anyray-connect 0.11.49 → 0.11.53

package/dist/util/policySync.js

@@ -1,5 +1,5 @@
 /**
- * Team skills/policy sync (client side).
+ * Team policy sync and reconciliation (client side).
  *
  * `anyray-connect sync` pulls the org's shared skills/instructions from the
  * gateway and writes them as `SKILL.md` files into each supported coding tool's
@@ -9,25 +9,66 @@
  * fine and does not touch the privacy invariant.
  *
  * Contract (gateway-side): `GET <gatewayUrl>/connect/policy` with header
- * `x-anyray-api-key: <personal key or placeholder>` → 200
- *   { "skills": [ { "id", "name", "version", "body" } ], "updatedAt": "ISO" }
+ * `x-anyray-api-key: <personal key>` returns versioned metadata/config: shared
+ * skills plus optional routing origin, bound team, and enabled tool ids. A
+ * skills-only document without `version` is the legacy v0 shape.
  *
  * On a non-200 or a network error we fail gracefully with a clear message
  * (never crash). The last-synced version per skill is tracked in ~/.anyray so
  * re-runs only rewrite files whose `version` changed.
  */
-import { mkdir, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { REGISTRY } from "../tools/index.js";
+import { resolveOrigin } from "../target.js";
+import { loadProfile, saveProfile } from "./persist.js";
+import { targetFromProfile } from "./profileTarget.js";
+import { findDriftedManagedTools, repairSucceeded, repairTools, } from "./repair.js";
 const POLICY_TIMEOUT_MS = 10_000;
-const optionalString = (value) => typeof value === 'string' && value.trim() ? value.trim() : undefined;
+export const TEAM_POLICY_VERSION = 1;
+const safeSkillId = z
+    .string()
+    .min(1)
+    .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/)
+    .refine((id) => id !== "." && id !== "..");
+const policySkillSchema = z.object({
+    id: safeSkillId,
+    name: z.string().min(1),
+    version: z.string().min(1),
+    /** Markdown body of the skill — team policy text, content-free. */
+    body: z.string(),
+});
 /**
- * A skill `id` becomes a directory name (`<skillsDir>/<id>/SKILL.md`). The
- * gateway only validates it as non-empty, so a malicious or mistyped id like
- * `../../evil` would escape the skills dir and write SKILL.md anywhere. Restrict
- * it to a single safe path segment: a leading alphanumeric, then alphanumerics,
- * `.`, `_`, `-` — which excludes `/`, `\`, `..`, and absolute paths.
+ * The consume-side policy boundary. Zod objects strip unknown keys, so future
+ * additive fields are ignored. Every v1 field is optional; the shared-skills
+ * array is the legacy core, and absence of `version` means a v0 document.
  */
-const isSafeSkillId = (id) => /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(id) && id !== '.' && id !== '..';
+export const teamPolicySchema = z.object({
+    version: z.literal(TEAM_POLICY_VERSION).optional(),
+    skills: z.array(policySkillSchema),
+    updatedAt: z.string().min(1).optional(),
+    routing: z
+        .object({
+        origin: z.string().min(1),
+    })
+        .optional(),
+    team: z.string().min(1).optional(),
+    tools: z
+        .object({
+        enabled: z.array(z.string().min(1)),
+    })
+        .optional(),
+});
+/** A skill id becomes a directory name, so it must be one safe path segment. */
+const isSafeSkillId = (id) => /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(id) && id !== "." && id !== "..";
+/** Safe label for parse/fetch failures; never includes response bodies. */
+export const policyErrorName = (error) => error &&
+    typeof error === "object" &&
+    "name" in error &&
+    typeof error.name === "string"
+    ? error.name
+    : "Error";
 /**
  * Fetch the team policy from the gateway. Throws an Error with a clear,
  * content-free message on non-200 or network failure — callers catch it and
@@ -41,13 +82,13 @@ export const fetchTeamPolicy = async (gatewayUrl, apiKey, opts = {}) => {
     let res;
     try {
         res = await fetch(url, {
-            method: 'GET',
-            headers: { 'x-anyray-api-key': apiKey },
+            method: "GET",
+            headers: { "x-anyray-api-key": apiKey },
             signal: controller.signal,
         });
     }
     catch (error) {
-        const reason = error instanceof Error && error.name === 'AbortError'
+        const reason = error instanceof Error && error.name === "AbortError"
             ? `no response within ${timeoutMs}ms`
             : error instanceof Error
                 ? error.message
@@ -62,30 +103,106 @@ export const fetchTeamPolicy = async (gatewayUrl, apiKey, opts = {}) => {
     }
     let body;
     try {
-        body = (await res.json());
+        body = await res.json();
     }
-    catch {
-        throw new Error('team policy fetch failed: the gateway returned a malformed response');
+    catch (error) {
+        const malformed = new Error("team policy fetch failed: the gateway returned a malformed response");
+        malformed.name = policyErrorName(error);
+        throw malformed;
     }
-    const rawSkills = Array.isArray(body.skills) ? body.skills : [];
-    const skills = [];
-    for (const raw of rawSkills) {
-        const entry = raw;
-        const id = optionalString(entry?.id);
-        const version = optionalString(entry?.version);
-        // Skip entries that can't be keyed/diffed; an id+version are required for
-        // the SKILL.md path and the version diff. Reject ids that aren't a safe path
-        // segment — they'd let a hostile policy write outside the skills dir.
-        if (!id || !version || !isSafeSkillId(id))
-            continue;
-        skills.push({
-            id,
-            name: optionalString(entry?.name) ?? id,
-            version,
-            body: typeof entry?.body === 'string' ? entry.body : '',
-        });
+    return teamPolicySchema.parse(body);
+};
+/**
+ * Reconcile the server-owned fleet fields into the local profile and installed
+ * tools. The tool policy is strictly enable-only AND revert-safe: it only ever
+ * re-points tools already recorded in `managedTools`. An enabled id that is not
+ * managed — never enrolled, or intentionally reverted — is never applied or
+ * recorded, so a fleet policy can never resurrect a tool the developer reverted
+ * (the #1031 rule the drift path also enforces). A routing/team change re-points
+ * every managed tool; otherwise only managed tools that have drifted off the
+ * origin are re-applied, so a steady-state reconcile is a no-op.
+ */
+export const reconcileFleetPolicy = async (policy, deps = {}) => {
+    const load = deps.loadProfile ?? loadProfile;
+    const save = deps.saveProfile ?? saveProfile;
+    const buildTarget = deps.targetFromProfile ?? targetFromProfile;
+    const adapters = deps.adapters ?? REGISTRY;
+    const applyTools = deps.repairTools ?? repairTools;
+    const profile = await load();
+    let next = { ...profile };
+    let routingUpdated = false;
+    let teamUpdated = false;
+    if (policy.routing?.origin) {
+        const origin = resolveOrigin(policy.routing.origin);
+        if (origin !== profile.gateway) {
+            next.gateway = origin;
+            routingUpdated = true;
+        }
+    }
+    if (policy.team && policy.team !== profile.team) {
+        next.team = policy.team;
+        teamUpdated = true;
+    }
+    if (routingUpdated || teamUpdated) {
+        // Merge onto the freshest credential/profile snapshot so a key refresh
+        // that completed during policy parsing is not rolled back.
+        next = { ...(await load()) };
+        if (routingUpdated)
+            next.gateway = resolveOrigin(policy.routing.origin);
+        if (teamUpdated)
+            next.team = policy.team;
+        await save(next);
+    }
+    // Only tools already recorded in `managedTools` may be touched. An enabled id
+    // absent from the record was never enrolled or was intentionally reverted, and
+    // must never be resurrected here — the same #1031 revert-stickiness guarantee
+    // the drift path enforces. Enabled ids keep their (already-managed) tool
+    // pointed; a routing/team change re-points every managed tool.
+    const enabled = new Set(policy.tools?.enabled ?? []);
+    const managedIds = next.managedTools ?? [];
+    const candidateIds = managedIds.filter((id) => enabled.has(id) || routingUpdated || teamUpdated);
+    let toolsRequested = 0;
+    let toolsApplied = 0;
+    if (candidateIds.length > 0) {
+        const resolved = await buildTarget(async () => next);
+        if (resolved) {
+            // A team-only change is invisible to `pointsAt` (same origin), so when
+            // routing or team changed we re-point every installed candidate.
+            // Otherwise re-apply only the candidates that have actually drifted off
+            // the origin, so a steady-state reconcile applies nothing (idempotent).
+            let toApply;
+            if (routingUpdated || teamUpdated) {
+                const candidate = new Set(candidateIds);
+                toApply = [];
+                for (const adapter of adapters) {
+                    if (!candidate.has(adapter.id))
+                        continue;
+                    try {
+                        if ((await adapter.detect()).installed)
+                            toApply.push(adapter);
+                    }
+                    catch {
+                        // An unreadable/uninstalled tool is not changed.
+                    }
+                }
+            }
+            else {
+                toApply = await findDriftedManagedTools(candidateIds, resolved.toolOrigin, adapters);
+            }
+            toolsRequested = toApply.length;
+            if (toApply.length > 0) {
+                const results = await applyTools(toApply, resolved.target);
+                toolsApplied = results.filter(repairSucceeded).length;
+            }
+        }
     }
-    return { skills, updatedAt: optionalString(body.updatedAt) };
+    return {
+        routingUpdated,
+        teamUpdated,
+        toolsRequested,
+        toolsApplied,
+        profileUpdated: routingUpdated || teamUpdated,
+    };
 };
 /**
  * Diff the fetched policy against the previously synced versions and write
@@ -121,11 +238,11 @@ export const syncPolicyToDirs = async (policy, skillsDirs, previousVersions) =>
         const files = [];
         for (const dir of skillsDirs) {
             const skillDir = join(dir, skill.id);
-            const file = join(skillDir, 'SKILL.md');
+            const file = join(skillDir, "SKILL.md");
             await mkdir(skillDir, { recursive: true });
             // Skill bodies are team policy text (content-free); persisting them is
             // intended. A trailing newline keeps the files diff-friendly.
-            await writeFile(file, ensureTrailingNewline(skill.body), 'utf-8');
+            await writeFile(file, ensureTrailingNewline(skill.body), "utf-8");
             files.push(file);
         }
         changed += 1;
@@ -139,5 +256,5 @@ export const syncPolicyToDirs = async (policy, skillsDirs, previousVersions) =>
     }
     return { results, changed, unchanged, versions, updatedAt: policy.updatedAt };
 };
-const ensureTrailingNewline = (body) => body.endsWith('\n') ? body : `${body}\n`;
+const ensureTrailingNewline = (body) => body.endsWith("\n") ? body : `${body}\n`;
 //# sourceMappingURL=policySync.js.map

package/dist/util/policySync.js.map

@@ -1 +1 @@
-{"version":3,"file":"policySync.js","sourceRoot":"","sources":["../../src/util/policySync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAqBjC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE,CAC5D,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE,CAC5C,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,UAAkB,EAClB,MAAc,EACd,OAA2B,EAAE,EACR,EAAE;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,UAAU,iBAAiB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YACnD,CAAC,CAAC,sBAAsB,SAAS,IAAI;YACrC,CAAC,CAAC,KAAK,YAAY,KAAK;gBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,CAAC,MAAM,OAAO,GAAG,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAqC,CAAC;QACpD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,0EAA0E;QAC1E,6EAA6E;QAC7E,sEAAsE;QACtE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAAE,SAAS;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE;YACF,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;YACvC,OAAO;YACP,IAAI,EAAE,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAuBF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAkB,EAClB,UAAoB,EACpB,gBAAwC,EAClB,EAAE;IACxB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,SAAS;QACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,SAAS,CAAC,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,CAAC;QACb,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,IAAI;YACb,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAChF,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAU,EAAE,CACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC"}
+{"version":3,"file":"policySync.js","sourceRoot":"","sources":["../../src/util/policySync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAU,CAAC;AAE9C,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,KAAK,CAAC,8BAA8B,CAAC;KACrC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,mEAAmE;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC;SACD,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KACpC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAUH,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE,CAC5C,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC;AAEvE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAAU,EAAE,CACxD,KAAK;IACL,OAAO,KAAK,KAAK,QAAQ;IACzB,MAAM,IAAI,KAAK;IACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;IAC5B,CAAC,CAAC,KAAK,CAAC,IAAI;IACZ,CAAC,CAAC,OAAO,CAAC;AAEd;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,UAAkB,EAClB,MAAc,EACd,OAA2B,EAAE,EACR,EAAE;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,UAAU,iBAAiB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YACnD,CAAC,CAAC,sBAAsB,SAAS,IAAI;YACrC,CAAC,CAAC,KAAK,YAAY,KAAK;gBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,CAAC,MAAM,OAAO,GAAG,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,IAAI,KAAK,CACzB,qEAAqE,CACtE,CAAC;QACF,SAAS,CAAC,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,CAAC;IAClB,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC,CAAC;AAqBF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,MAAkB,EAClB,OAAiC,EAAE,EACN,EAAE;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC;IAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAkB,EAAE,GAAG,OAAO,EAAE,CAAC;IACzC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;QAClC,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7B,IAAI,cAAc;YAAE,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,OAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,WAAW;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,cAAc,IAAI,WAAW,CACzD,CAAC;IAEF,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,OAAsB,CAAC;YAC3B,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;gBACxC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBAAE,SAAS;oBACzC,IAAI,CAAC;wBACH,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS;4BAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAChE,CAAC;oBAAC,MAAM,CAAC;wBACP,iDAAiD;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,MAAM,uBAAuB,CACrC,YAAY,EACZ,QAAQ,CAAC,UAAU,EACnB,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC3D,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc;QACd,WAAW;QACX,cAAc;QACd,YAAY;QACZ,cAAc,EAAE,cAAc,IAAI,WAAW;KAC9C,CAAC;AACJ,CAAC,CAAC;AAuBF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAkB,EAClB,UAAoB,EACpB,gBAAwC,EAClB,EAAE;IACxB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,SAAS;QACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACxC,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,SAAS,CAAC,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,CAAC;QACb,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,IAAI;YACb,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAChF,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAU,EAAE,CACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC"}

package/dist/util/proxyEnrollmentGate.js

@@ -30,6 +30,10 @@ import { runSsoGate } from '../commands/ssoGate.js';
 const GATE_ATTEMPT_MIN_GAP_MS = 60_000;
 /** Re-notify the SAME pending grant at most this often. */
 const RENOTIFY_MIN_GAP_MS = 10 * 60_000;
+const headerValue = (headers, name) => {
+    const raw = headers[name];
+    return typeof raw === 'string' ? raw : Array.isArray(raw) ? raw[0] : undefined;
+};
 /**
  * Mirror of the gateway's token-source order (`tokenFrom` in
  * clientKeyAuth): x-anyray-api-key, an Authorization Bearer, or an `ark_`
@@ -38,16 +42,35 @@ const RENOTIFY_MIN_GAP_MS = 10 * 60_000;
  * and firing on someone else's presented credential would be noise.
  */
 export const inboundPresentsToken = (headers) => {
-    const value = (name) => {
-        const raw = headers[name];
-        return typeof raw === 'string' ? raw : Array.isArray(raw) ? raw[0] : undefined;
-    };
-    if (value('x-anyray-api-key')?.trim())
+    if (headerValue(headers, 'x-anyray-api-key')?.trim())
         return true;
-    const auth = value('authorization')?.trim() ?? '';
+    const auth = headerValue(headers, 'authorization')?.trim() ?? '';
     if (/^bearer\s+\S+/i.test(auth))
         return true;
-    const xApiKey = value('x-api-key')?.trim() ?? '';
+    const xApiKey = headerValue(headers, 'x-api-key')?.trim() ?? '';
+    return xApiKey.startsWith('ark_');
+};
+/**
+ * Narrower sibling of inboundPresentsToken for the key-INJECTION decision: does
+ * the request already carry a CLIENT KEY (an `ark_` gateway key)? The only
+ * difference is the Authorization Bearer: a bare bearer is a client key ONLY
+ * when it's an `ark_` token. A subscription/provider OAuth bearer (passthrough
+ * mode — the seat token the gateway forwards upstream) is NOT a client key; it
+ * lives in a different slot than the `x-anyray-api-key` the gateway reads for
+ * client-key identity. So when only a seat OAuth is present the daemon may
+ * inject the enrolled per-user key into the empty client-key slot without
+ * overriding anything the caller presented — which lets a passthrough tool pick
+ * up a freshly re-minted key mid-session with no restart. The brute-force /
+ * enrollment gate above still uses the broader inboundPresentsToken (a seat
+ * OAuth means "has a credential, don't nag to enroll").
+ */
+export const inboundPresentsClientKey = (headers) => {
+    if (headerValue(headers, 'x-anyray-api-key')?.trim())
+        return true;
+    const auth = headerValue(headers, 'authorization')?.trim() ?? '';
+    if (/^bearer\s+ark_\S+/i.test(auth))
+        return true;
+    const xApiKey = headerValue(headers, 'x-api-key')?.trim() ?? '';
     return xApiKey.startsWith('ark_');
 };
 /** The gateway's clientKeyAuth guard surface: /v1/ paths only. */

package/dist/util/proxyEnrollmentGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxyEnrollmentGate.js","sourceRoot":"","sources":["../../src/util/proxyEnrollmentGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,wEAAwE;AACxE,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAsD,EAC7C,EAAE;IACX,MAAM,KAAK,GAAG,CAAC,IAAY,EAAsB,EAAE;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CACpD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAErC,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAU,EAAE,CAClD,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAE1E,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAa,EACb,OAAe,EACf,kBAAmC,OAAO,CAAC,QAAQ,EACnD,OAAwB,QAAQ,EAC1B,EAAE;IACR,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CACF,oBAAoB,EACpB;gBACE,IAAI;gBACJ,yBAAyB,WAAW,iBAAiB,SAAS,GAAG;aAClE,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;QACJ,CAAC;aAAM,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;YACvC,IAAI,CACF,aAAa,EACb,CAAC,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAC,EAC7C,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC,CAAC;AAqBF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAgC,EAAE,EACb,EAAE;IACvB,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEjC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,gBAAoC,CAAC;IACzC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAClD;YACE,sEAAsE;YACtE,wDAAwD;YACxD,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAC/B,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACvC,CACF,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO;QACnC,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IACE,KAAK,EAAE,MAAM,KAAK,SAAS;YAC3B,CAAC,KAAK,CAAC,QAAQ;YACf,CAAC,KAAK,CAAC,uBAAuB,EAC9B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,KAAK,gBAAgB,CAAC;QACvD,IAAI,CAAC,UAAU,IAAI,GAAG,EAAE,GAAG,cAAc,GAAG,mBAAmB;YAAE,OAAO;QACxE,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC;QAClC,cAAc,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,CACJ,kCAAkC,EAClC,QAAQ,KAAK,CAAC,uBAAuB,mBAAmB,KAAK,CAAC,QAAQ,kDAAkD,CACzH,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,qBAAqB,CAAC,GAAG,EAAE,OAAO;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;oBAAE,OAAO;gBAChC,IAAI,oBAAoB,CAAC,OAAO,CAAC;oBAAE,OAAO;gBAC1C,IAAI,QAAQ,IAAI,GAAG,EAAE,GAAG,aAAa,GAAG,uBAAuB;oBAAE,OAAO;gBACxE,aAAa,GAAG,GAAG,EAAE,CAAC;gBACtB,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,IAAI,EAAE;qBACR,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;qBACtB,OAAO,CAAC,GAAG,EAAE;oBACZ,QAAQ,GAAG,KAAK,CAAC;gBACnB,CAAC,CAAC,CAAC;YACP,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"proxyEnrollmentGate.js","sourceRoot":"","sources":["../../src/util/proxyEnrollmentGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,wEAAwE;AACxE,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAIxC,MAAM,WAAW,GAAG,CAAC,OAAkB,EAAE,IAAY,EAAsB,EAAE;IAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAkB,EAAW,EAAE;IAClE,IAAI,WAAW,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAkB,EAAW,EAAE;IACtE,IAAI,WAAW,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CACpD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAErC,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAU,EAAE,CAClD,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAE1E,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAa,EACb,OAAe,EACf,kBAAmC,OAAO,CAAC,QAAQ,EACnD,OAAwB,QAAQ,EAC1B,EAAE;IACR,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CACF,oBAAoB,EACpB;gBACE,IAAI;gBACJ,yBAAyB,WAAW,iBAAiB,SAAS,GAAG;aAClE,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;QACJ,CAAC;aAAM,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;YACvC,IAAI,CACF,aAAa,EACb,CAAC,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAC,EAC7C,EAAE,OAAO,EAAE,KAAK,EAAE,EAClB,GAAG,EAAE,GAAE,CAAC,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC,CAAC;AAqBF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAgC,EAAE,EACb,EAAE;IACvB,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEjC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,gBAAoC,CAAC;IACzC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAClD;YACE,sEAAsE;YACtE,wDAAwD;YACxD,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAC/B,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACvC,CACF,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO;QACnC,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IACE,KAAK,EAAE,MAAM,KAAK,SAAS;YAC3B,CAAC,KAAK,CAAC,QAAQ;YACf,CAAC,KAAK,CAAC,uBAAuB,EAC9B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,KAAK,gBAAgB,CAAC;QACvD,IAAI,CAAC,UAAU,IAAI,GAAG,EAAE,GAAG,cAAc,GAAG,mBAAmB;YAAE,OAAO;QACxE,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC;QAClC,cAAc,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,CACJ,kCAAkC,EAClC,QAAQ,KAAK,CAAC,uBAAuB,mBAAmB,KAAK,CAAC,QAAQ,kDAAkD,CACzH,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,qBAAqB,CAAC,GAAG,EAAE,OAAO;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;oBAAE,OAAO;gBAChC,IAAI,oBAAoB,CAAC,OAAO,CAAC;oBAAE,OAAO;gBAC1C,IAAI,QAAQ,IAAI,GAAG,EAAE,GAAG,aAAa,GAAG,uBAAuB;oBAAE,OAAO;gBACxE,aAAa,GAAG,GAAG,EAAE,CAAC;gBACtB,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,IAAI,EAAE;qBACR,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;qBACtB,OAAO,CAAC,GAAG,EAAE;oBACZ,QAAQ,GAAG,KAAK,CAAC;gBACnB,CAAC,CAAC,CAAC;YACP,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anyray-connect",
-  "version": "0.11.49",
+  "version": "0.11.53",
   "description": "Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.",
   "type": "module",
   "bin": {
@@ -25,6 +25,9 @@
   "engines": {
     "node": ">=24"
   },
+  "dependencies": {
+    "zod": "4.4.3"
+  },
   "files": [
     "dist/",
     "README.md"
@@ -39,8 +42,8 @@
     "prepublishOnly": "npm run build && npm test"
   },
   "devDependencies": {
-    "@types/node": "26.1.0",
-    "tsx": "4.23.0",
-    "typescript": "6.0.3"
+    "@types/node": "26.1.1",
+    "tsx": "4.23.1",
+    "typescript": "7.0.2"
   }
 }