borgmcp-server 0.1.1 → 0.1.5

package/dist/debug-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-log.js","sourceRoot":"","sources":["../src/debug-log.ts"],"names":[],"mappings":"AAqCA,MAAM,CAAC,MAAM,mBAAmB,GAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;AAEzF,MAAM,UAAU,iBAAiB,CAAC,KAA2C;IAC3E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,KAAiB;YACpB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,SAAS,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,MAAM,KAAK,GAAG,KAA2C,CAAC;IAC1D,QAAQ,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC;gBACxE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC9C,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC;aAC1F,CAAC;QACJ,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACtD,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC;gBACzD,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC;gBACzD,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC;gBAC3E,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC;gBAC9E,GAAG,SAAS;gBACZ,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC;gBAC/C,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;aAC7E,CAAC;QACJ,CAAC;QACD,KAAK,WAAW;YACd,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QACzG,KAAK,iBAAiB;YACpB,OAAO;gBACL,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC9B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChC,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBACtC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACxC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC;gBAChF,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM;gBAC7D,mBAAmB,EAAE,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;aAC3D,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC;gBACvD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC9B,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC1C,cAAc,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC;gBAC9D,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBACxE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI;aACvC,CAAC;QACJ,KAAK,WAAW;YACd,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACnM,KAAK,gBAAgB;YACnB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACrJ,KAAK,eAAe;YAClB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5P,KAAK,iBAAiB;YACpB,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9O,KAAK,YAAY;YACf,OAAO;gBACL,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,kBAAkB,EAAE,qBAAqB,CAAC;gBAC7E,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvG,GAAG,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/C,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC3C,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC7C,GAAG,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;aAClD,CAAC;QACJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC7I;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7F,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAc;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,OAAe,EAAE,OAAe;IACtE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,OAAO,IAAK,KAAgB,IAAI,OAAO;QAChG,CAAC,CAAC,KAAe;QACjB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAyB,KAAc,EAAE,OAAqB,EAAE,QAAW;IAC3F,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAU,CAAC,CAAC,CAAC,CAAC,KAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3F,CAAC;AAED,MAAM,YAAY,GAAG,6EAA6E,CAAC;AACnG,MAAM,YAAY,GAA0B,CAAC,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAC9R,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AACjF,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AACvG,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,qBAAqB,CAAU,CAAC;AAClF,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC"}

package/dist/enrollment.d.ts

@@ -1,16 +1,8 @@
+import { type EnrollmentExchangeRequest, type ProtocolEnvelope } from "borgmcp-shared/protocol";
 import type { CredentialAuthority } from "./credentials.js";
-interface EnrollmentEnvelope {
-    readonly protocol_version: "1";
-    readonly request_id: string;
-    readonly payload: {
-        readonly invitation: string;
-        readonly retry_key: string;
-        readonly client_credential: string;
-        readonly client_name?: string;
-    };
-}
+type EnrollmentEnvelope = ProtocolEnvelope<EnrollmentExchangeRequest>;
 export declare function createEnrollmentExchange(authority: CredentialAuthority): (body: unknown) => Promise<{
-    readonly status: 201 | 400 | 401 | 507;
+    readonly status: 201 | 400 | 401 | 426 | 507;
     readonly body?: unknown;
 }>;
 export declare function decodeEnrollmentEnvelope(value: unknown): EnrollmentEnvelope;

package/dist/enrollment.js

@@ -1,3 +1,4 @@
+import { ErrorCode, PROTOCOL_VERSION, ProtocolContractError, createProtocolEnvelope, decodeEnrollmentExchangeRequestEnvelope, } from "borgmcp-shared/protocol";
 import { StorageCapacityError } from "./store.js";
 export function createEnrollmentExchange(authority) {
     return async (body) => {
@@ -5,7 +6,14 @@ export function createEnrollmentExchange(authority) {
         try {
             envelope = decodeEnrollmentEnvelope(body);
         }
-        catch {
+        catch (error) {
+            if (error instanceof ProtocolContractError &&
+                error.code === ErrorCode.UNSUPPORTED_PROTOCOL_VERSION) {
+                return {
+                    status: 426,
+                    body: errorEnvelope(ErrorCode.UNSUPPORTED_PROTOCOL_VERSION, "Unsupported protocol version.", safeRequestId(body)),
+                };
+            }
             return {
                 status: 400,
                 body: errorEnvelope("INVALID_INPUT", "Invalid enrollment request.", safeRequestId(body)),
@@ -38,21 +46,17 @@ export function createEnrollmentExchange(authority) {
         }
         return {
             status: 201,
-            body: {
-                protocol_version: "1",
-                request_id: envelope.request_id,
-                payload: {
-                    purpose: response.purpose,
-                    client_id: response.clientId,
-                    server_capabilities: response.serverCapabilities,
-                },
-            },
+            body: createProtocolEnvelope(envelope.request_id, {
+                purpose: response.purpose,
+                client_id: response.clientId,
+                server_capabilities: response.serverCapabilities,
+            }),
         };
     };
 }
 function errorEnvelope(code, message, requestId) {
     return {
-        protocol_version: "1",
+        protocol_version: PROTOCOL_VERSION,
         ...(requestId === undefined ? {} : { request_id: requestId }),
         error: { code, message },
     };
@@ -66,57 +70,14 @@ function safeRequestId(value) {
         : undefined;
 }
 export function decodeEnrollmentEnvelope(value) {
-    const envelope = exactRecord(value, ["protocol_version", "request_id", "payload"]);
-    if (envelope["protocol_version"] !== "1")
-        throw new Error("Invalid enrollment request.");
-    const requestId = envelope["request_id"];
-    if (typeof requestId !== "string" || !/^[A-Za-z0-9._-]{8,128}$/u.test(requestId)) {
-        throw new Error("Invalid enrollment request.");
-    }
-    const payload = exactRecord(envelope["payload"], ["invitation", "retry_key", "client_credential"], ["client_name"]);
-    const invitation = payload["invitation"];
-    if (typeof invitation !== "string" || !/^[A-Za-z0-9_-]{43,1024}$/u.test(invitation)) {
-        throw new Error("Invalid enrollment request.");
-    }
-    const retryKey = payload["retry_key"];
-    if (typeof retryKey !== "string" ||
-        !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(retryKey)) {
-        throw new Error("Invalid enrollment request.");
-    }
-    const clientCredential = payload["client_credential"];
-    if (typeof clientCredential !== "string" ||
-        !/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/u.test(clientCredential)) {
-        throw new Error("Invalid enrollment request.");
-    }
-    const clientName = payload["client_name"];
-    if (clientName !== undefined &&
-        (typeof clientName !== "string" || Buffer.byteLength(clientName) > 120 ||
-            !/^[A-Za-z0-9][A-Za-z0-9 ._-]*$/u.test(clientName))) {
-        throw new Error("Invalid enrollment request.");
-    }
-    return {
-        protocol_version: "1",
-        request_id: requestId,
-        payload: clientName === undefined
-            ? { invitation, retry_key: retryKey.toLowerCase(), client_credential: clientCredential }
-            : {
-                invitation,
-                retry_key: retryKey.toLowerCase(),
-                client_credential: clientCredential,
-                client_name: clientName,
-            },
-    };
-}
-function exactRecord(value, required, optional = []) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new Error("Invalid enrollment request.");
+    try {
+        return decodeEnrollmentExchangeRequestEnvelope(value);
     }
-    const record = value;
-    const allowed = new Set([...required, ...optional]);
-    if (Object.keys(record).some((key) => !allowed.has(key)) ||
-        required.some((key) => !Object.hasOwn(record, key))) {
+    catch (error) {
+        if (error instanceof ProtocolContractError &&
+            error.code === ErrorCode.UNSUPPORTED_PROTOCOL_VERSION)
+            throw error;
         throw new Error("Invalid enrollment request.");
     }
-    return record;
 }
 //# sourceMappingURL=enrollment.js.map

package/dist/enrollment.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../src/enrollment.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAalD,MAAM,UAAU,wBAAwB,CAAC,SAA8B;IACrE,OAAO,KAAK,EAAE,IAAa,EAGxB,EAAE;QACH,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CACjB,eAAe,EACf,6BAA6B,EAC7B,aAAa,CAAC,IAAI,CAAC,CACpB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,SAAS,CAAC,kBAAkB,CAAC;gBACtC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;gBACvC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;gBACpC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB;gBACpD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1D,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;aAC7E,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CACjB,cAAc,EACd,mCAAmC,EACnC,QAAQ,CAAC,UAAU,CACpB;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,gBAAgB,EAAE,GAAG;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ;oBAC5B,mBAAmB,EAAE,QAAQ,CAAC,kBAAkB;iBACjD;aACF;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAA4D,EAC5D,OAAe,EACf,SAAkB;IAElB,OAAO;QACL,gBAAgB,EAAE,GAAY;QAC9B,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC7D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,SAAS,GAAI,KAAiC,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAChF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,kBAAkB,CAAC,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CACzB,QAAQ,CAAC,SAAS,CAAC,EACnB,CAAC,YAAY,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAChD,CAAC,aAAa,CAAC,CAChB,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,6EAA6E,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;QACpC,CAAC,wCAAwC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,GAAG;YACrE,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,GAAG;QACrB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,UAAU,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE;YACxF,CAAC,CAAC;gBACE,UAAU;gBACV,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE;gBACjC,iBAAiB,EAAE,gBAAgB;gBACnC,WAAW,EAAE,UAAU;aACxB;KACN,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,QAA2B,EAC3B,QAAQ,GAAsB,EAAE;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../src/enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,uCAAuC,GAGxC,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAIlD,MAAM,UAAU,wBAAwB,CAAC,SAA8B;IACrE,OAAO,KAAK,EAAE,IAAa,EAGxB,EAAE;QACH,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB;gBACtC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,4BAA4B,EAAE,CAAC;gBAC1D,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,aAAa,CACjB,SAAS,CAAC,4BAA4B,EACtC,+BAA+B,EAC/B,aAAa,CAAC,IAAI,CAAC,CACpB;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CACjB,eAAe,EACf,6BAA6B,EAC7B,aAAa,CAAC,IAAI,CAAC,CACpB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,SAAS,CAAC,kBAAkB,CAAC;gBACtC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;gBACvC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;gBACpC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB;gBACpD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1D,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;aAC7E,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,aAAa,CACjB,cAAc,EACd,mCAAmC,EACnC,QAAQ,CAAC,UAAU,CACpB;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,sBAAsB,CAAC,QAAQ,CAAC,UAAU,EAAE;gBAC9C,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ;gBAC5B,mBAAmB,EAAE,QAAQ,CAAC,kBAAkB;aACnD,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAA6F,EAC7F,OAAe,EACf,SAAkB;IAElB,OAAO;QACL,gBAAgB,EAAE,gBAAgB;QAClC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC7D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,SAAS,GAAI,KAAiC,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAChF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC;QACH,OAAO,uCAAuC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB;YACtC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,4BAA4B;YAAE,MAAM,KAAK,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/https-server.d.ts

@@ -2,20 +2,7 @@ import type { Socket } from "node:net";
 import { type BindOptionsInput } from "./network-policy.js";
 import type { CoordinationRequest, CoordinationResponse } from "./coordination-api.js";
 import type { Principal } from "./principal.js";
-export interface ProtocolInfoDocument {
-    readonly protocol_version: string;
-    readonly package: {
-        readonly name: "borgmcp-shared";
-        readonly version: string;
-    };
-    readonly capabilities: readonly string[];
-    readonly limits: {
-        readonly max_request_bytes: number;
-        readonly max_log_message_bytes: number;
-        readonly max_read_page_size: number;
-        readonly max_replay_page_size: number;
-    };
-}
+import { type DebugLogger } from "./debug-log.js";
 export interface ServiceLimits {
     readonly maxConnections: number;
     readonly maxConnectionsPerAddress: number;
@@ -36,14 +23,13 @@ export interface ServiceLimits {
 }
 export declare const DEFAULT_SERVICE_LIMITS: ServiceLimits;
 export interface RequestHandlerContext {
-    readonly protocolInfo: ProtocolInfoDocument;
-    readonly authorizeProtocol: (authorization: string | undefined, signal: AbortSignal) => Promise<boolean | "missing" | "invalid" | "revoked">;
     readonly exchangeEnrollment?: (body: unknown) => Promise<{
-        readonly status: 201 | 400 | 401 | 507;
+        readonly status: 201 | 400 | 401 | 426 | 507;
         readonly body?: unknown;
     }>;
-    readonly authorizeCoordination?: (authorization: string | undefined, signal: AbortSignal) => Promise<Principal | "missing" | "invalid" | "revoked">;
+    readonly authorizeCoordination?: (authorization: string | undefined, signal: AbortSignal) => Promise<Principal | "missing" | "invalid" | "revoked" | "evicted">;
     readonly handleCoordination?: (request: CoordinationRequest) => Promise<CoordinationResponse>;
+    readonly debugLogger: DebugLogger;
 }
 export interface HttpsServerOptions {
     readonly bind?: BindOptionsInput;
@@ -52,12 +38,11 @@ export interface HttpsServerOptions {
         readonly cert: string | Buffer;
         readonly ca?: string | Buffer;
     };
-    readonly protocolInfo: ProtocolInfoDocument;
-    readonly authorizeProtocol: RequestHandlerContext["authorizeProtocol"];
     readonly exchangeEnrollment?: RequestHandlerContext["exchangeEnrollment"];
     readonly authorizeCoordination?: RequestHandlerContext["authorizeCoordination"];
     readonly handleCoordination?: RequestHandlerContext["handleCoordination"];
     readonly limits?: ServiceLimits;
+    readonly debugLogger?: DebugLogger;
     readonly testHooks?: {
         readonly identifyRemoteAddress?: (socket: Socket) => string;
     };

package/dist/https-server.js

@@ -1,6 +1,8 @@
 import { createServer } from "node:https";
 import { createHash, X509Certificate } from "node:crypto";
+import { ATTACH_PATH, CUBES_PATH, ENROLLMENT_EXCHANGE_PATH, ErrorCode, HEALTH_PATH, PROTOCOL_INFO_PATH, PROTOCOL_VERSION, createProtocolTagPreflight, } from "borgmcp-shared/protocol";
 import { resolveBindOptions } from "./network-policy.js";
+import { disabledDebugLogger } from "./debug-log.js";
 export const DEFAULT_SERVICE_LIMITS = {
     maxConnections: 100,
     maxConnectionsPerAddress: 25,
@@ -40,8 +42,14 @@ export async function startHttpsServer(options) {
     }, createRequestListener(handlerContext, limits, options.testHooks?.identifyRemoteAddress));
     const acceptedSockets = applyServerLimits(server, limits);
     server.on("secureConnection", (socket) => socket.disableRenegotiation());
-    server.on("tlsClientError", (_error, socket) => socket.destroy());
-    server.on("clientError", (_error, socket) => socket.end("HTTP/1.1 400 Bad Request\r\n\r\n"));
+    server.on("tlsClientError", (_error, socket) => {
+        handlerContext.debugLogger.emit({ event: "transport_rejection", reason: "tls_client_error" });
+        socket.destroy();
+    });
+    server.on("clientError", (_error, socket) => {
+        handlerContext.debugLogger.emit({ event: "transport_rejection", reason: "http_parser_error" });
+        socket.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+    });
     server.on("checkContinue", (_request, response) => sendEmpty(response, 417, true));
     try {
         await listen(server, bind.port, bind.host);
@@ -70,8 +78,6 @@ export async function startHttpsServer(options) {
 }
 export function createRequestHandlerContext(options) {
     return Object.freeze({
-        protocolInfo: options.protocolInfo,
-        authorizeProtocol: options.authorizeProtocol,
         ...(options.exchangeEnrollment === undefined
             ? {}
             : { exchangeEnrollment: options.exchangeEnrollment }),
@@ -81,6 +87,7 @@ export function createRequestHandlerContext(options) {
         ...(options.handleCoordination === undefined
             ? {}
             : { handleCoordination: options.handleCoordination }),
+        debugLogger: options.debugLogger ?? disabledDebugLogger,
     });
 }
 function createRequestListener(context, limits, identifyRemoteAddress = (socket) => socket.remoteAddress ?? "unknown") {
@@ -88,6 +95,33 @@ function createRequestListener(context, limits, identifyRemoteAddress = (socket)
     const credentialRateLimiter = new RequestRateLimiter(limits, limits.maxRequestsPerWindow);
     const streamQuota = new ConcurrentQuota(limits.maxStreamsPerCredential);
     return (request, response) => {
+        const startedAt = Date.now();
+        const trace = {
+            route: debugRoute(request.url),
+            method: debugMethod(request.method),
+            authentication: "not_required",
+        };
+        let debugEmitted = false;
+        const emitDebug = () => {
+            if (debugEmitted)
+                return;
+            debugEmitted = true;
+            const status = response.headersSent ? response.statusCode : 0;
+            context.debugLogger.emit({
+                event: "request",
+                route: trace.route,
+                method: trace.method,
+                authentication: trace.authentication,
+                authorization: trace.authentication === "accepted"
+                    ? status === 403 || status === 404 ? "denied_or_not_found" : "accepted"
+                    : "not_checked",
+                ...(trace.principal === undefined ? {} : { principal: trace.principal }),
+                status,
+                durationMs: Math.max(0, Date.now() - startedAt),
+            });
+        };
+        response.once("finish", emitDebug);
+        response.once("close", emitDebug);
         const controller = new AbortController();
         response.once("close", () => controller.abort());
         let timer;
@@ -98,7 +132,7 @@ function createRequestListener(context, limits, identifyRemoteAddress = (socket)
             }, limits.handlerTimeoutMs);
             timer.unref();
         });
-        const handled = handleRequest(request, response, context, limits, admissionLimiter, credentialRateLimiter, streamQuota, identifyRemoteAddress, controller.signal)
+        const handled = handleRequest(request, response, context, limits, admissionLimiter, credentialRateLimiter, streamQuota, identifyRemoteAddress, controller.signal, trace)
             .then(() => "handled");
         void Promise.race([handled, deadline])
             .then((outcome) => {
@@ -112,7 +146,7 @@ function createRequestListener(context, limits, identifyRemoteAddress = (socket)
         });
     };
 }
-async function handleRequest(request, response, context, limits, admissionLimiter, credentialRateLimiter, streamQuota, identifyRemoteAddress, signal) {
+async function handleRequest(request, response, context, limits, admissionLimiter, credentialRateLimiter, streamQuota, identifyRemoteAddress, signal, trace) {
     const addressIdentity = `address:${identifyRemoteAddress(request.socket)}`;
     const preAuthRetry = admissionLimiter.consume(addressIdentity);
     if (preAuthRetry !== null) {
@@ -136,42 +170,23 @@ async function handleRequest(request, response, context, limits, admissionLimite
         }
         return;
     }
-    if (path === "/healthz") {
+    if (path === HEALTH_PATH) {
         if (requestBody.length !== 0)
             return sendEmpty(response, 400, true);
         sendEmpty(response, request.method === "GET" ? 204 : 405);
         return;
     }
-    if (path === "/api/protocol") {
+    if (path === PROTOCOL_INFO_PATH) {
         if (requestBody.length !== 0)
             return sendEmpty(response, 400, true);
-        const authorized = await context.authorizeProtocol(request.headers.authorization, signal);
-        if (signal.aborted)
-            return;
-        if (authorized !== true) {
-            const code = authorized === "revoked"
-                ? "SESSION_REVOKED"
-                : authorized === "missing" || request.headers.authorization === undefined
-                    ? "AUTH_MISSING"
-                    : "AUTH_INVALID";
-            sendJson(response, 401, protocolError(code, "Authentication failed."));
-            return;
-        }
-        const credentialRetry = consumeAuthenticatedRateLimit(request.headers.authorization, credentialRateLimiter);
-        if (credentialRetry !== null)
-            return sendRateLimited(response, credentialRetry);
         if (request.method !== "GET") {
             sendEmpty(response, 405);
             return;
         }
-        sendJson(response, 200, {
-            protocol_version: "1",
-            request_id: "protocol-info",
-            payload: context.protocolInfo,
-        });
+        sendJson(response, 200, createProtocolTagPreflight());
         return;
     }
-    if (path === "/api/enrollment/exchange") {
+    if (path === ENROLLMENT_EXCHANGE_PATH) {
         if (request.method !== "POST" || context.exchangeEnrollment === undefined) {
             sendEmpty(response, 405);
             return;
@@ -195,8 +210,9 @@ async function handleRequest(request, response, context, limits, admissionLimite
             sendEmpty(response, result.status, result.status === 400);
         else if (result.status === 400)
             sendJson(response, 400, result.body, true);
-        else if (result.status === 401 || result.status === 507)
+        else if (result.status === 401 || result.status === 426 || result.status === 507) {
             sendJson(response, result.status, result.body);
+        }
         else
             sendJson(response, 201, result.body);
         return;
@@ -221,23 +237,29 @@ async function handleRequest(request, response, context, limits, admissionLimite
             return;
         }
         const authentication = await authorizeCoordination(authorization, signal);
+        trace.authentication = typeof authentication === "string" ? authentication : "accepted";
         if (signal.aborted)
             return;
         if (typeof authentication === "string") {
+            if (authentication === "evicted") {
+                sendJson(response, 410, protocolError(ErrorCode.DRONE_EVICTED, "Authentication failed."));
+                return;
+            }
             const code = authentication === "revoked"
                 ? "SESSION_REVOKED"
                 : authentication === "missing" || authorization === undefined ? "AUTH_MISSING" : "AUTH_INVALID";
             sendJson(response, 401, protocolError(code, "Authentication failed."));
             return;
         }
+        trace.principal = authentication;
         const clientIdentity = `client:${authentication.kind === "drone-session"
             ? authentication.clientId
             : authentication.id}`;
         const credentialRetry = credentialRateLimiter.consume(clientIdentity);
         if (credentialRetry !== null)
             return sendRateLimited(response, credentialRetry);
-        const cursor = parseCursorParameter(request.url, path);
-        if (cursor === INVALID_COORDINATION_QUERY) {
+        const query = parseCoordinationQuery(request.url, path);
+        if (query === INVALID_COORDINATION_QUERY) {
             sendJson(response, 400, protocolError("INVALID_INPUT", "Invalid query parameters."), true);
             return;
         }
@@ -246,7 +268,7 @@ async function handleRequest(request, response, context, limits, admissionLimite
             path,
             principal: authentication,
             ...(decoded === undefined ? {} : { body: decoded }),
-            ...(cursor === undefined ? {} : { cursor }),
+            ...query,
             signal,
         });
         if (signal.aborted) {
@@ -273,6 +295,46 @@ async function handleRequest(request, response, context, limits, admissionLimite
     }
     sendEmpty(response, 404);
 }
+function debugMethod(method) {
+    return method === "GET" || method === "POST" || method === "PUT" ||
+        method === "PATCH" || method === "DELETE" ? method : "OTHER";
+}
+function debugRoute(rawUrl) {
+    const path = parseRequestPath(rawUrl);
+    if (path === null)
+        return "unknown";
+    if (path === HEALTH_PATH)
+        return "health";
+    if (path === PROTOCOL_INFO_PATH)
+        return "protocol";
+    if (path === ENROLLMENT_EXCHANGE_PATH)
+        return "enrollment_exchange";
+    if (path === ATTACH_PATH)
+        return "client_attach";
+    if (path === "/api/cubes")
+        return "cubes";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}$/iu.test(path))
+        return "cube";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/roles$/iu.test(path))
+        return "cube_roles";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/roles\/[0-9a-f-]{36}$/iu.test(path))
+        return "cube_role";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/roles\/[0-9a-f-]{36}\/section-patch$/iu.test(path))
+        return "cube_role_section_patch";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/taxonomy-patch$/iu.test(path))
+        return "cube_taxonomy_patch";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/drones$/iu.test(path))
+        return "cube_drones";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/logs$/iu.test(path))
+        return "cube_logs";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/acks$/iu.test(path))
+        return "cube_acks";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/decisions$/iu.test(path))
+        return "cube_decisions";
+    if (/^\/api\/cubes\/[0-9a-f-]{36}\/stream$/iu.test(path))
+        return "cube_stream";
+    return "unknown";
+}
 async function closeRejectedStream(stream) {
     const iterator = stream[Symbol.asyncIterator]();
     try {
@@ -402,33 +464,33 @@ function waitForDrain(response) {
     });
 }
 function protocolError(code, message) {
-    return { protocol_version: "1", error: { code, message } };
+    return { protocol_version: PROTOCOL_VERSION, error: { code, message } };
 }
 const INVALID_COORDINATION_QUERY = Symbol("invalid-coordination-query");
-function parseCursorParameter(value, path) {
+function parseCoordinationQuery(value, path) {
     if (value === undefined)
-        return undefined;
+        return {};
     try {
         const parsed = new URL(value, "https://local.invalid");
         const keys = [...parsed.searchParams.keys()];
-        if (!path.endsWith("/stream")) {
-            return keys.length === 0 ? undefined : INVALID_COORDINATION_QUERY;
-        }
-        if (keys.some((key) => key !== "cursor"))
+        const allowed = path.endsWith("/stream") ? "cursor" : path.endsWith("/drones") ? "since" : null;
+        if (allowed === null)
+            return keys.length === 0 ? {} : INVALID_COORDINATION_QUERY;
+        if (keys.some((key) => key !== allowed))
             return INVALID_COORDINATION_QUERY;
-        const values = parsed.searchParams.getAll("cursor");
+        const values = parsed.searchParams.getAll(allowed);
         if (values.length === 0)
-            return undefined;
-        return values.length === 1 && values[0].length > 0
-            ? values[0]
-            : INVALID_COORDINATION_QUERY;
+            return {};
+        if (values.length !== 1 || values[0].length === 0)
+            return INVALID_COORDINATION_QUERY;
+        return allowed === "cursor" ? { cursor: values[0] } : { since: values[0] };
     }
     catch {
         return INVALID_COORDINATION_QUERY;
     }
 }
 function isCoordinationPath(path) {
-    return path === "/api/client/attach" || path === "/api/cubes" ||
+    return path === ATTACH_PATH || path === CUBES_PATH ||
         path?.startsWith("/api/cubes/") === true;
 }
 function applyServerLimits(server, limits) {
@@ -773,10 +835,6 @@ function credentialIdentity(authorization) {
         return null;
     return `credential:${createHash("sha256").update(authorization).digest("base64url")}`;
 }
-function consumeAuthenticatedRateLimit(authorization, rateLimiter) {
-    const identity = credentialIdentity(authorization);
-    return identity === null ? null : rateLimiter.consume(identity);
-}
 function listen(server, port, host) {
     return new Promise((resolve, reject) => {
         const onError = (error) => {