-        const set = this.sets.get(nonce);
-        if (!set)
-            return null;
-        if (!Number.isInteger(index) || index < 0 || index >= set.length) {
-            return null;
-        }
-        return set[index];
-    }
-    /** The set offered under `nonce`, for re-rendering the question on retry. */
-    recall(nonce) {
-        return this.sets.get(nonce) ?? null;
+export function createConfirmationCodec(api) {
+    return createRequestStateCodec({
+        key: api.deriveStateKey(CONFIRMATION_KEY_DOMAIN),
+        ttlSeconds: CONFIRMATION_TTL_SECONDS,
+    });
+}
+/**
+ * The candidate at a 0-based position, or `null`.
+ *
+ * `null` for a non-integer and for an out-of-range index alike: both mean the
+ * confirmation is describing something this search did not offer, and the
+ * caller's answer to that is the same refusal.
+ */
+export function candidateAt(candidates, index) {
+    if (!Number.isInteger(index) || index < 0 || index >= candidates.length) {
+        return null;
     }
+    return candidates[index];
 }
 /** Turn a backend item into a candidate, dropping fields nothing renders. */
 export function toCandidate(item) {

package/dist/drive-search.js.map

@@ -1 +1 @@
-{"version":3,"file":"drive-search.js","sourceRoot":"","sources":["../src/drive-search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAmD9C;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IAGM;IAFrB,IAAI,GAAG,CAAC,CAAC;IAEjB,YAA6B,QAAgB,2BAA2B;QAA3C,UAAK,GAAL,KAAK,CAAsC;IAAG,CAAC;IAE5E,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAYD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,iBAAiB;IAC5B,MAAM,CAAU,cAAc,GAAG,CAAC,CAAC;IAElB,IAAI,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEhE,QAAQ,CAAC,KAAa,EAAE,UAAgC;QACtD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC,cAAc,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAa,EAAE,KAAa;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;;AAGH,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe,EAAE,IAAI,CAAC,eAAe;KACtC,CAAC;AACJ,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,gDAAgD;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EACL,mEAAmE;oBACnE,qEAAqE;oBACrE,uDAAuD;aAC1D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EACL,mEAAmE;oBACnE,qEAAqE;oBACrE,6BAA6B;aAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EACL,sEAAsE;YACtE,wEAAwE;YACxE,iEAAiE;KACpE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,CACL,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,CACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,yDAAyD;IACzD,qEAAqE;IACrE,sEAAsE;IACtE,oDAAoD,CAAC"}
+{"version":3,"file":"drive-search.js","sourceRoot":"","sources":["../src/drive-search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,uBAAuB,GAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAGrE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAmD9C;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IAGM;IAFrB,IAAI,GAAG,CAAC,CAAC;IAEjB,YAA6B,QAAgB,2BAA2B;QAA3C,UAAK,GAAL,KAAK,CAAsC;IAAG,CAAC;IAE5E,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAYD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,iFAAiF;AACjF,MAAM,uBAAuB,GAAG,yCAAyC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAsC;IAEtC,OAAO,uBAAuB,CAAuB;QACnD,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAChD,UAAU,EAAE,wBAAwB;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,UAAgC,EAChC,KAAa;IAEb,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe,EAAE,IAAI,CAAC,eAAe;KACtC,CAAC;AACJ,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,gDAAgD;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EACL,mEAAmE;oBACnE,qEAAqE;oBACrE,uDAAuD;aAC1D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EACL,mEAAmE;oBACnE,qEAAqE;oBACrE,6BAA6B;aAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EACL,sEAAsE;YACtE,wEAAwE;YACxE,iEAAiE;KACpE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,CACL,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,CACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,yDAAyD;IACzD,qEAAqE;IACrE,sEAAsE;IACtE,oDAAoD,CAAC"}

package/dist/lib.d.ts

@@ -13,6 +13,12 @@
  *
  * Stable API surface (semver-bound):
  *   - `createServer(apiClient, options?): McpServer`
+ *   - `ToolTelemetrySink` (ENG-2823) — where a HOST wants one structured line
+ *     per tool call to go. The stdio surface omits it and keeps the local
+ *     file, because stdout is the transport there; the gateway supplies its
+ *     request logger so the line reaches CloudWatch. The package never picks
+ *     a destination, and the event's key set is fixed so no host can widen it
+ *     into arguments or content.
  *   - `grantsWriteTools(scope)` — the write allow-list (ENG-2208), exported so
  *     the gateway asks the same question instead of writing a second copy of
  *     the rule that would drift from this one.
@@ -24,7 +30,8 @@
  *   - `ApiClient` (class) and `ApiClientConfig` (interface)
  *   - All `types` (Team, EnrolledFile, FileVersion, ...)
  */
-export { createServer } from './server.js';
+export { createServer, type CreateServerOptions } from './server.js';
+export { type ToolOutcome, type ToolTelemetryEvent, type ToolTelemetrySink, } from './tool-telemetry.js';
 export { grantsWriteTools, resolveCapabilities, registeredToolsForCapabilities, PAT_CAPABILITIES, PENDING_WRITE_TOOLS, WRITE_TOOLS_BY_CAPABILITY, type PatCapability, type RegisterToolsOptions, } from './tools/index.js';
 export { ApiClient, type ApiClientConfig } from './api-client.js';
 export * from './types.js';

package/dist/lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClE,cAAc,YAAY,CAAC"}

package/dist/lib.js

@@ -13,6 +13,12 @@
  *
  * Stable API surface (semver-bound):
  *   - `createServer(apiClient, options?): McpServer`
+ *   - `ToolTelemetrySink` (ENG-2823) — where a HOST wants one structured line
+ *     per tool call to go. The stdio surface omits it and keeps the local
+ *     file, because stdout is the transport there; the gateway supplies its
+ *     request logger so the line reaches CloudWatch. The package never picks
+ *     a destination, and the event's key set is fixed so no host can widen it
+ *     into arguments or content.
  *   - `grantsWriteTools(scope)` — the write allow-list (ENG-2208), exported so
  *     the gateway asks the same question instead of writing a second copy of
  *     the rule that would drift from this one.

package/dist/lib.js.map

@@ -1 +1 @@
-{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,GAG1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AAClE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAMrE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,GAG1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AAClE,cAAc,YAAY,CAAC"}

package/dist/not-ready.d.ts

@@ -32,7 +32,14 @@ export type NotReadyReason =
  * an unknown completeness state is not permission to serve rows. This is the
  * one reason that is NOT a statement about the file.
  */
- | 'completeness_unknown';
+ | 'completeness_unknown'
+/**
+ * ENG-2824 — the file is enrolled but its initial read has not landed yet.
+ * Distinct from `change_history_incomplete`, which is a FOLD rewriting an
+ * existing window: here there is no window and no version, because enrolment
+ * saves the file row before it writes Initial 1.0.0 / Live 0.0.0.
+ */
+ | 'enrollment_incomplete';
 /** Grep marker; also the first token of every refusal an assistant sees. */
 export declare const NOT_READY_MARKER = "CHANGE_HISTORY_NOT_READY";
 /** Poll hint when the backend gave none — mirrors the backend's own default. */
@@ -68,6 +75,31 @@ export interface NotReadyToolResult {
  * wrong inference explicitly, and a JSON object to branch on.
  */
 export declare function notReadyToolResult(err: unknown): NotReadyToolResult;
+/**
+ * ENG-2824 — throws {@link ChangeHistoryNotReadyError} when the file's initial
+ * read has not landed, judged by its version list being EMPTY.
+ *
+ * Why the version list is the right signal, and why the existing probe cannot
+ * be it. `assertChangeHistoryComplete` asks the commit-diff QUEUE, and the
+ * enrolment write enqueues no fold at all — `initial` is named among the
+ * never-enqueued classes in `backend/src/queue/commit-diff-fold-status.sql.ts`
+ * ("the never-enqueued classes (initial, …) are all correctly reported as
+ * nothing pending"). So during the ~90 seconds a workbook is being read for
+ * the first time the probe answers `foldPending: false` truthfully, and every
+ * change-history surface reads that as permission to serve an empty list.
+ *
+ * The backend already treats "row exists, zero versions" as enrolment that has
+ * not finished: `enrolled-files.service.ts` short-circuits a repeat POST only
+ * when the row has "at least one saved FileVersion", and calls a versionless
+ * row a "half-enrolled stub" on the Google path. Enrolment saves the file row
+ * first and Initial 1.0.0 / Live 0.0.0 after, on BOTH platform paths, so there
+ * is no enrolled-and-complete file with zero versions.
+ *
+ * Existence is not being inferred here: `FileUserAccessGuard` denies an unknown
+ * or unauthorised id outright, so a 200 carrying an empty array means the file
+ * is ours and is still being read — not that it might not exist.
+ */
+export declare function assertEnrollmentComplete(fileMsId: string, versions: readonly unknown[]): void;
 /** The completeness probe this module needs from the API client. */
 export interface CompletenessProbe {
     getFoldStatus(fileMsId: string): Promise<{

package/dist/not-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"not-ready.d.ts","sourceRoot":"","sources":["../src/not-ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,oDAAoD;AACpD,MAAM,MAAM,cAAc;AACxB,2EAA2E;AACzE,2BAA2B;AAC7B,6EAA6E;GAC3E,iBAAiB;AACnB;;;;GAIG;GACD,sBAAsB,CAAC;AAE3B,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAG,IAAI,CAAU;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBAErB,GAAG,EAAE;QACf,MAAM,EAAE,cAAc,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;CAeF;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,0BAA0B,CAI1E;AAyBD,MAAM,WAAW,kBAAkB;IACjC;8DAC0D;IAC1D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAwBnE;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;QACrB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,CAAC,CAAC;CACJ;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"not-ready.d.ts","sourceRoot":"","sources":["../src/not-ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,oDAAoD;AACpD,MAAM,MAAM,cAAc;AACxB,2EAA2E;AACzE,2BAA2B;AAC7B,6EAA6E;GAC3E,iBAAiB;AACnB;;;;GAIG;GACD,sBAAsB;AACxB;;;;;GAKG;GACD,uBAAuB,CAAC;AAE5B,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAG,IAAI,CAAU;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBAErB,GAAG,EAAE;QACf,MAAM,EAAE,cAAc,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;CAeF;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,0BAA0B,CAI1E;AAyBD,MAAM,WAAW,kBAAkB;IACjC;8DAC0D;IAC1D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAmCnE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,SAAS,OAAO,EAAE,GAC3B,IAAI,CASN;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;QACrB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,CAAC,CAAC;CACJ;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/not-ready.js

@@ -87,15 +87,25 @@ export function notReadyToolResult(err) {
         retryAfterSeconds: e.retryAfterSeconds,
         fileMsId: e.fileMsId,
     };
+    // ENG-2824 — the enrolment case is not a change-history statement, and
+    // saying "computing this file's change history" over a file whose bytes
+    // have not been read yet invites exactly the wrong follow-up ("so it has
+    // no versions"). Name the state the caller is actually in.
+    const body = e.reason === 'enrollment_incomplete'
+        ? `Rockhopper is still reading this workbook for the first time, so no ` +
+            `versions and no changes can be served yet.\n` +
+            `Do NOT say the file has no versions, no history or no changes, that ` +
+            `it is empty, or that enrolment failed — none of that is known.\n`
+        : `Rockhopper has not finished computing this file's change history, ` +
+            `so no rows can be served.\n` +
+            `Do NOT say there are no changes, that nothing changed, or that the ` +
+            `history is empty — none of that is known.\n`;
     return {
         content: [
             {
                 type: 'text',
                 text: `${NOT_READY_MARKER} — this is NOT a result and NOT an empty result.\n` +
-                    `Rockhopper has not finished computing this file's change history, ` +
-                    `so no rows can be served.\n` +
-                    `Do NOT say there are no changes, that nothing changed, or that the ` +
-                    `history is empty — none of that is known.\n` +
+                    body +
                     `Retry in ${e.retryAfterSeconds} seconds.\n` +
                     JSON.stringify(payload),
             },
@@ -103,6 +113,40 @@ export function notReadyToolResult(err) {
         isError: true,
     };
 }
+/**
+ * ENG-2824 — throws {@link ChangeHistoryNotReadyError} when the file's initial
+ * read has not landed, judged by its version list being EMPTY.
+ *
+ * Why the version list is the right signal, and why the existing probe cannot
+ * be it. `assertChangeHistoryComplete` asks the commit-diff QUEUE, and the
+ * enrolment write enqueues no fold at all — `initial` is named among the
+ * never-enqueued classes in `backend/src/queue/commit-diff-fold-status.sql.ts`
+ * ("the never-enqueued classes (initial, …) are all correctly reported as
+ * nothing pending"). So during the ~90 seconds a workbook is being read for
+ * the first time the probe answers `foldPending: false` truthfully, and every
+ * change-history surface reads that as permission to serve an empty list.
+ *
+ * The backend already treats "row exists, zero versions" as enrolment that has
+ * not finished: `enrolled-files.service.ts` short-circuits a repeat POST only
+ * when the row has "at least one saved FileVersion", and calls a versionless
+ * row a "half-enrolled stub" on the Google path. Enrolment saves the file row
+ * first and Initial 1.0.0 / Live 0.0.0 after, on BOTH platform paths, so there
+ * is no enrolled-and-complete file with zero versions.
+ *
+ * Existence is not being inferred here: `FileUserAccessGuard` denies an unknown
+ * or unauthorised id outright, so a 200 carrying an empty array means the file
+ * is ours and is still being read — not that it might not exist.
+ */
+export function assertEnrollmentComplete(fileMsId, versions) {
+    if (versions.length > 0)
+        return;
+    throw new ChangeHistoryNotReadyError({
+        reason: 'enrollment_incomplete',
+        fileMsId,
+        detail: 'the file is enrolled but has no versions yet, so its initial read has ' +
+            'not finished',
+    });
+}
 /**
  * Throws {@link ChangeHistoryNotReadyError} unless the file's change history is
  * complete.