@sentropic/h2a 0.85.25 → 0.87.0

package/dist/runtime/mirror/sanitize.js

@@ -0,0 +1,625 @@
+/**
+ * EVO-13 / feed-contract P1 — the mirror's **SEND BOUNDARY**.
+ *
+ * The feed (`runtime/feed/descriptors.ts`) sanitizes what a browser READS. That
+ * protects nothing that has already come to rest on someone else's disk: the
+ * mirror push (`build.ts` → `remote/client.ts`) used to ship `listPresence(...)`
+ * records and registry rows **verbatim**, so `launchContext.cwd`, the full
+ * command line, the tmux session/pane, the pid, `workspace.path` and the
+ * `file://<root>` endpoint uri all landed in the hosted store — the exact fields
+ * the feed contract exists to keep out of a browser.
+ *
+ * The rule this module implements:
+ *
+ *   **Sanitize at the boundary you are responsible for; never assume an upstream
+ *   or downstream sanitizer.** A read-side sanitizer does not protect data at
+ *   rest. The send boundary is ours, so it sanitizes.
+ *
+ * ── AND THE SAME RULE APPLIED TO THIS FILE'S OWN COMMENTS ───────────────────
+ *
+ *   **When a comment here cites another module's validator, CALL IT and check
+ *   what it actually rejects. Do not read its name, its type signature, or its
+ *   docstring and infer.**
+ *
+ * This is written down because the file broke its own rule three times, and each
+ * time it took a measurement to notice — a comment assuming a sibling guard is
+ * the same mistake as code assuming one:
+ *
+ *  - `isH2AActorRegistration` "requires `endpoints` to be an array" — it does,
+ *    but it is **never called on any production path**, so it required nothing.
+ *  - `isH2AEnvelope` "requires a vocabulary role" — it checks `actor.instance`
+ *    and nothing else (see {@link sanitizeActorForMirror}).
+ *  - `isActorRef` (`envelope.ts:27`) does check the role vocabulary, and is
+ *    referenced **nowhere**. Reading it as live would have been the third.
+ *
+ * A false claim about a sibling guard is worse than no claim: it supplies a
+ * reason to delete a protection that works. Every guard citation below has been
+ * exercised, and what each one ACTUALLY enforces is recorded at its use site:
+ *
+ *   | Cited guard              | What it really enforces                      |
+ *   |--------------------------|----------------------------------------------|
+ *   | `isH2AWorkspaceRef`      | `id`/`host`/`label` required; `path` rejected |
+ *   |                          | when present-but-empty; EXTRA KEYS TOLERATED  |
+ *   | `isH2ASession`           | rejects missing `interests`/`subscribedTopics`|
+ *   |                          | and a non-vocabulary topic; tolerates extra   |
+ *   |                          | top-level keys                                |
+ *   | `isInterests`            | `scopes`+`negotiations` string arrays only;   |
+ *   |                          | EXTRA NESTED KEYS TOLERATED (the P1 leak)     |
+ *   | `isH2AActorRegistration` | would reject `endpoints: "nope"` — but has NO |
+ *   |                          | production caller, so it guards nothing        |
+ *   | `isH2AEnvelope`          | `actor.instance` is a string. NOT `role`.     |
+ *   | `canAttestComprehension` | `(role, rights = [])`; both call sites pass   |
+ *   |                          | `registration.capabilities` — claim holds     |
+ *   | `deriveLiveness`         | reads `mirroredAt` to gate staleness          |
+ *   |                          | (`descriptors.ts:410`) — claim holds          |
+ *
+ * Note the shape of the three tolerances: every one of these guards is a
+ * SPOT-CHECK that accepts unknown keys. None of them is an allowlist. That is
+ * precisely why this module cannot delegate to any of them.
+ *
+ * ── Why an ALLOWLIST, and why it is a *type*, not a filter ──────────────────
+ *
+ * A denylist that strips `cwd`/`command`/`tmux`/`pid` starts leaking silently
+ * the day someone adds a field to `H2ASession`. So every COMPOSITE type that
+ * travels — each payload member **and every composite nested inside one** — gets
+ * a FIELD PLAN: an object that classifies **every** field of the source type as
+ * `send`, `withhold` or `narrow`. Three properties follow, in increasing order
+ * of strength:
+ *
+ *  1. *Nothing unclassified can travel.* The builders iterate the PLAN's keys and
+ *     read only those off the record. A field absent from the plan is never even
+ *     read, so it cannot reach the wire whatever wrote it (including an `as any`
+ *     cast or a JS caller). This holds at EVERY level, not merely at the top of
+ *     each payload member: every composite listed in the table below is rebuilt
+ *     field-by-field from its own plan, never copied by reference. It does NOT
+ *     hold for the element VALUES inside arrays of primitives — those are free
+ *     text, no field allowlist can constrain them, and they are handled as a
+ *     disclosed gap (see the table's second half).
+ *  2. *Nothing unclassified can be added quietly.* Each plan is checked with
+ *     `satisfies { [K in keyof Required<Source>]: ... }`, so adding a field to
+ *     ANY type in the table **fails the build** until it is explicitly
+ *     classified. The ratchet is the compiler, not a reviewer's attention — and
+ *     because the nested types carry plans of their own, the ratchet reaches
+ *     downward instead of stopping at the payload member. (Before the nested
+ *     plans it did stop there: a field added to `H2ASessionInterests` or to the
+ *     endpoints element type compiled clean and travelled.)
+ *  3. *The wire type cannot drift from the plan.* `H2AMirrored*` is written out
+ *     explicitly (it IS the wire contract, so it should be readable), and a
+ *     compile-time equality assertion pins its key set to the plan's `send` +
+ *     `narrow` keys. Change one without the other and the build fails.
+ *
+ * This is the same reasoning that makes `sanitizeDeclaredCapabilities` correct:
+ * it ITERATES the closed vocabulary (`H2A_DECLARED_CAPABILITIES.filter(...)`)
+ * instead of removing known-bad values. Here the "vocabulary" is the field set.
+ *
+ * ── Every composite type that travels, and its plan ────────────────────────
+ *
+ * Property 1 is worth exactly as much as this list is complete, so the list is
+ * exhaustive by construction: `buildInstanceMirror` puts three member arrays in
+ * the body and nothing else, and every entry here is reachable from one of them.
+ *
+ *   H2ASession                          → PRESENCE_PLAN
+ *     ├─ H2ASessionInterests            → INTERESTS_PLAN
+ *     ├─ H2AAgentVersion                → VERSION_PLAN
+ *     └─ H2AWorkspaceRef                → WORKSPACE_PLAN
+ *   H2AActorRegistration                → REGISTRATION_PLAN
+ *     ├─ endpoints[] element {kind,uri} → ENDPOINT_PLAN
+ *     └─ H2AWorkspaceRef                → WORKSPACE_PLAN
+ *   H2ASubagentBinding                  → SUBAGENT_PLAN
+ *
+ * Every composite above has a plan. **NOT covered, and cannot be**: arrays of
+ * primitives and free-text scalars, because a field allowlist classifies FIELDS
+ * and these have none — their risk is in the VALUE. Transmitted: the element
+ * values of `interests.scopes[]`, `interests.negotiations[]`, `scopes[]`,
+ * `capabilities[]`, `declaredCapabilities[]`, `acceptedPolicies[]`,
+ * `publicKeys[]`, `roles[]`, `subscribedTopics[]`, and the scalars `name`,
+ * `principal`, `conductor`, `agentUuid`, `workspace.label`, `workspace.host`,
+ * `workspace.id`, `version.cli`, `version.skill`. `roles[]` and
+ * `subscribedTopics[]` are closed vocabularies in the TYPE but are not
+ * re-intersected against that vocabulary here. The others are agent-settable:
+ * `h2a_session_open` copies `interests.scopes` verbatim from its caller
+ * (`runtime/mcp/sessions.ts`), and `h2a_register_instance` accepts an arbitrary
+ * object, so a scope of `"scope:/home/you/private"` or a conductor of
+ * `"file:///home/you/…"` comes to rest on the hosted disk with no privilege, no
+ * malformed record and no older CLI involved. That is a disclosed, bounded gap —
+ * joint plan § 9 item 1, feed contract "Send boundary" — not something these
+ * plans close, and the concern is DATA AT REST on someone else's disk, not only
+ * how a panel renders it.
+ *
+ * The ENVELOPE around the body is NOT all literals — an earlier version of this
+ * comment claimed it was, and that was false. `protocol` / `version` / `id` /
+ * `type` / `target` / `createdAt` are built from constants, the instance id and
+ * the injected clock. But `actor` is assembled from the REGISTRATION:
+ * `buildInstanceMirror` wrote `role: reg.roles?.[0]`, which is a source record's
+ * field reaching the wire outside every plan in this module — demonstrated with
+ * a `roles` array whose first element was a real filesystem path, which came to
+ * rest on the receiver. `scope` was a hardcoded `"scope:default"`, i.e. the one
+ * remaining literal in the one place with no plan and no ratchet: the day
+ * somebody made it `reg.scopes?.[0]` — the obvious edit — a record field would
+ * have ridden out with no compile-time and no test signal.
+ *
+ * So `actor` now has a boundary like everything else, and it is a stronger one
+ * than a plan: {@link sanitizeActorForMirror} derives it from the ALREADY
+ * SANITIZED `H2AMirroredRegistration`, never from the raw record. That makes the
+ * property structural rather than reviewed — the envelope cannot carry a field
+ * the registration plan does not already transmit, because the raw record is not
+ * in scope at the point the actor is built. `role` is additionally re-intersected
+ * against the `H2A_ROLES` vocabulary at runtime, so the path in the example above
+ * no longer reaches the wire at all, and the unvalidated `reg.roles?.[0]` — which
+ * on the string `"NOTANARRAY"` quietly yielded the single character `"N"` — is
+ * gone with it.
+ *
+ * ── What this module is NOT ────────────────────────────────────────────────
+ *
+ * Everything here is PURE and happens **before signing**, so the signature still
+ * covers exactly the bytes transmitted. Nothing about the signing primitive, the
+ * sequence fencing or the accept-side verification changes.
+ *
+ * It is also only the SEND half. The ingester (`serve.ts`) still writes whatever
+ * a *verified* sender hands it, so an older CLI that predates this module keeps
+ * pushing raw records. Applying these same functions on the ingest path is the
+ * symmetric half of the rule and is recorded as owed — see the feed contract's
+ * "Send boundary" section.
+ */
+import { H2A_ROLES } from "@sentropic/h2a";
+/** Transmitted as-is. Only for fields that are provably not sender-private. */
+const SEND = { kind: "send" };
+/** Never transmitted, with the reason recorded in the closed vocabulary. */
+function withhold(because) {
+    return { kind: "withhold", because };
+}
+/** Transmitted, but through its own nested allowlist. */
+function narrow(fn) {
+    return { kind: "narrow", narrow: fn };
+}
+/**
+ * Objects this module built field-by-field from a plan.
+ *
+ * The membership test is what makes "a composite is REBUILT, never passed
+ * through" checkable at runtime instead of merely intended. See
+ * {@link isPlanBuilt} and the `narrow` branch of {@link applyPlan}.
+ */
+const PLAN_BUILT = new WeakSet();
+/**
+ * The RUNTIME twin of {@link MirrorSendableValue}.
+ *
+ * It exists because the compile-time constraint proves something about the
+ * PLAN, not about the VALUE. `applyPlan` receives records from
+ * `store.findInstance` / `listPresence`, and a registration is accepted and
+ * written with **no validation at all** (`registerInstance` validates nothing;
+ * `handleRegisterInstance` checks `typeof === "object"` and stops). So the
+ * declared type of a field is a hope about the data, not a fact about it: a
+ * `principal` declared `string` can hold `{cwd, command}` at runtime, and a
+ * `send` classification would copy that object wholesale.
+ */
+function isSendableAtRuntime(value) {
+    const isPrimitive = (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+    if (isPrimitive(value))
+        return true;
+    return Array.isArray(value) && value.every(isPrimitive);
+}
+/** Whether a narrow's output was really rebuilt from a plan (arrays: elementwise). */
+function isPlanBuilt(value) {
+    if (value === null || typeof value !== "object")
+        return true;
+    if (Array.isArray(value))
+        return value.every(isPlanBuilt);
+    return PLAN_BUILT.has(value);
+}
+/**
+ * Apply a plan: iterate the PLAN (never the record's own keys) and copy only
+ * what it permits.
+ *
+ * Iterating the plan is what makes this an allowlist rather than a filter — an
+ * unclassified field on `record` is not skipped, it is never looked at. Absent
+ * values are omitted rather than serialized as `undefined`, so the payload keeps
+ * the same "optional field absent" shape the store and the guards expect.
+ *
+ * ── THE TWO RUNTIME CHECKS, AND WHY A TYPE IS NOT ENOUGH ───────────────────
+ *
+ * Both exist because this function's input is UNVALIDATED. The compile-time
+ * ratchet governs the plan; nothing governs the record.
+ *
+ *  - A `send` value that is not a primitive or an array of primitives is
+ *    DROPPED. The declared type says what the field must be, so anything else is
+ *    a lie, and a lie shaped like an object is how a `cwd` and a command line
+ *    ride out through a field declared `string`. Dropped rather than thrown:
+ *    throwing here would let any hostile registry row kill the push for every
+ *    session on the machine, trading availability for a confidentiality win
+ *    that dropping already secures. If the dropped field was required, the
+ *    receiver's own guard rejects the record — fail-closed, and visible.
+ *  - A `narrow` whose output was not itself built by this function is DROPPED.
+ *    `NarrowPlan.narrow` is an arbitrary callback returning `unknown`, so
+ *    `narrow((value) => value)` — an identity narrow — type-checks and copies a
+ *    composite wholesale, which is precisely the leak the plans exist to stop.
+ *    The compiler cannot reject it (identity returns a structurally compatible
+ *    type), so the membership test in {@link PLAN_BUILT} does.
+ *
+ * `null` is passed THROUGH to a narrow rather than short-circuited, so the
+ * narrow's own hostile-input handling can run. That is what makes
+ * `endpoints: null` produce `[]` instead of an absent field.
+ */
+function applyPlan(record, plan) {
+    const out = {};
+    PLAN_BUILT.add(out);
+    // The record itself may be null/undefined or not an object at all — every
+    // narrow must be TOTAL, because nothing validated what is in the store.
+    const source = (record ?? {});
+    for (const field of Object.keys(plan)) {
+        const step = plan[field];
+        if (step === undefined || step.kind === "withhold")
+            continue;
+        const value = source[field];
+        if (value === undefined)
+            continue;
+        if (step.kind === "narrow") {
+            const narrowed = step.narrow(value);
+            if (narrowed === undefined || narrowed === null)
+                continue;
+            if (!isPlanBuilt(narrowed))
+                continue;
+            out[field] = narrowed;
+            continue;
+        }
+        if (value === null)
+            continue;
+        if (!isSendableAtRuntime(value))
+            continue;
+        out[field] = value;
+    }
+    return out;
+}
+/**
+ * {@link applyPlan} and the plan constructors, exported for the send-boundary
+ * tests ONLY.
+ *
+ * Exporting internals to test them is usually a smell. It is justified here
+ * because the property under test is "a hostile PLAN cannot defeat the
+ * boundary", and a plan cannot be made hostile from outside without these. The
+ * alternative — trusting that no future plan uses an identity narrow — is the
+ * assumption this module exists to eliminate.
+ */
+export const MIRROR_TEST_HOOKS = {
+    applyPlan,
+    send: SEND,
+    narrow,
+    withhold
+};
+/**
+ * Fields present on `record` that the plan does not classify at all.
+ *
+ * **This is a TEST-TIME assertion helper, not a runtime half of the ratchet.**
+ * It is called from `test/mirror-send-boundary.test.js` and from nowhere on the
+ * send path, and the earlier claim that it "covers the paths the compiler cannot
+ * see" was wider than what is built — a guard that is never invoked cannot cover
+ * anything. It is kept, and kept exported, because it is what lets a test fail by
+ * NAMING the unclassified field instead of asserting an opaque key-set equality.
+ *
+ * It is deliberately not wired into the builders. Two reasons, and the second is
+ * the honest one: (a) throwing on an unclassified field would turn an additive,
+ * harmless field into a dead mirror pipeline — availability lost for no
+ * confidentiality gained, since `applyPlan` never reads the field anyway; and
+ * (b) the alternative, warning or counting, would make this module impure, and
+ * the purity claim above ("everything here is PURE and happens before signing")
+ * is load-bearing for the signature argument. The ratchet that actually holds is
+ * the compiler (`satisfies MirrorPlanFor<Source>` on every plan in the table) plus
+ * plan-iteration in {@link applyPlan}. There is no runtime ratchet; if one is
+ * wanted it belongs in the caller, where a side effect is allowed.
+ */
+export function unclassifiedMirrorFields(record, plan) {
+    return Object.keys(record).filter((field) => !(field in plan));
+}
+const WORKSPACE_PLAN = {
+    id: SEND,
+    host: SEND,
+    label: SEND,
+    path: withhold("filesystem-path"),
+    repo: withhold("not-consumed-downstream")
+};
+/** The plan, for tests. */
+export const MIRROR_WORKSPACE_PLAN = WORKSPACE_PLAN;
+const _workspaceKeysMatchPlan = true;
+void _workspaceKeysMatchPlan;
+export function sanitizeWorkspaceRefForMirror(workspace) {
+    return applyPlan(workspace, WORKSPACE_PLAN);
+}
+// ─── Version stamp ──────────────────────────────────────────────────────────
+const VERSION_PLAN = {
+    cli: SEND,
+    skill: SEND
+};
+/** The plan, for tests. */
+export const MIRROR_VERSION_PLAN = VERSION_PLAN;
+function sanitizeVersionForMirror(version) {
+    return applyPlan(version, VERSION_PLAN);
+}
+const INTERESTS_PLAN = {
+    scopes: SEND,
+    negotiations: SEND
+};
+/** The plan, for tests. */
+export const MIRROR_INTERESTS_PLAN = INTERESTS_PLAN;
+const _interestsKeysMatchPlan = true;
+void _interestsKeysMatchPlan;
+function sanitizeInterestsForMirror(interests) {
+    return applyPlan(interests, INTERESTS_PLAN);
+}
+/**
+ * Every field of `H2ASession`, classified.
+ *
+ * The `send` set is exactly what a consumer of the mirror demonstrably needs:
+ *  - `sessionId` / `instance` — the row's own identity (`accept.ts` authorizes a
+ *    session by `instance`; the feed keys rows on both);
+ *  - `startedAt` / `heartbeatAt` / `state` / `lastMcpActivityAt` — the liveness
+ *    derivation (`deriveSessionState`, `deriveLiveness`, `isSessionExpired`);
+ *  - `interests` / `subscribedTopics` — required by `isH2ASession`, so the
+ *    hosted `writePresence` rejects the record without them;
+ *  - `host` / `name` / `workspace` — the feed's `host`, `topicOrTitle`,
+ *    `displayName` and `workspaceLabel`;
+ *  - `workStatus` / `version` — closed vocabularies, shown by `h2a_discover_*`.
+ */
+const PRESENCE_PLAN = {
+    sessionId: SEND,
+    instance: SEND,
+    host: SEND,
+    name: SEND,
+    startedAt: SEND,
+    heartbeatAt: SEND,
+    state: SEND,
+    // Narrowed, not SEND: `isInterests` tolerates extra keys, so a `SEND` here
+    // shipped the caller's whole object by reference. See INTERESTS_PLAN.
+    interests: narrow(sanitizeInterestsForMirror),
+    // Element values are NOT re-intersected against the closed topic vocabulary.
+    // Recorded, not fixed: `writePresence`/`isH2ASession` reject a non-vocabulary
+    // topic at the sender, so the real pipeline cannot reach this; calling
+    // `sanitizePresenceForMirror` directly with a hostile element can. Pure
+    // defence-in-depth, tracked with the free-text gap.
+    subscribedTopics: SEND,
+    workStatus: SEND,
+    lastMcpActivityAt: SEND,
+    version: narrow(sanitizeVersionForMirror),
+    workspace: narrow(sanitizeWorkspaceRefForMirror),
+    // The working directory, the command line and the terminal coordinates: the
+    // whole point of the exercise. Captured at launch for LOCAL relance (DEC-084)
+    // — a relauncher on another host could not use them even if it wanted to.
+    launchContext: withhold("command-line"),
+    pid: withhold("process-identity"),
+    // Not privacy — PROVENANCE. `mirroredAt` is the receiving side's own record of
+    // when it ingested a row, and `deriveLiveness` reads it to decide `stale`. A
+    // sender-supplied value would be a forged freshness claim feeding a liveness
+    // decision, so the sender does not get to make it. `serve.ts` stamps it.
+    mirroredAt: withhold("receiver-stamped")
+};
+/** The plan, for tests and for callers that want to state the contract. */
+export const MIRROR_PRESENCE_PLAN = PRESENCE_PLAN;
+const _presenceKeysMatchPlan = true;
+void _presenceKeysMatchPlan;
+/** One presence record → the record as it may leave the machine. */
+export function sanitizePresenceForMirror(session) {
+    return applyPlan(session, PRESENCE_PLAN);
+}
+// ─── Registration ───────────────────────────────────────────────────────────
+/**
+ * Endpoint uri schemes that may leave the machine: a NETWORK locator is
+ * meaningful to a receiver, a `file://` uri is a path on the sender's disk.
+ *
+ * Allowlisted by scheme rather than by `kind` deliberately. `kind` is a
+ * self-declared label — a `file://` uri labelled `kind: "remote"` would sail
+ * through a kind-based check, while the scheme is the thing that actually
+ * determines whether the value is a path. The only writer in the tree today
+ * emits `{ kind: "local-files", uri: "file://<root>" }` (`identity/live.ts`),
+ * i.e. the agent's h2a root — under `$HOME` on every developer machine.
+ *
+ * ── What this filter does NOT do ───────────────────────────────────────────
+ *
+ * It answers "is this a NETWORK LOCATOR", not "does this value contain a path or
+ * a secret". A bounded, disclosed gap with a known shape: all of
+ * `http://localhost/home/you/…`, `https://h/?cwd=/home/you/…`,
+ * `https://h/#/home/you/…` and `https://user:sk-live-…@h/` (credentials in the
+ * URI's userinfo) are network locators and therefore travel. Mirror endpoint
+ * URLs are exactly the kind of value that carries a token, so this is worth
+ * naming rather than leaving implied. Content-checking a URI is a different
+ * mitigation in kind (userinfo stripping, query/fragment policy) and is tracked
+ * with the free-text gap, not silently folded in here.
+ */
+const MIRRORABLE_ENDPOINT_SCHEMES = ["http:", "https:", "ws:", "wss:"];
+const ENDPOINT_PLAN = {
+    kind: SEND,
+    uri: SEND
+};
+/** The plan, for tests. */
+export const MIRROR_ENDPOINT_PLAN = ENDPOINT_PLAN;
+const _endpointKeysMatchPlan = true;
+void _endpointKeysMatchPlan;
+/**
+ * Endpoints reachable by a receiver — from an explicit filter, so an empty list
+ * is the established fact "no endpoint of this registration is addressable from
+ * off this machine", never a defaulted `[]`. Each survivor is then rebuilt from
+ * {@link ENDPOINT_PLAN} rather than passed through.
+ *
+ * `Array.isArray` FIRST, and not as a formality. `isH2AActorRegistration`
+ * (`types.ts`) would require this field to be an array, but it **is never called
+ * on any production path** — its only non-test references in the tree are its
+ * definition, the barrel re-export and this comment. Neither
+ * `store.registerInstance` nor `handleRegisterInstance` invokes it; the latter
+ * validates its input as `typeof === "object"` and nothing more, so
+ * `registerInstance({… endpoints: "nope"})` is accepted and written to
+ * `instances.jsonl`. Without the guard, `endpoints.filter` throws a `TypeError`
+ * that propagates out of `buildInstanceMirror` and kills the push — a fault this
+ * module would have INTRODUCED, since the pre-fix builder shipped `reg` verbatim
+ * and never touched `endpoints`. Confidentiality-neutral, availability-negative:
+ * exactly the failure a guard justified by a premise that does not exist creates.
+ *
+ * ── `endpoints: null` — RECORDED IN ROUND 3, CLOSED IN ROUND 5 ────────────
+ *
+ * The earlier note said this was recorded and left to the ingest half. That was
+ * wrong on ownership, and the second review leg was right to push back: the SEND
+ * side was emitting a row that violated its OWN declared wire type, so the fix
+ * belongs here regardless of what the receiver does.
+ *
+ * The mechanism: {@link applyPlan} used to skip null BEFORE invoking the narrow,
+ * so `Array.isArray` inside {@link sanitizeEndpointsForMirror} — the guard
+ * written precisely for this — could never fire for `null`. The field came out
+ * ABSENT rather than `[]`, and `runtime/drumbeat/relaunchers.ts:296` reads
+ * `store?.findInstance(instance)?.endpoints.find(…)`, whose optional chain stops
+ * BEFORE `.endpoints`. A guard that could not fire, which is the same shape this
+ * module keeps finding elsewhere.
+ *
+ * Now closed on both sides: `null` flows through to the narrow (which returns
+ * `[]`), and {@link sanitizeRegistrationForMirror} makes the array
+ * unconditional, covering the `undefined` case too. Both are pinned by tests.
+ */
+function sanitizeEndpointsForMirror(endpoints) {
+    if (!Array.isArray(endpoints))
+        return [];
+    return endpoints
+        .filter((endpoint) => {
+        let scheme;
+        try {
+            scheme = new URL(endpoint.uri).protocol;
+        }
+        catch {
+            return false; // unparseable, or not an object at all → cannot vouch for it
+        }
+        return MIRRORABLE_ENDPOINT_SCHEMES.includes(scheme);
+    })
+        .map((endpoint) => applyPlan(endpoint, ENDPOINT_PLAN));
+}
+/**
+ * Every field of `H2AActorRegistration`, classified.
+ *
+ * `capabilities` is transmitted DELIBERATELY, though it is authority-bearing and
+ * the feed never displays it. Two gates on the RECEIVING side read it off the
+ * registry row: the subagent capability ceiling (`subagents.ts`
+ * `capabilities-exceed-parent` compares a binding against `parent.capabilities`)
+ * and the attestation right (`canAttestComprehension(role,
+ * registration.capabilities)` in `mcp/handlers.ts`). Withholding it would not be
+ * "sanitizing" — it would silently change an authorization outcome on the
+ * receiver, which is a worse failure than the one being fixed. It carries no
+ * path, no command and no process identity.
+ */
+const REGISTRATION_PLAN = {
+    id: SEND,
+    instance: SEND,
+    roles: SEND,
+    scopes: SEND,
+    capabilities: SEND,
+    declaredCapabilities: SEND,
+    publicKeys: SEND,
+    acceptedPolicies: SEND,
+    createdAt: SEND,
+    principal: SEND,
+    conductor: SEND,
+    agentUuid: SEND,
+    name: SEND,
+    endpoints: narrow(sanitizeEndpointsForMirror),
+    workspace: narrow(sanitizeWorkspaceRefForMirror)
+};
+/** The plan, for tests. */
+export const MIRROR_REGISTRATION_PLAN = REGISTRATION_PLAN;
+const _registrationKeysMatchPlan = true;
+void _registrationKeysMatchPlan;
+export function sanitizeRegistrationForMirror(registration) {
+    const out = applyPlan(registration, REGISTRATION_PLAN);
+    // `endpoints` is REQUIRED by `H2AMirroredRegistration`, and the receiver
+    // dereferences it WITHOUT optional chaining (`relaunchers.ts:296`:
+    // `…?.endpoints.find(…)` — the chain stops before `.endpoints`). `applyPlan`
+    // omits a source field that is `undefined`, so without this the emitted row
+    // would violate its own declared wire type and hand the receiver a
+    // `TypeError`. `null` is already handled — it now flows through the narrow,
+    // which returns `[]` — so this closes the remaining `undefined` case and makes
+    // the array unconditional.
+    if (!Array.isArray(out.endpoints))
+        out.endpoints = [];
+    return out;
+}
+// ─── Envelope actor ─────────────────────────────────────────────────────────
+/** Role used when the registration declares none usable. */
+const MIRROR_FALLBACK_ROLE = "AGENTS";
+/** Scope used when the registration declares none usable. */
+const MIRROR_FALLBACK_SCOPE = "scope:default";
+/**
+ * First usable element of a declared list, or the fallback.
+ *
+ * `Array.isArray` first, and not as a formality — the same reason it guards
+ * {@link sanitizeEndpointsForMirror}. `h2a_register_instance` accepts an
+ * arbitrary object and `isH2AActorRegistration` is not called on any production
+ * path, so `roles` can be a bare string at runtime despite its `H2ARole[]` type.
+ * The previous `reg.roles?.[0]` then indexed the STRING: `"NOTANARRAY"` yielded
+ * `"N"`, a value that is not a role, not a diagnostic, and travelled anyway.
+ */
+function firstDeclared(values, fallback) {
+    if (!Array.isArray(values))
+        return fallback;
+    const first = values[0];
+    return typeof first === "string" && first.length > 0 ? first : fallback;
+}
+/**
+ * The envelope's `actor`, derived from the SANITIZED registration.
+ *
+ * Taking `H2AMirroredRegistration` rather than `H2AActorRegistration` is the
+ * whole point and is worth not "simplifying" later: the raw record is not in
+ * scope here, so this function CANNOT read a withheld field even by mistake.
+ * Every value it can reach has already been through {@link REGISTRATION_PLAN},
+ * which makes "the envelope carries nothing the body does not already carry" a
+ * consequence of the signature instead of a claim in a comment.
+ *
+ * `role` is re-intersected against `H2A_ROLES`. That is a genuinely closed
+ * vocabulary check, not a shape check: `roles[]` element VALUES are otherwise
+ * free text (disclosed above), and this is the one place where an element value
+ * escapes the body into the envelope, so it is the one place worth closing.
+ *
+ * ── STRUCK, AND LEFT VISIBLE ON PURPOSE ────────────────────────────────────
+ *
+ * An earlier version of this comment continued: ~~"`isH2AEnvelope` requires a
+ * vocabulary role anyway, so a non-role here produced an envelope that fails the
+ * protocol's own guard."~~ **That is false.** `isH2AEnvelope` delegates to
+ * `validateH2AEnvelope` (`envelope.ts:109`), which checks `actor` only for
+ * `typeof actor.instance === "string"`. It never looks at `role`. Measured:
+ *
+ *   isH2AEnvelope(actor.role = "/home/antoinefa/NOTAROLE")  -> true
+ *   isH2AEnvelope(actor with no role at all)                -> true
+ *   isH2AEnvelope(actor with no instance)                   -> false
+ *
+ * There IS a function that checks the vocabulary — `isActorRef`, `envelope.ts:27`
+ * — but it is module-private and referenced nowhere in the tree. A guard that
+ * cannot fire.
+ *
+ * The sentence is struck rather than deleted because of what it was doing: it
+ * supplied a REASON TO DELETE THE RE-INTERSECTION BELOW. "The protocol guard
+ * catches it anyway" is exactly the argument someone would use to remove that
+ * line, and removing it restores the leak. A false justification for a live
+ * guard is more dangerous than no justification at all — nothing downstream
+ * validates this field, so the check here is the only one there is.
+ *
+ * `scope` is NOT closed — there is no scope vocabulary to close it against — but
+ * it is now sourced from the sanitized registration rather than hardcoded, so
+ * the trap is disarmed by construction: the "obvious edit" has already been made
+ * here, safely, under test. Its value is free text and rides out under the same
+ * disclosed gap as `scopes[]` in the body, which already transmits it verbatim.
+ */
+export function sanitizeActorForMirror(instance, mirrored) {
+    const declaredRole = firstDeclared(mirrored.roles, MIRROR_FALLBACK_ROLE);
+    return {
+        instance,
+        role: H2A_ROLES.includes(declaredRole)
+            ? declaredRole
+            : MIRROR_FALLBACK_ROLE,
+        scope: firstDeclared(mirrored.scopes, MIRROR_FALLBACK_SCOPE)
+    };
+}
+const SUBAGENT_PLAN = {
+    id: SEND,
+    parentInstance: SEND,
+    name: SEND,
+    capabilities: SEND,
+    createdAt: SEND
+};
+/** The plan, for tests. */
+export const MIRROR_SUBAGENT_PLAN = SUBAGENT_PLAN;
+const _subagentKeysMatchPlan = true;
+void _subagentKeysMatchPlan;
+export function sanitizeSubagentForMirror(binding) {
+    return applyPlan(binding, SUBAGENT_PLAN);
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/runtime/mirror/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/runtime/mirror/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAoG3C,+EAA+E;AAC/E,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAExC,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,OAA6B;IAC7C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED,yDAAyD;AACzD,SAAS,MAAM,CAAI,EAAsC;IACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACxC,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,WAAW,GAAG,CAAC,CAAU,EAAW,EAAE,CAC1C,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,CAAC;IAC3E,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAS,SAAS,CAChB,MAAc,EACd,IAA2B;IAE3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAI,IAAiD,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAc,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;gBAAE,SAAS;YAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACrC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAAE,SAAS;QAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,IAAI,EAAE,IAAI;IACV,MAAM;IACN,QAAQ;CACA,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc,EACd,IAA6B;IAE7B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AA6CD,MAAM,cAAc,GAAG;IACrB,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC;IACjC,IAAI,EAAE,QAAQ,CAAC,yBAAyB,CAAC;CACD,CAAC;AAE3C,2BAA2B;AAC3B,MAAM,CAAC,MAAM,qBAAqB,GAChC,cAAkE,CAAC;AAOrE,MAAM,uBAAuB,GAA2B,IAAI,CAAC;AAC7D,KAAK,uBAAuB,CAAC;AAE7B,MAAM,UAAU,6BAA6B,CAC3C,SAA0B;IAE1B,OAAO,SAAS,CAAC,SAAS,EAAE,cAAc,CAAuC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAE/E,MAAM,YAAY,GAAG;IACnB,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;CAC6B,CAAC;AAE3C,2BAA2B;AAC3B,MAAM,CAAC,MAAM,mBAAmB,GAC9B,YAAgE,CAAC;AAEnE,SAAS,wBAAwB,CAAC,OAAwB;IACxD,OAAO,SAAS,CAAC,OAAO,EAAE,YAAY,CAAoB,CAAC;AAC7D,CAAC;AAgCD,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,IAAI;CAC0B,CAAC;AAE/C,2BAA2B;AAC3B,MAAM,CAAC,MAAM,qBAAqB,GAChC,cAAkE,CAAC;AAOrE,MAAM,uBAAuB,GAA2B,IAAI,CAAC;AAC7D,KAAK,uBAAuB,CAAC;AAE7B,SAAS,0BAA0B,CACjC,SAA8B;IAE9B,OAAO,SAAS,CACd,SAAS,EACT,cAAc,CAC2B,CAAC;AAC9C,CAAC;AA+BD;;;;;;;;;;;;;GAaG;AACH,MAAM,aAAa,GAAG;IACpB,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,KAAK,EAAE,IAAI;IACX,2EAA2E;IAC3E,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAsB,0BAA0B,CAAC;IAClE,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,wEAAwE;IACxE,oDAAoD;IACpD,gBAAgB,EAAE,IAAI;IACtB,UAAU,EAAE,IAAI;IAChB,iBAAiB,EAAE,IAAI;IACvB,OAAO,EAAE,MAAM,CAAkB,wBAAwB,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAkB,6BAA6B,CAAC;IACjE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,aAAa,EAAE,QAAQ,CAAC,cAAc,CAAC;IACvC,GAAG,EAAE,QAAQ,CAAC,kBAAkB,CAAC;IACjC,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC;CACL,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAC/B,aAAiE,CAAC;AAOpE,MAAM,sBAAsB,GAA0B,IAAI,CAAC;AAC3D,KAAK,sBAAsB,CAAC;AAE5B,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,OAAmB;IAC3D,OAAO,SAAS,CAAC,OAAO,EAAE,aAAa,CAAkC,CAAC;AAC5E,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,2BAA2B,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAgBhF,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,IAAI;CACsC,CAAC;AAElD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,oBAAoB,GAC/B,aAAiE,CAAC;AAOpE,MAAM,sBAAsB,GAA0B,IAAI,CAAC;AAC3D,KAAK,sBAAsB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,SAAS,0BAA0B,CACjC,SAA4C;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,SAAS;SACb,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,6DAA6D;QAC7E,CAAC;QACD,OAAQ,2BAAiD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAmC,CAAC,CAAC;AAC7F,CAAC;AA+BD;;;;;;;;;;;;GAYG;AACH,MAAM,iBAAiB,GAAG;IACxB,EAAE,EAAE,IAAI;IACR,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,IAAI;IAClB,oBAAoB,EAAE,IAAI;IAC1B,UAAU,EAAE,IAAI;IAChB,gBAAgB,EAAE,IAAI;IACtB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,MAAM,CAAoC,0BAA0B,CAAC;IAChF,SAAS,EAAE,MAAM,CAAkB,6BAA6B,CAAC;CACpB,CAAC;AAEhD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,wBAAwB,GAEjC,iBAAqE,CAAC;AAO1E,MAAM,0BAA0B,GAA8B,IAAI,CAAC;AACnE,KAAK,0BAA0B,CAAC;AAEhC,MAAM,UAAU,6BAA6B,CAC3C,YAAkC;IAElC,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACvD,yEAAyE;IACzE,mEAAmE;IACnE,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,+EAA+E;IAC/E,2BAA2B;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;IACtD,OAAO,GAAyC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAE/E,4DAA4D;AAC5D,MAAM,oBAAoB,GAAY,QAAQ,CAAC;AAC/C,6DAA6D;AAC7D,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAE9C;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,MAAe,EAAE,QAAgB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,KAAK,GAAY,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAiC;IAEjC,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACzE,OAAO;QACL,QAAQ;QACR,IAAI,EAAG,SAA+B,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC3D,CAAC,CAAE,YAAwB;YAC3B,CAAC,CAAC,oBAAoB;QACxB,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;KAC7D,CAAC;AACJ,CAAC;AAmBD,MAAM,aAAa,GAAG;IACpB,EAAE,EAAE,IAAI;IACR,cAAc,EAAE,IAAI;IACpB,IAAI,EAAE,IAAI;IACV,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAC4B,CAAC;AAE9C,2BAA2B;AAC3B,MAAM,CAAC,MAAM,oBAAoB,GAC/B,aAAiE,CAAC;AAOpE,MAAM,sBAAsB,GAA0B,IAAI,CAAC;AAC3D,KAAK,sBAAsB,CAAC;AAE5B,MAAM,UAAU,yBAAyB,CACvC,OAA2B;IAE3B,OAAO,SAAS,CAAC,OAAO,EAAE,aAAa,CAA0C,CAAC;AACpF,CAAC"}

package/dist/runtime/mirror/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/serve.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA+B5E,MAAM,WAAW,2BAA2B;IAC1C,kFAAkF;IAClF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAmBxE;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC,GAAG,MAAM,CAoEzG"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/serve.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA+B5E,MAAM,WAAW,2BAA2B;IAC1C,kFAAkF;IAClF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAmBxE;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC,GAAG,MAAM,CA4GzG"}