agim-cli 1.2.21 → 1.2.34

package/dist/core/access-token.d.ts

@@ -1,3 +1,4 @@
+export type TokenRole = 'admin' | 'user';
 export interface TokenRow {
     id: string;
     label: string;
@@ -5,20 +6,45 @@ export interface TokenRow {
     hash: string;
     created_at: number;
     last_used_at: number | null;
+    /** Granted role. Optional on disk for back-compat with pre-R12 token
+     *  files — readers MUST treat missing field as 'admin' since that was
+     *  the implicit behaviour before role gating landed. New tokens
+     *  default to 'admin' too (operator-friendly); the operator can
+     *  explicitly demote by passing `role: 'user'` to createToken or via
+     *  the PATCH /api/tokens/:id endpoint. */
+    role?: TokenRole;
 }
 /** Raw token format: `agim_` + 40 hex chars. Easy to identify in logs. */
 export declare function generateRawToken(): string;
 /** Create + persist a new token. Returns the raw value (caller must
  *  surface it to the operator immediately — it is NOT recoverable later). */
-export declare function createToken(label: string): {
+export declare function createToken(label: string, opts?: {
+    actor?: string;
+    traceId?: string;
+    role?: TokenRole;
+}): {
     id: string;
     raw: string;
     createdAt: number;
+    role: TokenRole;
 };
 /** List tokens with secrets stripped. */
 export declare function listTokens(): Array<Omit<TokenRow, 'hash'>>;
+/** Resolve the role of a token by id. Missing field reads as 'admin'
+ *  for back-compat with pre-R12 tokens.json files. */
+export declare function getTokenRole(id: string): TokenRole;
+/** Convenience: true iff the token's role is 'admin'. */
+export declare function isAdminTokenId(id: string): boolean;
+/** Demote / promote an existing token. Returns true on change. */
+export declare function setTokenRole(id: string, role: TokenRole, opts?: {
+    actor?: string;
+    traceId?: string;
+}): boolean;
 /** Revoke (delete) a token by id. Returns true if a row was removed. */
-export declare function revokeToken(id: string): boolean;
+export declare function revokeToken(id: string, opts?: {
+    actor?: string;
+    traceId?: string;
+}): boolean;
 /**
  * Verify a raw token. Updates `last_used_at` on success. Returns the
  * matching row id, or null if no match. Uses timing-safe comparison on
@@ -27,11 +53,31 @@ export declare function revokeToken(id: string): boolean;
 export declare function verifyToken(raw: string): string | null;
 /** True when at least one token is registered. */
 export declare function hasAnyToken(): boolean;
+/** Consume the in-memory bootstrap-token holder. Intended for interactive
+ *  CLI flows that need the raw value once and then drop it. Returns null
+ *  after the first call or when no bootstrap happened. */
+export declare function consumeBootstrapTokenRaw(): {
+    raw: string;
+    id: string;
+} | null;
 /**
  * First-launch helper. If no token exists and IMHUB_WEB_AUTH !== 'off',
- * create a bootstrap token and surface the raw value to stdout + the pino
- * logger. Idempotent — does nothing if any token already exists. Returns
- * the raw value when generated, null otherwise.
+ * create a bootstrap token. Idempotent — does nothing if any token
+ * already exists. Returns the raw value when generated, null otherwise.
+ *
+ * Compliance note (R13 A3): the raw token value is NEVER written to
+ * stdout or pino — both go to journald in systemd deployments where any
+ * `journalctl -u agim` reader could harvest the token before the
+ * operator consumes it. Instead we:
+ *
+ *   - print a banner that *points* at tokens.json + invites the
+ *     operator to run `agim token bootstrap` (an interactive CLI that
+ *     reads the cached value via consumeBootstrapTokenRaw)
+ *   - emit a structured log with the id only (no raw)
+ *
+ * The raw is still returned from this function (callers like the
+ * interactive setup may print it directly to their TTY), so existing
+ * behaviour for non-systemd installs is preserved.
  */
 export declare function bootstrapIfEmpty(): string | null;
 /** True iff token auth is enabled (env opt-out turned off). */

package/dist/core/access-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/core/access-token.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AA2BD,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD;6EAC6E;AAC7E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAczF;AAED,yCAAyC;AACzC,wBAAgB,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAO1D;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAO/C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBtD;AAED,kDAAkD;AAClD,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CA0BhD;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,QAAc,CAAA"}
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/core/access-token.ts"],"names":[],"mappings":"AAuCA,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,CAAA;AAExC,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;;;;;8CAK0C;IAC1C,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB;AA2BD,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD;6EAC6E;AAC7E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CA+BzK;AAED,yCAAyC;AACzC,wBAAgB,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAQ1D;AAED;sDACsD;AACtD,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAIlD;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAsB9G;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAmB5F;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBtD;AAED,kDAAkD;AAClD,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAOD;;0DAE0D;AAC1D,wBAAgB,wBAAwB,IAAI;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CA6BhD;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,QAAc,CAAA"}

package/dist/core/access-token.js

@@ -65,20 +65,38 @@ function newId() {
 }
 /** Create + persist a new token. Returns the raw value (caller must
  *  surface it to the operator immediately — it is NOT recoverable later). */
-export function createToken(label) {
+export function createToken(label, opts) {
     const data = readFile();
     const raw = generateRawToken();
     const id = newId();
+    const role = opts?.role === 'user' ? 'user' : 'admin';
     const row = {
         id,
         label: label || `token-${data.tokens.length + 1}`,
         hash: sha256Hex(raw),
         created_at: Math.floor(Date.now() / 1000),
         last_used_at: null,
+        role,
     };
     data.tokens.push(row);
     writeFile(data);
-    return { id, raw, createdAt: row.created_at };
+    // R12 ⑤ — persistent audit row. Label is operator-supplied and
+    // intended for display, so it goes into details (not the raw token).
+    void (async () => {
+        try {
+            const { logAuditEvent } = await import('./audit-log.js');
+            logAuditEvent({
+                traceId: opts?.traceId,
+                eventType: 'token.create',
+                actor: opts?.actor ?? 'system',
+                target: id,
+                outcome: 'ok',
+                details: { label: row.label, role },
+            });
+        }
+        catch { /* best-effort */ }
+    })();
+    return { id, raw, createdAt: row.created_at, role };
 }
 /** List tokens with secrets stripped. */
 export function listTokens() {
@@ -87,16 +105,69 @@ export function listTokens() {
         label: t.label,
         created_at: t.created_at,
         last_used_at: t.last_used_at,
+        role: t.role ?? 'admin',
     }));
 }
+/** Resolve the role of a token by id. Missing field reads as 'admin'
+ *  for back-compat with pre-R12 tokens.json files. */
+export function getTokenRole(id) {
+    if (!id)
+        return 'admin'; // empty id never returned by verifyToken; defensive default
+    const row = readFile().tokens.find((t) => t.id === id);
+    return row?.role ?? 'admin';
+}
+/** Convenience: true iff the token's role is 'admin'. */
+export function isAdminTokenId(id) {
+    return getTokenRole(id) === 'admin';
+}
+/** Demote / promote an existing token. Returns true on change. */
+export function setTokenRole(id, role, opts) {
+    const data = readFile();
+    const row = data.tokens.find((t) => t.id === id);
+    if (!row)
+        return false;
+    const prev = row.role ?? 'admin';
+    if (prev === role)
+        return false;
+    row.role = role;
+    writeFile(data);
+    void (async () => {
+        try {
+            const { logAuditEvent } = await import('./audit-log.js');
+            logAuditEvent({
+                traceId: opts?.traceId,
+                eventType: role === 'admin' ? 'admin.elevate' : 'admin.revoke',
+                actor: opts?.actor ?? 'system',
+                target: id,
+                outcome: 'ok',
+                details: { from: prev, to: role, label: row.label },
+            });
+        }
+        catch { /* best-effort */ }
+    })();
+    return true;
+}
 /** Revoke (delete) a token by id. Returns true if a row was removed. */
-export function revokeToken(id) {
+export function revokeToken(id, opts) {
     const data = readFile();
     const before = data.tokens.length;
     data.tokens = data.tokens.filter((t) => t.id !== id);
     if (data.tokens.length === before)
         return false;
     writeFile(data);
+    void (async () => {
+        try {
+            const { logAuditEvent } = await import('./audit-log.js');
+            logAuditEvent({
+                traceId: opts?.traceId,
+                eventType: 'token.revoke',
+                actor: opts?.actor ?? 'system',
+                target: id,
+                outcome: 'ok',
+            });
+        }
+        catch { /* best-effort */ }
+    })();
     return true;
 }
 /**
@@ -135,35 +206,63 @@ export function verifyToken(raw) {
 export function hasAnyToken() {
     return readFile().tokens.length > 0;
 }
+/** Cache the raw bootstrap token so a one-shot CLI (`agim token bootstrap`)
+ *  can fetch it via an in-process call without parsing stdout. Cleared
+ *  after first retrieval. Process-local; never written to disk. */
+let _bootstrapRawHolder = null;
+/** Consume the in-memory bootstrap-token holder. Intended for interactive
+ *  CLI flows that need the raw value once and then drop it. Returns null
+ *  after the first call or when no bootstrap happened. */
+export function consumeBootstrapTokenRaw() {
+    const v = _bootstrapRawHolder;
+    _bootstrapRawHolder = null;
+    return v;
+}
 /**
  * First-launch helper. If no token exists and IMHUB_WEB_AUTH !== 'off',
- * create a bootstrap token and surface the raw value to stdout + the pino
- * logger. Idempotent — does nothing if any token already exists. Returns
- * the raw value when generated, null otherwise.
+ * create a bootstrap token. Idempotent — does nothing if any token
+ * already exists. Returns the raw value when generated, null otherwise.
+ *
+ * Compliance note (R13 A3): the raw token value is NEVER written to
+ * stdout or pino — both go to journald in systemd deployments where any
+ * `journalctl -u agim` reader could harvest the token before the
+ * operator consumes it. Instead we:
+ *
+ *   - print a banner that *points* at tokens.json + invites the
+ *     operator to run `agim token bootstrap` (an interactive CLI that
+ *     reads the cached value via consumeBootstrapTokenRaw)
+ *   - emit a structured log with the id only (no raw)
+ *
+ * The raw is still returned from this function (callers like the
+ * interactive setup may print it directly to their TTY), so existing
+ * behaviour for non-systemd installs is preserved.
  */
 export function bootstrapIfEmpty() {
     if ((process.env.IMHUB_WEB_AUTH || '').toLowerCase() === 'off')
         return null;
     if (hasAnyToken())
         return null;
-    const t = createToken('bootstrap');
+    const t = createToken('bootstrap', { role: 'admin' });
+    _bootstrapRawHolder = { raw: t.raw, id: t.id };
     log.warn({
         event: 'access-token.bootstrap_generated',
         id: t.id,
-        msg: 'web auth bootstrap token generated (see stdout for the raw value)',
-    });
+    }, 'web auth bootstrap token generated (run `agim token bootstrap` on the host to print the raw value once)');
     const banner = [
         '',
         '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━',
-        '🔑 Web auth bootstrap token (paste this at /login):',
-        '',
-        `   ${t.raw}`,
+        '🔑 Web auth bootstrap token generated.',
         '',
         `   id    : ${t.id}`,
-        `   path  : ${TOKENS_FILE}`,
+        `   file  : ${TOKENS_FILE}  (chmod 0o600)`,
+        '',
+        '   To retrieve the raw token (one-time, on this host):',
+        '       agim token bootstrap',
+        '',
+        '   Or rotate to a fresh token:',
+        '       agim token create <label>',
         '',
-        '   Manage tokens later with:  agim token list | create | revoke',
-        '   Disable auth entirely with:  IMHUB_WEB_AUTH=off',
+        '   Disable auth entirely:  IMHUB_WEB_AUTH=off',
         '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━',
         '',
     ].join('\n');

package/dist/core/access-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/core/access-token.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,kCAAkC;AAClC,EAAE;AACF,WAAW;AACX,sFAAsF;AACtF,0EAA0E;AAC1E,8CAA8C;AAC9C,EAAE;AACF,aAAa;AACb,4EAA4E;AAC5E,6EAA6E;AAC7E,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,gDAAgD;AAChD,yEAAyE;AACzE,iEAAiE;AACjE,8CAA8C;AAC9C,EAAE;AACF,YAAY;AACZ,6EAA6E;AAC7E,gEAAgE;AAEhE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;AAClD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAA;AAe3D,SAAS,QAAQ;IACf,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAc,CAAA;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAC9D,+CAA+C,CAAC,CAAA;QAClD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACvB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAe;IAChC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,CAAC;QAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAA;IAC9B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAa;QACpB,EAAE;QACF,KAAK,EAAE,KAAK,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;QACjD,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;QACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,YAAY,EAAE,IAAI;KACnB,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrB,SAAS,CAAC,IAAI,CAAC,CAAA;IACf,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAA;AAC/C,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,UAAU;IACxB,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC,CAAC,CAAA;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAC/C,SAAS,CAAC,IAAI,CAAC,CAAA;IACf,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAQ;QAAC,CAAC;QACpB,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,SAAQ;QAC3C,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;YAChD,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;YACtE,OAAO,GAAG,CAAC,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,WAAW;IACzB,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC3E,IAAI,WAAW,EAAE;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAClC,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,kCAAkC;QACzC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,mEAAmE;KACzE,CAAC,CAAA;IACF,MAAM,MAAM,GAAG;QACb,EAAE;QACF,4DAA4D;QAC5D,qDAAqD;QACrD,EAAE;QACF,MAAM,CAAC,CAAC,GAAG,EAAE;QACb,EAAE;QACF,cAAc,CAAC,CAAC,EAAE,EAAE;QACpB,cAAc,WAAW,EAAE;QAC3B,EAAE;QACF,iEAAiE;QACjE,oDAAoD;QACpD,4DAA4D;QAC5D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5B,OAAO,CAAC,CAAC,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa;IAC3B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAA;AACnE,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA"}
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/core/access-token.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,kCAAkC;AAClC,EAAE;AACF,WAAW;AACX,sFAAsF;AACtF,0EAA0E;AAC1E,8CAA8C;AAC9C,EAAE;AACF,aAAa;AACb,4EAA4E;AAC5E,6EAA6E;AAC7E,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,gDAAgD;AAChD,yEAAyE;AACzE,iEAAiE;AACjE,8CAA8C;AAC9C,EAAE;AACF,YAAY;AACZ,6EAA6E;AAC7E,gEAAgE;AAEhE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;AAClD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAA;AAwB3D,SAAS,QAAQ;IACf,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAc,CAAA;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAC9D,+CAA+C,CAAC,CAAA;QAClD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACvB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAe;IAChC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,CAAC;QAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,IAA6D;IACtG,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAA;IAC9B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAc,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAChE,MAAM,GAAG,GAAa;QACpB,EAAE;QACF,KAAK,EAAE,KAAK,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;QACjD,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;QACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,YAAY,EAAE,IAAI;QAClB,IAAI;KACL,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrB,SAAS,CAAC,IAAI,CAAC,CAAA;IACf,+DAA+D;IAC/D,qEAAqE;IACrE,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;YACxD,aAAa,CAAC;gBACZ,OAAO,EAAE,IAAI,EAAE,OAAO;gBACtB,SAAS,EAAE,cAAc;gBACzB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ;gBAC9B,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE;aACpC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,UAAU;IACxB,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;KACxB,CAAC,CAAC,CAAA;AACL,CAAC;AAED;sDACsD;AACtD,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,IAAI,CAAC,EAAE;QAAE,OAAO,OAAO,CAAA,CAAE,4DAA4D;IACrF,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACtD,OAAO,GAAG,EAAE,IAAI,IAAI,OAAO,CAAA;AAC7B,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,YAAY,CAAC,EAAE,CAAC,KAAK,OAAO,CAAA;AACrC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,IAAe,EAAE,IAA2C;IACnG,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,MAAM,IAAI,GAAc,GAAG,CAAC,IAAI,IAAI,OAAO,CAAA;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IACf,SAAS,CAAC,IAAI,CAAC,CAAA;IACf,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;YACxD,aAAa,CAAC;gBACZ,OAAO,EAAE,IAAI,EAAE,OAAO;gBACtB,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;gBAC9D,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ;gBAC9B,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;aACpD,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,IAAI,CAAA;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,IAA2C;IACjF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAC/C,SAAS,CAAC,IAAI,CAAC,CAAA;IACf,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;YACxD,aAAa,CAAC;gBACZ,OAAO,EAAE,IAAI,EAAE,OAAO;gBACtB,SAAS,EAAE,cAAc;gBACzB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ;gBAC9B,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAQ;QAAC,CAAC;QACpB,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,SAAQ;QAC3C,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;YAChD,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;YACtE,OAAO,GAAG,CAAC,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,WAAW;IACzB,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;mEAEmE;AACnE,IAAI,mBAAmB,GAAuC,IAAI,CAAA;AAElE;;0DAE0D;AAC1D,MAAM,UAAU,wBAAwB;IACtC,MAAM,CAAC,GAAG,mBAAmB,CAAA;IAC7B,mBAAmB,GAAG,IAAI,CAAA;IAC1B,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC3E,IAAI,WAAW,EAAE;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,CAAC,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;IAC9C,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,kCAAkC;QACzC,EAAE,EAAE,CAAC,CAAC,EAAE;KACT,EAAE,yGAAyG,CAAC,CAAA;IAC7G,MAAM,MAAM,GAAG;QACb,EAAE;QACF,4DAA4D;QAC5D,wCAAwC;QACxC,EAAE;QACF,cAAc,CAAC,CAAC,EAAE,EAAE;QACpB,cAAc,WAAW,iBAAiB;QAC1C,EAAE;QACF,wDAAwD;QACxD,6BAA6B;QAC7B,EAAE;QACF,gCAAgC;QAChC,kCAAkC;QAClC,EAAE;QACF,+CAA+C;QAC/C,4DAA4D;QAC5D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5B,OAAO,CAAC,CAAC,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa;IAC3B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAA;AACnE,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA"}

package/dist/core/acp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acp-server.d.ts","sourceRoot":"","sources":["../../src/core/acp-server.ts"],"names":[],"mappings":"AA6GA,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA0K/C"}
+{"version":3,"file":"acp-server.d.ts","sourceRoot":"","sources":["../../src/core/acp-server.ts"],"names":[],"mappings":"AA6GA,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAgN/C"}

package/dist/core/acp-server.js

@@ -271,13 +271,54 @@ export async function startACPServer(options) {
         }
         sendJson(res, 404, { error: 'Not found' });
     });
+    // R13 A2 — bind defaults to 127.0.0.1 (loopback only). Operators
+    // who run A2A across hosts can opt-in with IMHUB_ACP_BIND=<addr>.
+    // We warn loudly when non-loopback so the deployment audit log
+    // captures the elevation; the bearer-token gate (parseAuth)
+    // remains the only client-facing protection regardless.
+    const bind = (process.env.IMHUB_ACP_BIND || '127.0.0.1').trim();
+    const isLoopback = bind === '127.0.0.1' || bind === '::1' || bind === 'localhost';
     await new Promise((resolve) => {
-        server.listen(port, '127.0.0.1', () => resolve());
+        server.listen(port, bind, () => resolve());
     });
-    rootLogger.info({ component: 'acp', port }, `ACP Server listening on http://127.0.0.1:${port}`);
+    if (!isLoopback) {
+        rootLogger.warn({
+            component: 'acp',
+            event: 'acp.server.non_loopback_bind',
+            bind, port,
+        }, `⚠️  ACP Server bound to ${bind}:${port} — accessible beyond loopback. `
+            + `Ensure your firewall restricts ${bind}:${port} to trusted hosts; `
+            + `bearer-token gate is the only client-facing protection.`);
+        // Also emit a persistent audit row so the binding decision is
+        // visible in /api/audit/events long after the boot log rolls.
+        try {
+            const { logAuditEvent } = await import('./audit-log.js');
+            logAuditEvent({
+                eventType: 'config.put',
+                actor: 'system',
+                target: 'acp-server.bind',
+                outcome: 'ok',
+                details: { bind, port, loopback: false },
+            });
+        }
+        catch { /* best-effort */ }
+    }
+    rootLogger.info({ component: 'acp', port, bind }, `ACP Server listening on http://${bind}:${port}`);
     return {
         port,
-        close: () => { server.close(); },
+        close: () => {
+            server.close();
+            // R14 — force-drop in-flight connections so port releases
+            // immediately (mirror of the web server close behavior). Without
+            // this, a long /tasks SSE stream keeps port 9090 bound across
+            // restarts.
+            try {
+                const fn = server.closeAllConnections;
+                if (typeof fn === 'function')
+                    fn.call(server);
+            }
+            catch { /* ignore */ }
+        },
     };
 }
 //# sourceMappingURL=acp-server.js.map

package/dist/core/acp-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"acp-server.js","sourceRoot":"","sources":["../../src/core/acp-server.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,kCAAkC;AAClC,wCAAwC;AACxC,+DAA+D;AAC/D,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AAErE,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AACnD,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,uBAAuB;AACvB,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AACtD,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAE,QAAQ;AAEhD,SAAS,mBAAmB;IAC1B,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACrD,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,aAAa,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QAAC,OAAO,mBAAmB,EAAE,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB;IACrC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAEtF,oCAAoC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAE3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,GAAmB;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,OAAO;gBAAE,OAAM;YACnB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAA;YACjB,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC3B,OAAO,GAAG,IAAI,CAAA;gBACd,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;gBACzD,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,wBAAwB,CAAuD,CAAA;gBACrG,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAA;gBAClB,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAA;AAEtD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAA;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAA;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAA;QAE/D,qCAAqC;QACrC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAA;QACnE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6CAA6C,CAAC,CAAA;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QAEvE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QAEnE,kBAAkB;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC3D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,0CAA0C;gBACvD,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,YAAY,EAAE;oBACZ,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC9C;gBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACzB,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,cAAc;QACd,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwE,CAAA;gBAC1G,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;gBAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;gBAC5B,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAA;gBAC/C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;oBACnB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAA;oBACrD,OAAM;gBACR,CAAC;gBAED,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBAC7C,gEAAgE;gBAChE,6BAA6B;gBAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;gBACpE,MAAM,OAAO,GAAG,aAAa,IAAI,eAAe,EAAE,CAAA;gBAClD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBAE1F,oEAAoE;gBACpE,+DAA+D;gBAC/D,iEAAiE;gBACjE,mEAAmE;gBACnE,IAAI,KAAK,GAAG,CAAC,CAAA;gBACb,IAAI,CAAC;oBACH,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;oBAC9C,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAClC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACvG,oDAAoD,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,QAAQ,GAAiB;oBAC7B,gEAAgE;oBAChE,4DAA4D;oBAC5D,kDAAkD;oBAClD,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,eAAe,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE;oBAClF,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,OAAO;oBACP,MAAM;oBACN,MAAM,EAAE,YAAY;iBACrB,CAAA;gBAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACzC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAEnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,yBAAyB;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,cAAc,EAAE,mBAAmB;wBACnC,eAAe,EAAE,UAAU;wBAC3B,UAAU,EAAE,YAAY;wBACxB,WAAW,EAAE,MAAM;qBACpB,CAAC,CAAA;oBAEF,IAAI,QAAQ,GAAG,EAAE,CAAA;oBACjB,IAAI,CAAC;wBACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;4BAC/B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;4BACzE,QAAQ,GAAG,MAAM,CAAA;wBACnB,CAAC;6BAAM,CAAC;4BACN,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gCACjC,QAAQ,IAAI,KAAK,CAAA;gCACjB,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;4BAC1E,CAAC;wBACH,CAAC;wBACD,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;wBAC7B,+DAA+D;wBAC/D,gEAAgE;wBAChE,gEAAgE;wBAChE,IAAI,KAAK,EAAE,CAAC;4BACV,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC,MAAM,MAAM,QAAQ,CAAA,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAA;wBAC3G,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,GAAG,CAAC,GAAG,EAAE,CAAA;oBACX,CAAC;oBACD,OAAM;gBACR,CAAC;gBAED,YAAY;gBACZ,IAAI,YAAY,GAAG,EAAE,CAAA;gBACrB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,YAAY,GAAG,MAAM,CAAA;gBACvB,CAAC;qBAAM,CAAC;oBACN,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBACjC,YAAY,IAAI,KAAK,CAAA;oBACvB,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC,MAAM,MAAM,YAAY,CAAA,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAA;gBAC/G,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;iBAClC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,GAAyD,CAAA;gBACnE,IAAI,CAAC,EAAE,OAAO;oBAAE,OAAM,CAAE,+BAA+B;gBACvD,MAAM,MAAM,GAAG,CAAC,EAAE,UAAU,IAAI,GAAG,CAAA;gBACnC,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACxD,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7D,CAAC;YACD,OAAM;QACR,CAAC;QAED,iBAAiB;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;YACvC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;gBACxD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;aAC9B,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,4CAA4C,IAAI,EAAE,CAAC,CAAA;IAE/F,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC;KAChC,CAAA;AACH,CAAC"}
+{"version":3,"file":"acp-server.js","sourceRoot":"","sources":["../../src/core/acp-server.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,kCAAkC;AAClC,wCAAwC;AACxC,+DAA+D;AAC/D,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AAErE,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AACnD,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,uBAAuB;AACvB,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AACtD,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAE,QAAQ;AAEhD,SAAS,mBAAmB;IAC1B,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACrD,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,aAAa,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QAAC,OAAO,mBAAmB,EAAE,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB;IACrC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAEtF,oCAAoC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAE3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,GAAmB;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,OAAO;gBAAE,OAAM;YACnB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAA;YACjB,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC3B,OAAO,GAAG,IAAI,CAAA;gBACd,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;gBACzD,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,wBAAwB,CAAuD,CAAA;gBACrG,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAA;gBAClB,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAA;AAEtD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAA;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAA;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAA;QAE/D,qCAAqC;QACrC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAA;QACnE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6CAA6C,CAAC,CAAA;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QAEvE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QAEnE,kBAAkB;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC3D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,0CAA0C;gBACvD,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,YAAY,EAAE;oBACZ,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC9C;gBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACzB,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,cAAc;QACd,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwE,CAAA;gBAC1G,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;gBAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;gBAC5B,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAA;gBAC/C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;oBACnB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAA;oBACrD,OAAM;gBACR,CAAC;gBAED,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBAC7C,gEAAgE;gBAChE,6BAA6B;gBAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;gBACpE,MAAM,OAAO,GAAG,aAAa,IAAI,eAAe,EAAE,CAAA;gBAClD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBAE1F,oEAAoE;gBACpE,+DAA+D;gBAC/D,iEAAiE;gBACjE,mEAAmE;gBACnE,IAAI,KAAK,GAAG,CAAC,CAAA;gBACb,IAAI,CAAC;oBACH,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;oBAC9C,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAClC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACvG,oDAAoD,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,QAAQ,GAAiB;oBAC7B,gEAAgE;oBAChE,4DAA4D;oBAC5D,kDAAkD;oBAClD,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,eAAe,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE;oBAClF,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,OAAO;oBACP,MAAM;oBACN,MAAM,EAAE,YAAY;iBACrB,CAAA;gBAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACzC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAEnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,yBAAyB;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,cAAc,EAAE,mBAAmB;wBACnC,eAAe,EAAE,UAAU;wBAC3B,UAAU,EAAE,YAAY;wBACxB,WAAW,EAAE,MAAM;qBACpB,CAAC,CAAA;oBAEF,IAAI,QAAQ,GAAG,EAAE,CAAA;oBACjB,IAAI,CAAC;wBACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;4BAC/B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;4BACzE,QAAQ,GAAG,MAAM,CAAA;wBACnB,CAAC;6BAAM,CAAC;4BACN,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gCACjC,QAAQ,IAAI,KAAK,CAAA;gCACjB,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;4BAC1E,CAAC;wBACH,CAAC;wBACD,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;wBAC7B,+DAA+D;wBAC/D,gEAAgE;wBAChE,gEAAgE;wBAChE,IAAI,KAAK,EAAE,CAAC;4BACV,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC,MAAM,MAAM,QAAQ,CAAA,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAA;wBAC3G,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,GAAG,CAAC,GAAG,EAAE,CAAA;oBACX,CAAC;oBACD,OAAM;gBACR,CAAC;gBAED,YAAY;gBACZ,IAAI,YAAY,GAAG,EAAE,CAAA;gBACrB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,YAAY,GAAG,MAAM,CAAA;gBACvB,CAAC;qBAAM,CAAC;oBACN,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBACjC,YAAY,IAAI,KAAK,CAAA;oBACvB,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC,MAAM,MAAM,YAAY,CAAA,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAA;gBAC/G,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;iBAClC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,GAAyD,CAAA;gBACnE,IAAI,CAAC,EAAE,OAAO;oBAAE,OAAM,CAAE,+BAA+B;gBACvD,MAAM,MAAM,GAAG,CAAC,EAAE,UAAU,IAAI,GAAG,CAAA;gBACnC,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACxD,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7D,CAAC;YACD,OAAM;QACR,CAAC;QAED,iBAAiB;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;YACvC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;gBACxD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;aAC9B,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,4DAA4D;IAC5D,wDAAwD;IACxD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/D,MAAM,UAAU,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAA;IACjF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC;YACd,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,8BAA8B;YACrC,IAAI,EAAE,IAAI;SACX,EAAE,2BAA2B,IAAI,IAAI,IAAI,iCAAiC;cACtE,kCAAkC,IAAI,IAAI,IAAI,qBAAqB;cACnE,yDAAyD,CAAC,CAAA;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;YACxD,aAAa,CAAC;gBACZ,SAAS,EAAE,YAAY;gBACvB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;aACzC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,kCAAkC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IAEnG,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,0DAA0D;YAC1D,iEAAiE;YACjE,8DAA8D;YAC9D,YAAY;YACZ,IAAI,CAAC;gBACH,MAAM,EAAE,GAAI,MAA0D,CAAC,mBAAmB,CAAA;gBAC1F,IAAI,OAAO,EAAE,KAAK,UAAU;oBAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/core/admin-allowlist.d.ts

@@ -13,7 +13,10 @@ export declare function listAdmins(): Array<{
 /** Add an admin at runtime: in-memory immediately + persist to env file so
  *  the next restart still has them. Idempotent — duplicates are skipped.
  *  Returns true if added, false if already present. */
-export declare function promoteAdmin(platform: string, userId: string): Promise<boolean>;
+export declare function promoteAdmin(platform: string, userId: string, opts?: {
+    actor?: string;
+    traceId?: string;
+}): Promise<boolean>;
 /** Localized denial message. Three cases:
  *    A. No admins at all → "首次部署"，引导查 setup token
  *    B. Admins exist, you're not one → 礼貌拒绝，建议联系部署者

package/dist/core/admin-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-allowlist.d.ts","sourceRoot":"","sources":["../../src/core/admin-allowlist.ts"],"names":[],"mappings":"AA8DA;;6DAE6D;AAC7D,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;yBACyB;AACzB,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAI7E;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,IAAI,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAExE;AAED;;uDAEuD;AACvD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBrF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAsBlF;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,IAAI,IAAI,CAIlC"}
+{"version":3,"file":"admin-allowlist.d.ts","sourceRoot":"","sources":["../../src/core/admin-allowlist.ts"],"names":[],"mappings":"AA8DA;;6DAE6D;AAC7D,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;yBACyB;AACzB,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAI7E;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,IAAI,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAExE;AAED;;uDAEuD;AACvD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAqClI;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAsBlF;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,IAAI,IAAI,CAIlC"}

package/dist/core/admin-allowlist.js

@@ -70,7 +70,7 @@ export function listAdmins() {
 /** Add an admin at runtime: in-memory immediately + persist to env file so
  *  the next restart still has them. Idempotent — duplicates are skipped.
  *  Returns true if added, false if already present. */
-export async function promoteAdmin(platform, userId) {
+export async function promoteAdmin(platform, userId, opts) {
     if (!userId)
         throw new Error('userId required');
     const p = platform.toLowerCase();
@@ -95,6 +95,19 @@ export async function promoteAdmin(platform, userId) {
             err: err instanceof Error ? err.message : String(err),
         }, 'in-memory admin add succeeded but env-file write failed; will be lost on restart');
     }
+    // R12 ⑤ — persistent audit row. Tracks who got admin'd, by whom, when.
+    try {
+        const { logAuditEvent } = await import('./audit-log.js');
+        logAuditEvent({
+            traceId: opts?.traceId,
+            eventType: 'admin.elevate',
+            actor: opts?.actor ?? 'system',
+            target: `${p}:${userId}`,
+            outcome: 'ok',
+            details: { total: getEntries().length },
+        });
+    }
+    catch { /* audit best-effort */ }
     return true;
 }
 /** Localized denial message. Three cases:

package/dist/core/admin-allowlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-allowlist.js","sourceRoot":"","sources":["../../src/core/admin-allowlist.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,mEAAmE;AACnE,EAAE;AACF,0EAA0E;AAC1E,YAAY;AACZ,+DAA+D;AAC/D,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,yCAAyC;AAEzC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAO9D,IAAI,aAAa,GAAmB,IAAI,CAAA;AACxC,IAAI,SAAS,GAAG,EAAE,CAAA;AAClB;;uCAEuC;AACvC,MAAM,cAAc,GAAY,EAAE,CAAA;AAElC,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAY,EAAE,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,EACnE,4DAA4D,CAAC,CAAA;YAC/D,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE;YAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAA;IAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,SAAS,GAAG,GAAG,CAAA;QACf,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IACD,qEAAqE;IACrE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,CAAA;AACtD,CAAC;AAED;;6DAE6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,OAAO,UAAU,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;yBACyB;AACzB,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,MAA0B;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;AAC1E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU;IACxB,OAAO,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED;;uDAEuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc;IACjE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnF,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAE5C,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/E,aAAa,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC9C,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,0BAA0B;YACjC,QAAQ,EAAE,CAAC;YACX,MAAM;YACN,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM;SAC3B,EAAE,mDAAmD,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,gCAAgC;YACvC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,EAAE,kFAAkF,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAA0B;IACxE,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,mEAAmE;QACnE,2DAA2D;QAC3D,OAAO,CACL,sBAAsB;YACtB,IAAI;YACJ,eAAe;YACf,wEAAwE;YACxE,iDAAiD;YACjD,wCAAwC;YACxC,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,YAAY;YACtF,IAAI;YACJ,4BAA4B,CAC7B,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,6BAA6B;IAC7B,OAAO,CACL,kBAAkB;QAClB,4CAA4C,CAC7C,CAAA;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW;IACzB,aAAa,GAAG,IAAI,CAAA;IACpB,SAAS,GAAG,EAAE,CAAA;IACd,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA;AAC3B,CAAC"}
+{"version":3,"file":"admin-allowlist.js","sourceRoot":"","sources":["../../src/core/admin-allowlist.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,mEAAmE;AACnE,EAAE;AACF,0EAA0E;AAC1E,YAAY;AACZ,+DAA+D;AAC/D,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,yCAAyC;AAEzC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAO9D,IAAI,aAAa,GAAmB,IAAI,CAAA;AACxC,IAAI,SAAS,GAAG,EAAE,CAAA;AAClB;;uCAEuC;AACvC,MAAM,cAAc,GAAY,EAAE,CAAA;AAElC,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAY,EAAE,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,EACnE,4DAA4D,CAAC,CAAA;YAC/D,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE;YAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAA;IAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,SAAS,GAAG,GAAG,CAAA;QACf,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IACD,qEAAqE;IACrE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,CAAA;AACtD,CAAC;AAED;;6DAE6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,OAAO,UAAU,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;yBACyB;AACzB,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,MAA0B;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;AAC1E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU;IACxB,OAAO,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED;;uDAEuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,IAA2C;IAC9G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnF,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAE5C,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/E,aAAa,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC9C,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,0BAA0B;YACjC,QAAQ,EAAE,CAAC;YACX,MAAM;YACN,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM;SAC3B,EAAE,mDAAmD,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,gCAAgC;YACvC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,EAAE,kFAAkF,CAAC,CAAA;IACxF,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACxD,aAAa,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,OAAO;YACtB,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ;YAC9B,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE;YACxB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACnC,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAA0B;IACxE,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,mEAAmE;QACnE,2DAA2D;QAC3D,OAAO,CACL,sBAAsB;YACtB,IAAI;YACJ,eAAe;YACf,wEAAwE;YACxE,iDAAiD;YACjD,wCAAwC;YACxC,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,YAAY;YACtF,IAAI;YACJ,4BAA4B,CAC7B,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,6BAA6B;IAC7B,OAAO,CACL,kBAAkB;QAClB,4CAA4C,CAC7C,CAAA;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW;IACzB,aAAa,GAAG,IAAI,CAAA;IACpB,SAAS,GAAG,EAAE,CAAA;IACd,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA;AAC3B,CAAC"}

package/dist/core/admin-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-bootstrap.d.ts","sourceRoot":"","sources":["../../src/core/admin-bootstrap.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,oBAAoB,QAA2C,CAAA;AAgB5E;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,IAAI,CAgC5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAU1E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CACN;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,KAAK,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,UAAU,GAAG,iBAAiB,CAAA;CAAE,CAC1E,CA+BA"}
+{"version":3,"file":"admin-bootstrap.d.ts","sourceRoot":"","sources":["../../src/core/admin-bootstrap.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,oBAAoB,QAA2C,CAAA;AAgB5E;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,IAAI,CAoC5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAU1E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CACN;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,KAAK,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,UAAU,GAAG,iBAAiB,CAAA;CAAE,CAC1E,CA+BA"}

package/dist/core/admin-bootstrap.js

@@ -80,13 +80,16 @@ export function ensureBootstrapTokenIfNeeded() {
         }, 'failed to write bootstrap token; admins cannot self-onboard via /setup');
         return null;
     }
-    log.info({ event: 'admin-bootstrap.ready', token, file: BOOTSTRAP_TOKEN_FILE });
-    // Also print prominent stdout banner so the operator notices in the
-    // systemd journal / log tail without having to grep for it.
+    // Compliance (R13 A3): never put the raw token in the pino log or
+    // unconditionally on stdout — both go to journald and would let any
+    // journal reader race the operator. We log only the file path; the
+    // token lives in 0o600 on disk and operators retrieve it via
+    // `cat ~/.agim/admin-bootstrap-token`.
+    log.info({ event: 'admin-bootstrap.ready', file: BOOTSTRAP_TOKEN_FILE }, 'admin-bootstrap token written; retrieve from file on the host');
     console.log();
     console.log('⚙️  No admin configured. To onboard yourself:');
-    console.log(`     · In IM, send:  /setup admin ${token}`);
-    console.log(`     · Token also in: ${BOOTSTRAP_TOKEN_FILE}`);
+    console.log(`     1. On the host, run:   cat ${BOOTSTRAP_TOKEN_FILE}`);
+    console.log('     2. In IM, send:        /setup admin <paste-token-here>');
     console.log('     · Token regenerates on every restart while no admin is set.');
     console.log();
     return token;

package/dist/core/admin-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-bootstrap.js","sourceRoot":"","sources":["../../src/core/admin-bootstrap.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,kBAAkB;AAClB,EAAE;AACF,QAAQ;AACR,mEAAmE;AACnE,+DAA+D;AAC/D,4DAA4D;AAC5D,+DAA+D;AAC/D,oEAAoE;AACpE,kDAAkD;AAClD,wEAAwE;AACxE,oEAAoE;AACpE,mEAAmE;AACnE,wBAAwB;AACxB,EAAE;AACF,YAAY;AACZ,oEAAoE;AACpE,qCAAqC;AACrC,gEAAgE;AAChE,uEAAuE;AACvE,sEAAsE;AACtE,sEAAsE;AAEtE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAA;AAE5E,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,kCAAkC,CAAA;AAEnD,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC1D,yCAAyC;QACzC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,IAAI,GAAG,CAAA;IACpC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B;IAC1C,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,oEAAoE;QACpE,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC;gBAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,aAAa,CAAC,oBAAoB,EAAE,KAAK,GAAG,IAAI,CAAC,CAAA;QACjD,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC;YACR,KAAK,EAAE,8BAA8B;YACrC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,EAAE,wEAAwE,CAAC,CAAA;QAC5E,OAAO,IAAI,CAAA;IACb,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC/E,oEAAoE;IACpE,4DAA4D;IAC5D,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;IAC5D,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAA;IACzD,OAAO,CAAC,GAAG,CAAC,yBAAyB,oBAAoB,EAAE,CAAC,CAAA;IAC5D,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAA;IAC/E,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,aAAa,CAAC,oBAAoB,EAAE,KAAK,GAAG,IAAI,CAAC,CAAA;IACjD,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACtC,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,oBAAoB;KAC3B,EAAE,mEAAmE,CAAC,CAAA;IACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,QAAgB,EAChB,MAAc;IAMd,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAE5D,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/C,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/C,CAAC;IAED,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,CAAC;QAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChC,MAAM;QACN,YAAY,EAAE,QAAQ;KACvB,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,QAAQ,EAAE,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"admin-bootstrap.js","sourceRoot":"","sources":["../../src/core/admin-bootstrap.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,kBAAkB;AAClB,EAAE;AACF,QAAQ;AACR,mEAAmE;AACnE,+DAA+D;AAC/D,4DAA4D;AAC5D,+DAA+D;AAC/D,oEAAoE;AACpE,kDAAkD;AAClD,wEAAwE;AACxE,oEAAoE;AACpE,mEAAmE;AACnE,wBAAwB;AACxB,EAAE;AACF,YAAY;AACZ,oEAAoE;AACpE,qCAAqC;AACrC,gEAAgE;AAChE,uEAAuE;AACvE,sEAAsE;AACtE,sEAAsE;AAEtE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAA;AAE5E,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,kCAAkC,CAAA;AAEnD,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC1D,yCAAyC;QACzC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,IAAI,GAAG,CAAA;IACpC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B;IAC1C,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,oEAAoE;QACpE,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC;gBAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,aAAa,CAAC,oBAAoB,EAAE,KAAK,GAAG,IAAI,CAAC,CAAA;QACjD,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC;YACR,KAAK,EAAE,8BAA8B;YACrC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,EAAE,wEAAwE,CAAC,CAAA;QAC5E,OAAO,IAAI,CAAA;IACb,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,6DAA6D;IAC7D,uCAAuC;IACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,EAAE,EACrE,+DAA+D,CAAC,CAAA;IAClE,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;IAC5D,OAAO,CAAC,GAAG,CAAC,mCAAmC,oBAAoB,EAAE,CAAC,CAAA;IACtE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;IAC1E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAA;IAC/E,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,aAAa,CAAC,oBAAoB,EAAE,KAAK,GAAG,IAAI,CAAC,CAAA;IACjD,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACtC,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,oBAAoB;KAC3B,EAAE,mEAAmE,CAAC,CAAA;IACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,QAAgB,EAChB,MAAc;IAMd,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAE5D,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/C,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/C,CAAC;IAED,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,CAAC;QAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChC,MAAM;QACN,YAAY,EAAE,QAAQ;KACvB,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,QAAQ,EAAE,CAAA;AAC9C,CAAC"}

package/dist/core/agent-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-base.d.ts","sourceRoot":"","sources":["../../src/core/agent-base.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAmG1E,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,8BAAsB,SAAU,YAAW,YAAY;IACrD,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IAEnC,2CAA2C;IAC3C,SAAS,KAAK,WAAW,IAAI,MAAM,CAAqB;IAExD;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,EAAE;IAE3E;;;;;;OAMG;cACa,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAIvF,sDAAsD;IACtD,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAEtD;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAEnE,yGAAyG;IACzG,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAI3F,0DAA0D;IAC1D,SAAS,CAAC,mBAAmB,IAAI,MAAM;IAIjC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQrC,qEAAqE;IAC/D,WAAW,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAMjE;;;;OAIG;IACI,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC;IAU5H;;;OAGG;IACH,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,GAAG,MAAM;IAUhF;;;4EAGwE;IACxE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;OAGG;IACU,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAQnF;;;;OAIG;cACc,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,GAAE,aAAkB,GAAG,cAAc,CAAC,MAAM,CAAC;CAiNrH"}
+{"version":3,"file":"agent-base.d.ts","sourceRoot":"","sources":["../../src/core/agent-base.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAmG1E,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,8BAAsB,SAAU,YAAW,YAAY;IACrD,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IAEnC,2CAA2C;IAC3C,SAAS,KAAK,WAAW,IAAI,MAAM,CAAqB;IAExD;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,EAAE;IAE3E;;;;;;OAMG;cACa,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAIvF,sDAAsD;IACtD,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAEtD;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAEnE,yGAAyG;IACzG,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAI3F,0DAA0D;IAC1D,SAAS,CAAC,mBAAmB,IAAI,MAAM;IAIjC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQrC,qEAAqE;IAC/D,WAAW,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAMjE;;;;OAIG;IACI,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC;IAU5H;;;OAGG;IACH,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,GAAG,MAAM;IAUhF;;;4EAGwE;IACxE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;OAGG;IACU,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAQnF;;;;OAIG;cACc,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,GAAE,aAAkB,GAAG,cAAc,CAAC,MAAM,CAAC;CAqOrH"}

package/dist/core/agent-base.js

@@ -323,6 +323,31 @@ export class AgentBase {
             closed = true;
             ping();
         });
+        // 'exit' fires the moment the kernel reaps the child; 'close' waits for
+        // ALL inherited stdio file descriptors to also close. Some agents
+        // (notably Antigravity / agy) leak stdout/stderr into MCP sidecar
+        // sub-processes — when the agent itself exits, those sidecars get
+        // re-parented to init (PPID=1) and keep the pipe open, so Node never
+        // emits 'close' on the parent ChildProcess. Without this, the
+        // spawnStream consumer hangs forever on its `await wait()` despite
+        // the agent being long gone.
+        //
+        // Workaround: on 'exit', destroy our end of stdout/stderr ourselves.
+        // The streams' own 'close' then fires (since the reader side ended),
+        // which lets the ChildProcess emit its 'close' event normally and the
+        // existing handler below does its usual cleanup. This is idempotent —
+        // if agents don't have the leak, destroy() is a no-op against an
+        // already-closed stream.
+        proc.on('exit', () => {
+            try {
+                proc.stdout?.destroy();
+            }
+            catch { /* already closed */ }
+            try {
+                proc.stderr?.destroy();
+            }
+            catch { /* already closed */ }
+        });
         proc.on('close', (code) => {
             exitCode = code;
             closed = true;