@yadsh/dsh-qa-surface 0.3.0 → 0.5.0

package/lib/secure-session.js

@@ -6,6 +6,7 @@ import { QaAccountsError } from "./accounts/store.js";
 import { QaAttestationError } from "./attestation.js";
 import { qaToolDenial, qaToolPolicyPlan } from "./lockdown-policy.js";
 import { QA_REPORT_SOURCES_TOOL } from "./provenance/host-store.js";
+import { qaUserWorkspaceDenial } from "./user-workspace.js";
 /** Grace period in which a fresh session may still be pinned to the QA preset. */
 const FRESH_SESSION_BOOTSTRAP_WINDOW_MS = 120_000;
 /**
@@ -37,25 +38,109 @@ export class QaPolicyAdmission {
     logger;
     accounts;
     appliedPolicies = new Map();
+    /**
+     * Sessions the QA surface has attested. The provenance note is written for
+     * exactly these, and a delegated child resolves through its root session, so
+     * one set answers for the whole chat.
+     */
+    attested = new Set();
+    workspaceAccess = new Map();
+    disposeWorkspaceGuard;
     constructor(ctx, config, logger, accounts) {
         this.ctx = ctx;
         this.config = config;
         this.logger = logger;
         this.accounts = accounts;
+        this.disposeWorkspaceGuard = ctx.tools.guard((execution) => {
+            const session = execution.agent?.session;
+            if (session === undefined)
+                return undefined;
+            const access = this.workspaceAccess.get(String(session.id));
+            if (access === undefined)
+                return undefined;
+            if (!cwdMatches(session.header.cwd, access.root)) {
+                return "QA workspace boundary: session cwd is outside this user's directory.";
+            }
+            return qaUserWorkspaceDenial(execution, access.root, this.attachmentRoot(), access);
+        });
+        ctx.on("session/created", (session) => {
+            const parent = session.header.parentSession;
+            if (parent === undefined)
+                return;
+            const access = this.workspaceAccess.get(String(parent));
+            if (access !== undefined) {
+                this.workspaceAccess.set(String(session.id), access);
+            }
+        });
         ctx.on("agent/disposed", ({ agent }) => {
             this.appliedPolicies.delete(agent);
+            this.workspaceAccess.delete(String(agent.session.id));
         });
     }
-    secureSession(token, sessionId) {
+    /**
+     * The mounted attachment store's verbatim root, when the backend exposes
+     * one. It sits outside every workspace, so the per-user fence would
+     * otherwise deny the model the exact file an upload produced and the prompt
+     * points it at. A backend without a resolvable root simply keeps the fence
+     * closed — attachments then only work where reads are not fenced per user.
+     */
+    attachmentRoot() {
+        const store = this.ctx.get("attachments");
+        return typeof store?.root === "string" ? store.root : undefined;
+    }
+    /**
+     * The live agent for one session, resuming a Session the Host has not
+     * materialized in this process.
+     *
+     * DSH builds an agent on demand: a session's journal opens straight from
+     * persistence (`session/page` reads the durable log), and only Agent-bound
+     * operations — a prompt, a model selection, renaming, an upload — resolve or
+     * resume one. So a chat from an earlier Host run has a readable transcript
+     * and no agent at all, and attestation, which pins the tool policy ON that
+     * agent, is the first thing here that needs one. Refusing instead would make
+     * every restored chat unopenable until something else in the Host happened
+     * to wake it.
+     *
+     * The resume composes the session's OWN recorded preset — the same
+     * composition a stock prompt would produce — so a session composed outside
+     * the QA preset still lands on the mismatch refusals below ("composition
+     * mismatch"), and the adoption and permission checks stay the gate.
+     */
+    async liveAgent(sessionId) {
+        const live = this.ctx.agents.get(SessionId(sessionId));
+        if (live !== undefined)
+            return live;
+        try {
+            const resolved = await this.ctx.sessionController.resolveAgent(SessionId(sessionId));
+            if (!("error" in resolved))
+                return resolved.agent;
+            this.logger.error("session.agent-resolve-rejected", {
+                sessionId,
+                error: resolved.error.message,
+            });
+        }
+        catch (error) {
+            // Either the composition itself failed (a preset that no longer mounts,
+            // a log the Host refuses to read) or the resolution threw before it
+            // could classify itself. Both are the same coarse fact for the browser.
+            this.logger.error("session.agent-resolve-rejected", {
+                sessionId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+        throw new QaAttestationError("agent-unavailable", "agent is unavailable");
+    }
+    async secureSession(token, sessionId) {
         const config = this.config();
         const lockdown = config.lockdown;
         // Account identity is checked before any policy work: an invalid token
         // must not learn whether a session exists or how the deployment composes.
         // Independent of lockdown — a deployment may gate users without pinning
         // the policy, and the gate itself no-ops while accounts are disabled.
+        let sessionOwner;
         if (this.accounts !== undefined) {
             try {
-                this.accounts.enforceSessionAccess(token, sessionId);
+                sessionOwner = this.accounts.enforceSessionAccess(token, sessionId);
             }
             catch (error) {
                 if (error instanceof QaAccountsError) {
@@ -66,10 +151,8 @@ export class QaPolicyAdmission {
                 throw error;
             }
         }
-        const agent = this.ctx.agents.get(SessionId(sessionId));
-        if (agent === undefined) {
-            throw new QaAttestationError("agent-unavailable", "agent is unavailable");
-        }
+        const agent = await this.liveAgent(sessionId);
+        this.attested.add(sessionId);
         if (!lockdown.enabled) {
             return {
                 sessionId,
@@ -77,7 +160,7 @@ export class QaPolicyAdmission {
                 agentPresetMatches: true,
                 workspaceMatches: true,
                 modelMatches: true,
-                sandboxIsReadOnly: false,
+                sandboxModeMatches: false,
                 approvalIsNever: false,
                 permissionPreset: "",
                 toolPolicyLoaded: false,
@@ -94,13 +177,28 @@ export class QaPolicyAdmission {
         if (expectedWorkspace !== null && pinnedWorkspace === undefined) {
             throw new QaAttestationError("workspace-unavailable", `workspace ${expectedWorkspace} is not registered`);
         }
+        let expectedUserRoot;
+        if (config.accounts.perUserWorkspace) {
+            if (sessionOwner === undefined || pinnedWorkspace === undefined) {
+                throw new QaAttestationError("workspace-unavailable", "per-user workspace identity is unavailable");
+            }
+            try {
+                expectedUserRoot = this.accounts?.userWorkspace(sessionOwner.id, pinnedWorkspace.path);
+            }
+            catch (error) {
+                throw new QaAttestationError("workspace-unavailable", error instanceof Error ? error.message : String(error));
+            }
+        }
         const expectedPreset = config.session.agentPreset;
         const agentPresetMatches = !lockdown.enforceFixedAgentPreset ||
             expectedPreset === null ||
             this.ctx.agentPresets.composedPreset(agent.ctx) === expectedPreset;
         const workspaceMatches = !lockdown.enforceFixedWorkspace ||
             (expectedWorkspace === null && config.session.cwd === null) ||
-            (pinnedWorkspace !== undefined &&
+            (expectedUserRoot !== undefined &&
+                cwdMatches(agent.session.header.cwd, expectedUserRoot)) ||
+            (!config.accounts.perUserWorkspace &&
+                pinnedWorkspace !== undefined &&
                 cwdMatches(agent.session.header.cwd, pinnedWorkspace.path)) ||
             (expectedWorkspace === null &&
                 config.session.cwd !== null &&
@@ -118,7 +216,7 @@ export class QaPolicyAdmission {
         const permission = this.ctx.permissionPresets.resolve(lockdown.permissionPreset);
         if (permission.sandbox !== lockdown.sandboxMode ||
             permission.approval !== lockdown.approvalPolicy) {
-            throw new QaAttestationError("permission-preset", `permission preset ${lockdown.permissionPreset} does not resolve to read-only/never`);
+            throw new QaAttestationError("permission-preset", `permission preset ${lockdown.permissionPreset} does not resolve to ${lockdown.sandboxMode}/never`);
         }
         const currentPermission = this.ctx.permissionPresets.current(agent.session);
         // History check over the model-visible surface: `user/message` is a
@@ -145,11 +243,6 @@ export class QaPolicyAdmission {
         if (prior?.fingerprint !== fingerprint) {
             const allowed = new Set(policy.allow);
             const disposeGuard = agent.ctx.tools.guard((execution) => qaToolDenial(allowed, execution.name));
-            const disposeGuidance = agent.ctx.systemPrompt.section({
-                name: "dsh-qa-surface:structured-sources",
-                order: 950,
-                text: "Source provenance is collected automatically from tools. Do not append a manual Sources/Источники bibliography to the answer. Delegated providers that cannot expose tool events should call qa_report_sources before finishing.",
-            });
             try {
                 const disposeRestriction = agent.ctx.tools.restrict({
                     allow: policy.allow,
@@ -158,27 +251,42 @@ export class QaPolicyAdmission {
                     fingerprint,
                     disposeGuard,
                     disposeRestriction,
-                    disposeGuidance,
                 });
                 prior?.disposeRestriction();
                 prior?.disposeGuard();
-                prior?.disposeGuidance();
             }
             catch (error) {
                 disposeGuard();
-                disposeGuidance();
                 throw error;
             }
         }
         this.ctx.permissionPresets.set(agent.session, lockdown.permissionPreset);
         const effectivePermission = this.ctx.permissionPresets.current(agent.session);
-        const sandboxIsReadOnly = permission.sandbox === "read-only";
+        const sandboxModeMatches = permission.sandbox === lockdown.sandboxMode;
         const approvalIsNever = permission.approval === "never";
         if (effectivePermission !== lockdown.permissionPreset ||
-            !sandboxIsReadOnly ||
+            !sandboxModeMatches ||
             !approvalIsNever) {
             throw new QaAttestationError("attestation-failed", "permission attestation failed");
         }
+        if (expectedUserRoot !== undefined) {
+            const currentAccess = this.workspaceAccess.get(sessionId);
+            if (currentAccess === undefined) {
+                this.workspaceAccess.set(sessionId, {
+                    root: expectedUserRoot,
+                    sharedReadOnlyRoots: lockdown.sharedReadOnlyRoots,
+                });
+            }
+            else {
+                // Children share this object, so a re-attestation also revokes stale
+                // roots from already-running subagent sessions.
+                currentAccess.root = expectedUserRoot;
+                currentAccess.sharedReadOnlyRoots = lockdown.sharedReadOnlyRoots;
+            }
+        }
+        else {
+            this.workspaceAccess.delete(sessionId);
+        }
         this.logger.debug("lockdown.attested", {
             sessionId,
             permissionPreset: lockdown.permissionPreset,
@@ -190,7 +298,7 @@ export class QaPolicyAdmission {
             agentPresetMatches,
             workspaceMatches,
             modelMatches,
-            sandboxIsReadOnly,
+            sandboxModeMatches,
             approvalIsNever,
             permissionPreset: lockdown.permissionPreset,
             toolPolicyLoaded: true,
@@ -199,14 +307,24 @@ export class QaPolicyAdmission {
             toolAllowList: lockdown.toolPolicy.allow,
         };
     }
+    /**
+     * Whether one session went through this boundary. The provenance note is
+     * written only for attested sessions, which is what keeps a deployment's
+     * source rules out of unrelated chats served by the same process.
+     */
+    knowsSession(sessionId) {
+        return this.attested.has(sessionId);
+    }
     /** Detach every pinned tool policy; wired as a disposal effect by the entry. */
     dispose() {
         for (const policy of this.appliedPolicies.values()) {
             policy.disposeRestriction();
             policy.disposeGuard();
-            policy.disposeGuidance();
         }
         this.appliedPolicies.clear();
+        this.attested.clear();
+        this.workspaceAccess.clear();
+        this.disposeWorkspaceGuard();
     }
 }
 //# sourceMappingURL=secure-session.js.map

package/lib/secure-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAGA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAmBpE,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAIT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IANV,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEnE,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;mBAHzB,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;QAEzB,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,SAAiB;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,KAAK;gBACxB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,eAAe,KAAK,SAAS;gBAC5B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CACnD,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;QACF,IACE,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW;YAC3C,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,cAAc,EAC/C,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,QAAQ,CAAC,gBAAgB,sCAAsC,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACzD,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,sBAAsB,CAAC;YACxD,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAChC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS,CAChE,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CACvD,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CACtC,CAAC;YACF,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;gBACrD,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,GAAG;gBACV,IAAI,EAAE,kOAAkO;aACzO,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAClD,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,kBAAkB;oBAClB,eAAe;iBAChB,CAAC,CAAC;gBACH,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,eAAe,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,eAAe,EAAE,CAAC;gBAClB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,KAAK,WAAW,CAAC;QAC7D,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,iBAAiB;YAClB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,iBAAiB;YACjB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,wEAAwE;YACxE,4CAA4C;YAC5C,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;SACzC,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AA0B5D,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAYT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IAdV,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnE;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,qBAAqB,CAAa;IAEnD,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;mBAHzB,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;QAEzB,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,sEAAsE,CAAC;YAChF,CAAC;YACD,OAAO,qBAAqB,CAC1B,SAAS,EACT,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CACC,CAAC;QAC1C,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAC5D,SAAS,CAAC,SAAS,CAAC,CACrB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,YAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAC7C,YAAY,CAAC,EAAE,EACf,eAAe,CAAC,IAAI,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,gBAAgB,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB;gBAChC,eAAe,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CACnD,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;QACF,IACE,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW;YAC3C,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,cAAc,EAC/C,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,QAAQ,CAAC,gBAAgB,wBAAwB,QAAQ,CAAC,WAAW,QAAQ,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACzD,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,sBAAsB,CAAC;YACxD,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAChC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS,CAChE,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CACvD,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CACtC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAClD,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,kBAAkB;iBACnB,CAAC,CAAC;gBACH,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,kBAAkB;YACnB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;oBAClC,IAAI,EAAE,gBAAgB;oBACtB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;iBAClD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gDAAgD;gBAChD,aAAa,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBACtC,aAAa,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,kBAAkB;YAClB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,wEAAwE;YACxE,4CAA4C;YAC5C,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;SACzC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/lib/session-ownership.js

@@ -0,0 +1,55 @@
+/**
+ * Which sessions belong to this deployment.
+ *
+ * The admission boundary attests chat roots. A delegated child never appears
+ * there — its scope chain does not reach the chat's own agent context — so it
+ * inherits its chat from the session that created it. Both interactive seams
+ * (tool approvals and user questions) read ownership from here, which is what
+ * keeps one chat answered by exactly one surface.
+ */
+export class QaSessionOwnership {
+    isAttested;
+    /** Child session → the attested chat that owns it. */
+    inherited = new Map();
+    disposeListener;
+    installed = false;
+    constructor(isAttested) {
+        this.isAttested = isAttested;
+    }
+    /** Listen for the children of an attested chat; safe to call from each seam. */
+    install(ctx) {
+        if (this.installed)
+            return;
+        this.installed = true;
+        this.disposeListener = ctx.on("session/created", (session) => {
+            const parent = session.header.parentSession;
+            if (parent === undefined)
+                return;
+            const root = this.rootOf(String(parent));
+            if (root !== undefined)
+                this.inherited.set(String(session.id), root);
+        });
+    }
+    /** The attested chat behind a session: itself, or the root it inherited. */
+    rootOf(sessionId) {
+        const inherited = this.inherited.get(sessionId);
+        if (inherited !== undefined)
+            return inherited;
+        return this.isAttested(sessionId) ? sessionId : undefined;
+    }
+    /**
+     * Drop one session's inheritance. Called when its agent is gone; the chat's
+     * own claim needs no bookkeeping here, because it resolves through the
+     * admission's attested set, which owns that lifetime.
+     */
+    forget(sessionId) {
+        this.inherited.delete(sessionId);
+    }
+    dispose() {
+        this.inherited.clear();
+        this.disposeListener?.();
+        this.disposeListener = undefined;
+        this.installed = false;
+    }
+}
+//# sourceMappingURL=session-ownership.js.map

package/lib/session-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-ownership.js","sourceRoot":"","sources":["../src/session-ownership.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAMA,UAAU;IALvC,sDAAsD;IACrC,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,eAAe,CAA2B;IAC1C,SAAS,GAAG,KAAK,CAAC;IAE1B,YAA6B,UAA0C;0BAA1C,UAAU;IAAmC,CAAC;IAE3E,gFAAgF;IAChF,OAAO,CAAC,GAAY;QAClB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,SAAiB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACzB,CAAC;CACF"}

package/lib/shared/session-key.js

@@ -0,0 +1,18 @@
+/**
+ * The browser-local key namespace every QA-side index derives from: the
+ * configured storage key pinned to the served route, versioned once so the
+ * Host's head-script injection and the client bundle cannot drift apart.
+ *
+ * Dependency-free like every `src/shared` module: both bundles inline it.
+ */
+/**
+ * The versioned key prefix for browser-local QA state of one deployment.
+ * Callers append their own scope suffix (`:account-token`, `:welcome-notice`,
+ * `:chat:<id>`, …).
+ * @param config - configuration holding the storage key and the route path.
+ * @returns the versioned prefix, e.g. `dsh-qa-surface.session:v1:/qa`.
+ */
+export function qaStorageNamespace(config) {
+    return `${config.session.storageKey}:v1:${config.route.path}`;
+}
+//# sourceMappingURL=session-key.js.map

package/lib/shared/session-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-key.js","sourceRoot":"","sources":["../../src/shared/session-key.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAGE;IAEF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAChE,CAAC"}

package/lib/shared/settings.js

@@ -0,0 +1,10 @@
+/**
+ * Identity shared by the Host plugin and its browser settings card.
+ *
+ * This module must stay dependency-free: the card bundle inlines it, and a
+ * browser build must not pull the Host config surface (schemastery) into the
+ * page just to learn the namespace name.
+ */
+/** Settings namespace the QA surface owns and its card binds to. */
+export const QA_SURFACE_SETTINGS_NAMESPACE = "qa-surface";
+//# sourceMappingURL=settings.js.map

package/lib/shared/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/shared/settings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAC"}

package/lib/thinking-phrases.js

@@ -0,0 +1,68 @@
+/**
+ * Phrases the running indicator cycles through. The list deliberately mixes
+ * Russian idiom with workshop imagery: a turn that keeps reshuffling the same
+ * thought in new words reads as alive, while a frozen one reads as stuck.
+ *
+ * Operators replace the list through `thinkingPhrases`; this module holds the
+ * canonical default so the config schema, the resolver and the browser all
+ * read one list.
+ */
+export const DEFAULT_THINKING_PHRASES = Object.freeze([
+    "Скребу по сусекам…",
+    "Кумекаю…",
+    "Навожу резкость…",
+    "Собираю мысли в кучку…",
+    "Раскладываю по полочкам…",
+    "Сверяю приметы…",
+    "Шлифую мысли…",
+    "Раскидываю умом…",
+    "Обтачиваю формулировки…",
+    "Ломаю голову…",
+    "Затачиваю аргументы…",
+    "Шевелю извилинами…",
+    "Правлю напильником…",
+    "Разматываю клубок…",
+    "Снимаю стружку…",
+    "Вяжу концы с концами…",
+    "Фрезерую крайние случаи…",
+    "Меряю семь раз…",
+    "Прокаливаю гипотезы…",
+    "Смотрю в корень…",
+    "Отливаю форму решения…",
+    "Ставлю точки над i…",
+    "Кую версию…",
+    "Разбираю по косточкам…",
+    "Калибрую допуски…",
+    "Прикидываю так и эдак…",
+    "Считаю допуски и посадки…",
+    "Взвешиваю за и против…",
+    "Меряю штангенциркулем…",
+    "Читаю между строк…",
+    "Сверяю по чертежу…",
+    "Тяну за ниточку…",
+    "Проверяю биение…",
+    "Перебираю варианты…",
+    "Зачищаю заусенцы…",
+    "Жонглирую версиями…",
+    "Центрую заготовку…",
+    "Подшиваю факты к делу…",
+    "Обкатываю механизм…",
+    "Плету сеть доводов…",
+    "Собираю узел…",
+    "Думаю думу…",
+    "Гну по шаблону…",
+    "Сверяю с ГОСТом…",
+]);
+/** How long one phrase stays on screen before the next one takes over. */
+const PHRASE_INTERVAL_MS = 4_000;
+/**
+ * Phrase shown `elapsedMs` into a running turn. The list is operator supplied,
+ * so an empty one falls back to the default: the indicator always needs a
+ * label.
+ */
+export function thinkingPhrase(elapsedMs, phrases = DEFAULT_THINKING_PHRASES) {
+    const pool = phrases.length === 0 ? DEFAULT_THINKING_PHRASES : phrases;
+    const index = Math.floor(Math.max(0, elapsedMs) / PHRASE_INTERVAL_MS) % pool.length;
+    return pool[index];
+}
+//# sourceMappingURL=thinking-phrases.js.map

package/lib/thinking-phrases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thinking-phrases.js","sourceRoot":"","sources":["../src/thinking-phrases.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvE,oBAAoB;IACpB,UAAU;IACV,kBAAkB;IAClB,wBAAwB;IACxB,0BAA0B;IAC1B,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,yBAAyB;IACzB,eAAe;IACf,sBAAsB;IACtB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;IACvB,0BAA0B;IAC1B,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;IAClB,wBAAwB;IACxB,qBAAqB;IACrB,aAAa;IACb,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;IACxB,2BAA2B;IAC3B,wBAAwB;IACxB,wBAAwB;IACxB,oBAAoB;IACpB,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,wBAAwB;IACxB,qBAAqB;IACrB,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,OAAO,GAAsB,wBAAwB;IAErD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACxE,OAAO,IAAI,CAAC,KAAK,CAAW,CAAC;AAC/B,CAAC"}