botmux 2.88.1 → 2.89.0

package/dist/dashboard/daemon-internal-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-internal-api.js","sourceRoot":"","sources":["../../src/dashboard/daemon-internal-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,GAGb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,GAGnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,6BAA6B,GAE9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,GAEV,MAAM,+BAA+B,CAAC;AAqEvC,2EAA2E;AAE3E,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAc,IAAa,EAAE,IAAY;IACzD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAQ,IAAgC,CAAC,IAAI,CAAkB,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,iBAAiB,CACxB,IAAsB,EACtB,WAA+B,EAC/B,aAA6C;IAE7C,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACrB,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC/B,8EAA8E;QAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,OAAO,KAAK,KAAK,WAAW,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,IAA4B,EAC5B,WAA+B;IAE/B,OAAO,iBAAiB,CACtB,IAAI,EACJ,WAAW,EACX,CAAC,CAAC,EAAE,CAAE,CAA6B,EAAE,SAA+B,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,yBAAyB,CAChC,MAA6C,EAC7C,WAA+B;IAE/B,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC1C,OAAQ,CAA6B,EAAE,SAAS,KAAK,QAAQ;QAC5D,CAA6B,CAAC,SAAS,KAAK,WAAW,CACzD,CAAC;IACF,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAI,CAA8B,EAAE,UAEpC,CAAC;QACd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC,EAAE,SAAS,KAAK,WAAW,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CACnD,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,aAAa,CAAC,IAAI,CAAC,EAAE,GAAI,CAAY,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED,yEAAyE;AAEzE,MAAM,MAAM,GAAe;IACzB,yCAAyC;IACzC;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,MAAM,QAAQ,GAAG,QAAQ;gBACvB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;gBACpB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACvD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC7C,CAAC;KACF;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,MAAM,SAAS,GAAG,QAAQ;gBACxB,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC;QAC9C,CAAC;KACF;IACD;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,iCAAiC;QACzC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,wBAAwB,EAAE,EAAE,EAAE,CAAC;KACzG;IACD;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,gCAAgC;YAChC,EAAE;YACF,qEAAqE;YACrE,sEAAsE;YACtE,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;gBAC3D,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACvD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;KACF;IACD;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,uCAAuC;QAC/C,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,KAAK,GAAG;gBACZ,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG;gBAC5C,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;aACjE,CAAC;YACF,uEAAuE;YACvE,yEAAyE;YACzE,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACvE,IACE,MAAM,CAAC,MAAM,KAAK,GAAG;gBACrB,MAAM,CAAC,IAAI;gBACX,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAC/B,KAAK,CAAC,OAAO,CAAE,MAAM,CAAC,IAA2B,CAAC,IAAI,CAAC,EACvD,CAAC;gBACD,MAAM,IAAI,GAAI,MAAM,CAAC,IAAyC,CAAC,IAAI,CAAC;gBACpE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAC3D,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;oBACd,CAAC,CAAC,iBAAiB,CACf,IAAI,EACJ,GAAG,CAAC,WAAW,EACf,CAAC,CAAC,EAAE,CAAE,CAA+C,EAAE,WAAW,EAAE,SAA+B,CACpG,CAAC;gBACN,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,EAAE,GAAI,MAAM,CAAC,IAAgC,EAAE,IAAI,EAAE,MAAM,EAAE;iBACpE,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,iCAAiC;QACzC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,gEAAgE;YAChE,oDAAoD;YACpD,EAAE;YACF,iEAAiE;YACjE,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,QAAQ,EAAE,QAAQ;wBAChB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;wBACpB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC;oBACtD,SAAS,EAAE,QAAQ;wBACjB,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;wBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC;oBACvD,QAAQ,EAAE,IAAI,CAAC,wBAAwB,EAAE;oBACzC,MAAM;iBACP;aACF,CAAC;QACJ,CAAC;KACF;IAED,yCAAyC;IACzC;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,YAAY,GAAG,SAAS,CAAU,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,EAAE,aAAa,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,EAC9E,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;YAC/E,MAAM,KAAK,GAAG,SAAS,CAAU,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnE,CAAC;KACF;IAED,yCAAyC;IACzC;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,wDAAwD;QAChE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAEpB,yCAAyC;YACzC,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,4BAA4B;YAC5B,iDAAiD;YACjD,wDAAwD;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;gBACxE,CAAC;gBACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBAClC,8DAA8D;oBAC9D,sCAAsC;oBACtC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;gBACxE,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,GAAG,CAAC,WAAW,EACf,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,EAC1D;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;iBAClD,CACF,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC5E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,CAAC;YAC/E,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,KAAK,EACL,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,EAC1D;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;aAClD,CACF,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,CAAC;KACF;IAED,yCAAyC;IACzC;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,sCAAsC;QAC9C,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAC7B,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC;KACxE;IACD;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,wCAAwC;QAChD,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAC7B,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC;KAC1E;IACD;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,yCAAyC;QACjD,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAC7B,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC;KAC/E;IACD;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,sDAAsD;QAC9D,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAC7B,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC;KACrG;IACD;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,wDAAwD;QAChE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAC9B,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC;KAC1F;IACD;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,+CAA+C;QACvD,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,KAAK,EACL,cAAc,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAC1C,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,CAAC;KACF;IACD;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,+CAA+C;QACvD,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,KAAK,EACL,cAAc,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAC1C;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;aAClD,CACF,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,CAAC;KACF;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,+CAA+C;QACvD,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,KAAK,EACL,cAAc,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,CAAC;KACF;IAED,yCAAyC;IACzC,EAAE;IACF,kEAAkE;IAClE,uEAAuE;IACvE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,EAAE;IACF,iEAAiE;IACjE,6BAA6B;IAC7B,0EAA0E;IAC1E,uEAAuE;IACvE,8DAA8D;IAC9D,EAAE;IACF,sEAAsE;IACtE,kBAAkB;IAClB;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAyB,CAAC;YAC5C,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CACzD,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAChC,KAAK,CACN,CAAC;YACF,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;gBACnG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChF,CAAC;KACF;IACD;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,+CAA+C;QACvD,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,2DAA2D;YAC3D,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CACzD,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAChC,KAAK,CACN,CAAC;YACF,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;gBACnG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjE,CAAC;KACF;IAED,yCAAyC;IACzC;QACE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,+DAA+D;QACvE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAEpB,uBAAuB;YACvB,iDAAiD;YACjD,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,mEAAmE;YACnE,kEAAkE;YAClE,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;gBACzE,CAAC;gBACD,mEAAmE;gBACnE,mEAAmE;gBACnE,8DAA8D;gBAC9D,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBAClC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;gBACzE,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,GAAG,CAAC,WAAW,EACf,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,EACpD;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;iBAClD,CACF,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,CAAC;YACD,gEAAgE;YAChE,2DAA2D;YAC3D,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC5E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,KAAK,EACL,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,EACpD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;aAClD,CACF,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACtB,KAAK,MAAM,CAAC,IAAI,MAAM;IAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAc,EACd,GAAQ,EACR,OAAe,EACf,IAA2B,EAC3B,WAAoB;IAEpB,IAAI,IAAI,GAAY,SAAS,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;QAAC,CAAC;IAC3E,CAAC;IAED,MAAM,GAAG,GAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAEjE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,yBAAyB,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,yBAAyB,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oDAAoD;AACpD,SAAS,kBAAkB,CAAC,GAAmB,EAAE,MAAqB;IACpE,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAClF,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAWD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;IAEzD,KAAK,UAAU,MAAM,CACnB,GAAoB,EACpB,GAAmB,EACnB,GAAQ;QAER,yEAAyE;QACzE,sEAAsE;QACtE,2EAA2E;QAC3E,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,kBAAkB,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,MAAM,CAAC,UAAU;gBACzB,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,UAAU,EACV,MAAM,CAAC,OAAO,EACd,IAAI,EACJ,MAAM,CAAC,KAAK,CACb,CAAC;QACF,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,GAAQ,EACR,UAAkB,EAAE,EACpB,WAAoB;QAEpB,OAAO,6BAA6B,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC"}

package/dist/dashboard/daemon-internal-auth.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Daemon-internal HMAC auth (PR2 / Route B) — signs & verifies internal
+ * `/__daemon/*` requests sent by botmux daemons to the dashboard process.
+ *
+ * Why a new module instead of `auth.ts:verifyHmac`?
+ *  - `/__cli/rotate` signs only `ts:nonce` (auth.ts:43-45) — a captured signature
+ *    can be replayed against a DIFFERENT path/method/body.
+ *  - Route B signs the full request envelope (ts/nonce/method/pathWithQuery/body),
+ *    so each signature is only valid for one specific call.
+ *  - We deliberately use the SAME `.dashboard-secret` file as the HMAC key so
+ *    operators don't have to manage two secrets; the differing signing material
+ *    prevents cross-protocol replay.
+ *
+ * Wire format mirrors the existing `/__cli/rotate` convention:
+ *   - sender:   `digest('base64url')` and ships sig as base64url string
+ *   - receiver: `Buffer.from(sig, 'base64url')` vs raw `.digest()` Buffer with
+ *               `timingSafeEqual` (see `auth.ts:43-49`)
+ *
+ * Body rule (B1): request body stream MUST only be read once. `verifyDaemonRequest`
+ * consumes it and returns `bodyRaw`; the dispatcher consumes `bodyRaw`, NEVER
+ * `req` again.
+ */
+import type { IncomingMessage } from 'node:http';
+/** Window during which a (ts, nonce) tuple is accepted; mirrors the spec ±60s. */
+export declare const TS_WINDOW_MS = 60000;
+/** Nonce time-to-live before it can be reused (10 minutes — well over TS_WINDOW). */
+export declare const NONCE_TTL_MS: number;
+/** Hard cap on body size we'll read into memory for signing. */
+export declare const BODY_LIMIT_BYTES: number;
+/** Canonical input fed into `signDaemonRequest`. All fields participate in the digest. */
+export interface SignInput {
+    /** `.dashboard-secret` file contents — opaque string used directly as HMAC key. */
+    secret: string;
+    /** Epoch milliseconds, as a string (no trimming, no normalisation). */
+    ts: string;
+    /** One-time random base64url string (32 random bytes recommended). */
+    nonce: string;
+    /** HTTP method; uppercased before being mixed into the digest. */
+    method: string;
+    /** Request `url` exactly as the server will receive it (path + query, including '?' and '&'). */
+    pathWithQuery: string;
+    /** Raw body bytes as a UTF-8 string. Empty body → ''. */
+    bodyRaw: string;
+}
+export interface SignOutput {
+    /** Wire-format signature (base64url, no padding). */
+    wire: string;
+    /** Raw HMAC digest bytes — used by `timingSafeEqual` on the server side. */
+    raw: Buffer;
+}
+/**
+ * Compute the HMAC signature for one request. Pure — no IO, no clock reads.
+ *
+ * Signing material is the canonical 5-line block:
+ *   ts \n nonce \n METHOD \n pathWithQuery \n sha256(bodyRaw)
+ *
+ * Query string order is significant (not canonicalised). Server and client MUST
+ * agree on the exact `pathWithQuery` byte-for-byte.
+ */
+export declare function signDaemonRequest(input: SignInput): SignOutput;
+/**
+ * Timing-safe comparison between a wire-format signature and the raw expected
+ * digest. Returns `false` on any decoding error rather than throwing — the
+ * caller treats a `false` result as `sig_mismatch` without leaking the reason.
+ */
+export declare function checkSig(wireSig: string, expectedRaw: Buffer): boolean;
+/** All-or-nothing loopback predicate, identical to `auth.ts`'s inline check. */
+export declare function isLoopback(remoteAddr: string | undefined): boolean;
+/** Persistent (in-memory) nonce store with lazy GC. */
+export interface NonceStore {
+    has(nonce: string): boolean;
+    add(nonce: string, expiresAt: number): void;
+    /** Number of currently tracked nonces. Useful for diagnostics / tests. */
+    size(): number;
+}
+export interface ClockLike {
+    now(): number;
+}
+/** Default clock — wraps `Date.now`. Replace in tests via the optional `clock` arg. */
+export declare const realClock: ClockLike;
+/**
+ * Create an in-process nonce store. Each `has()` triggers a lazy sweep of
+ * expired entries so the map cannot grow unbounded across a daemon lifetime.
+ */
+export declare function createNonceStore(clock?: ClockLike): NonceStore;
+/**
+ * Read the body stream into a single UTF-8 string, with a hard byte cap.
+ * Returns `null` when the cap is exceeded (caller maps to 413).
+ *
+ * Body MUST only be read once per request; `verifyDaemonRequest` is the only
+ * site that calls this, and downstream dispatch consumes the returned string.
+ */
+export declare function readBodyRaw(req: IncomingMessage, opts?: {
+    maxBytes?: number;
+}): Promise<string | null>;
+/** Reasons the verifier may reject a request. Mirror these in HTTP responses. */
+export type VerifyRejection = 'missing_header' | 'remote_not_loopback' | 'ts_malformed' | 'ts_window' | 'replay' | 'sig_mismatch' | 'body_too_large';
+export interface VerifyOk {
+    ok: true;
+    /** Self-reported daemon app id (audit only — NOT used for authn / authz). */
+    appId: string;
+    /** Body raw bytes read by verify; dispatcher MUST consume this, not `req`. */
+    bodyRaw: string;
+}
+export interface VerifyFail {
+    ok: false;
+    reason: VerifyRejection;
+    /** Suggested HTTP status code for the rejection. */
+    httpStatus: number;
+}
+export type VerifyResult = VerifyOk | VerifyFail;
+export interface VerifyOptions {
+    /** Override the default clock — used by tests to advance time deterministically. */
+    clock?: ClockLike;
+    /** Override the default body cap (rare; tests use this to assert 413 quickly). */
+    maxBodyBytes?: number;
+}
+/**
+ * Verify an inbound `/__daemon/*` request. Consumes the body stream exactly
+ * once and returns `bodyRaw` for the dispatcher. On success, the nonce is
+ * recorded with a TTL to block replays.
+ */
+export declare function verifyDaemonRequest(req: IncomingMessage, secret: string, nonceStore: NonceStore, opts?: VerifyOptions): Promise<VerifyResult>;
+//# sourceMappingURL=daemon-internal-auth.d.ts.map

package/dist/dashboard/daemon-internal-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-internal-auth.d.ts","sourceRoot":"","sources":["../../src/dashboard/daemon-internal-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,kFAAkF;AAClF,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC,qFAAqF;AACrF,eAAO,MAAM,YAAY,QAAc,CAAC;AAExC,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAE5C,0FAA0F;AAC1F,MAAM,WAAW,SAAS;IACxB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAW9D;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAStE;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKlE;AAED,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,0EAA0E;IAC1E,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,IAAI,MAAM,CAAC;CACf;AAED,uFAAuF;AACvF,eAAO,MAAM,SAAS,EAAE,SAAqC,CAAC;AAE9D;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,SAAqB,GAAG,UAAU,CAsBzE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,eAAe,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED,iFAAiF;AACjF,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,qBAAqB,GACrB,cAAc,GACd,WAAW,GACX,QAAQ,GACR,cAAc,GACd,gBAAgB,CAAC;AAErB,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,eAAe,CAAC;IACxB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAsDvB"}

package/dist/dashboard/daemon-internal-auth.js

@@ -0,0 +1,188 @@
+/**
+ * Daemon-internal HMAC auth (PR2 / Route B) — signs & verifies internal
+ * `/__daemon/*` requests sent by botmux daemons to the dashboard process.
+ *
+ * Why a new module instead of `auth.ts:verifyHmac`?
+ *  - `/__cli/rotate` signs only `ts:nonce` (auth.ts:43-45) — a captured signature
+ *    can be replayed against a DIFFERENT path/method/body.
+ *  - Route B signs the full request envelope (ts/nonce/method/pathWithQuery/body),
+ *    so each signature is only valid for one specific call.
+ *  - We deliberately use the SAME `.dashboard-secret` file as the HMAC key so
+ *    operators don't have to manage two secrets; the differing signing material
+ *    prevents cross-protocol replay.
+ *
+ * Wire format mirrors the existing `/__cli/rotate` convention:
+ *   - sender:   `digest('base64url')` and ships sig as base64url string
+ *   - receiver: `Buffer.from(sig, 'base64url')` vs raw `.digest()` Buffer with
+ *               `timingSafeEqual` (see `auth.ts:43-49`)
+ *
+ * Body rule (B1): request body stream MUST only be read once. `verifyDaemonRequest`
+ * consumes it and returns `bodyRaw`; the dispatcher consumes `bodyRaw`, NEVER
+ * `req` again.
+ */
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+/** Window during which a (ts, nonce) tuple is accepted; mirrors the spec ±60s. */
+export const TS_WINDOW_MS = 60_000;
+/** Nonce time-to-live before it can be reused (10 minutes — well over TS_WINDOW). */
+export const NONCE_TTL_MS = 10 * 60_000;
+/** Hard cap on body size we'll read into memory for signing. */
+export const BODY_LIMIT_BYTES = 1024 * 1024;
+/**
+ * Compute the HMAC signature for one request. Pure — no IO, no clock reads.
+ *
+ * Signing material is the canonical 5-line block:
+ *   ts \n nonce \n METHOD \n pathWithQuery \n sha256(bodyRaw)
+ *
+ * Query string order is significant (not canonicalised). Server and client MUST
+ * agree on the exact `pathWithQuery` byte-for-byte.
+ */
+export function signDaemonRequest(input) {
+    const bodyHashHex = createHash('sha256').update(input.bodyRaw).digest('hex');
+    const material = [
+        input.ts,
+        input.nonce,
+        input.method.toUpperCase(),
+        input.pathWithQuery,
+        bodyHashHex,
+    ].join('\n');
+    const raw = createHmac('sha256', input.secret).update(material).digest();
+    return { wire: raw.toString('base64url'), raw };
+}
+/**
+ * Timing-safe comparison between a wire-format signature and the raw expected
+ * digest. Returns `false` on any decoding error rather than throwing — the
+ * caller treats a `false` result as `sig_mismatch` without leaking the reason.
+ */
+export function checkSig(wireSig, expectedRaw) {
+    let provided;
+    try {
+        provided = Buffer.from(wireSig, 'base64url');
+    }
+    catch {
+        return false;
+    }
+    if (provided.length !== expectedRaw.length)
+        return false;
+    return timingSafeEqual(provided, expectedRaw);
+}
+/** All-or-nothing loopback predicate, identical to `auth.ts`'s inline check. */
+export function isLoopback(remoteAddr) {
+    if (!remoteAddr)
+        return false;
+    if (remoteAddr === '127.0.0.1' || remoteAddr === '::1')
+        return true;
+    if (remoteAddr.endsWith('::ffff:127.0.0.1'))
+        return true;
+    return false;
+}
+/** Default clock — wraps `Date.now`. Replace in tests via the optional `clock` arg. */
+export const realClock = { now: () => Date.now() };
+/**
+ * Create an in-process nonce store. Each `has()` triggers a lazy sweep of
+ * expired entries so the map cannot grow unbounded across a daemon lifetime.
+ */
+export function createNonceStore(clock = realClock) {
+    const m = new Map();
+    const gc = (now) => {
+        for (const [n, exp] of m) {
+            if (exp <= now)
+                m.delete(n);
+        }
+    };
+    return {
+        has(nonce) {
+            gc(clock.now());
+            return m.has(nonce);
+        },
+        add(nonce, expiresAt) {
+            m.set(nonce, expiresAt);
+        },
+        size() {
+            gc(clock.now());
+            return m.size;
+        },
+    };
+}
+/**
+ * Read the body stream into a single UTF-8 string, with a hard byte cap.
+ * Returns `null` when the cap is exceeded (caller maps to 413).
+ *
+ * Body MUST only be read once per request; `verifyDaemonRequest` is the only
+ * site that calls this, and downstream dispatch consumes the returned string.
+ */
+export async function readBodyRaw(req, opts = {}) {
+    const cap = opts.maxBytes ?? BODY_LIMIT_BYTES;
+    let total = 0;
+    const chunks = [];
+    for await (const chunk of req) {
+        const buf = chunk;
+        total += buf.length;
+        if (total > cap)
+            return null;
+        chunks.push(buf);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+/**
+ * Read a single header value. Node normally comma-joins duplicate wire headers;
+ * array-valued headers can still appear in tests/custom callers. Accept only
+ * strings so malformed arrays fail as missing headers instead of picking one.
+ */
+function headerStr(req, name) {
+    const v = req.headers[name];
+    return typeof v === 'string' ? v : undefined;
+}
+/**
+ * Verify an inbound `/__daemon/*` request. Consumes the body stream exactly
+ * once and returns `bodyRaw` for the dispatcher. On success, the nonce is
+ * recorded with a TTL to block replays.
+ */
+export async function verifyDaemonRequest(req, secret, nonceStore, opts = {}) {
+    const clock = opts.clock ?? realClock;
+    const ts = headerStr(req, 'x-botmux-daemon-ts');
+    const nonce = headerStr(req, 'x-botmux-daemon-nonce');
+    const sig = headerStr(req, 'x-botmux-daemon-sig');
+    const appId = headerStr(req, 'x-botmux-daemon-appid');
+    if (!ts || !nonce || !sig || !appId) {
+        return { ok: false, reason: 'missing_header', httpStatus: 400 };
+    }
+    if (!isLoopback(req.socket?.remoteAddress)) {
+        return { ok: false, reason: 'remote_not_loopback', httpStatus: 403 };
+    }
+    // Stricter than parseInt — rejects '123abc' / '1.5' / '' / 'NaN' / Infinity.
+    const tsMs = Number(ts);
+    if (!Number.isFinite(tsMs) || !Number.isInteger(tsMs)) {
+        return { ok: false, reason: 'ts_malformed', httpStatus: 401 };
+    }
+    if (Math.abs(clock.now() - tsMs) > TS_WINDOW_MS) {
+        return { ok: false, reason: 'ts_window', httpStatus: 401 };
+    }
+    // Body must be read BEFORE the nonce check so that the `has → add` window
+    // contains no `await` — concurrent requests with the same nonce can each
+    // pass `has()` only one at a time, which then `add()`s the entry before any
+    // other microtask can run. See test: "concurrent requests with the same
+    // nonce — exactly one is accepted".
+    const bodyRaw = await readBodyRaw(req, { maxBytes: opts.maxBodyBytes ?? BODY_LIMIT_BYTES });
+    if (bodyRaw === null) {
+        return { ok: false, reason: 'body_too_large', httpStatus: 413 };
+    }
+    // ─── Synchronous block — no `await` until `add()` finishes. ───
+    if (nonceStore.has(nonce)) {
+        return { ok: false, reason: 'replay', httpStatus: 401 };
+    }
+    const { raw: expected } = signDaemonRequest({
+        secret,
+        ts,
+        nonce,
+        method: req.method ?? 'GET',
+        pathWithQuery: req.url ?? '/',
+        bodyRaw,
+    });
+    if (!checkSig(sig, expected)) {
+        return { ok: false, reason: 'sig_mismatch', httpStatus: 401 };
+    }
+    nonceStore.add(nonce, clock.now() + NONCE_TTL_MS);
+    // ─── End synchronous block. ───
+    return { ok: true, appId, bodyRaw };
+}
+//# sourceMappingURL=daemon-internal-auth.js.map

package/dist/dashboard/daemon-internal-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-internal-auth.js","sourceRoot":"","sources":["../../src/dashboard/daemon-internal-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGtE,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,qFAAqF;AACrF,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAExC,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAyB5C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAgB;IAChD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG;QACf,KAAK,CAAC,EAAE;QACR,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,aAAa;QACnB,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,WAAmB;IAC3D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,UAA8B;IACvD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAcD,uFAAuF;AACvF,MAAM,CAAC,MAAM,SAAS,GAAc,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAE9D;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAmB,SAAS;IAC3D,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpC,MAAM,EAAE,GAAG,CAAC,GAAW,EAAQ,EAAE;QAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,GAAG,IAAI,GAAG;gBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,KAAa;YACf,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,GAAG,CAAC,KAAa,EAAE,SAAiB;YAClC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI;YACF,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB,EACpB,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAC;QAC5B,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;QACpB,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAoCD;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAoB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,MAAc,EACd,UAAsB,EACtB,OAAsB,EAAE;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IAEtC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACvE,CAAC;IAED,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC7D,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAClE,CAAC;IAED,iEAAiE;IACjE,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC;QAC1C,MAAM;QACN,EAAE;QACF,KAAK;QACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;QAC3B,aAAa,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;QAC7B,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAChE,CAAC;IAED,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;IAClD,iCAAiC;IACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/dashboard/daemon-internal-client.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Daemon-internal HTTP client (PR2 C7) — used by daemon processes to talk to
+ * the dashboard's `/__daemon/*` Route B endpoints with HMAC auth.
+ *
+ * Retry policy (codex C7 gate):
+ *   - GET defaults to N retries with exponential backoff. Each attempt mints
+ *     a fresh `ts + nonce + sig`; we never reuse a signature.
+ *   - Non-GET (POST/PUT/DELETE) defaults to NO retry to avoid double-effect
+ *     on close/resume/leave/disband/settings-write/etc. Callers can opt in
+ *     with `retryUnsafeWrites: true` when they're confident the endpoint is
+ *     idempotent end-to-end.
+ *   - 401 is never retried (sig will not become valid by retrying).
+ *   - 4xx other than 408/429 is also never retried.
+ *   - Network errors and timeouts follow the same per-method policy.
+ *
+ * Signed `pathWithQuery` is forwarded BYTE-FOR-BYTE to fetch; we never
+ * canonicalise the query string. Callers that build URLs MUST control their
+ * own parameter order.
+ *
+ * The client never touches the real dashboard in tests — `fetch` / `now` /
+ * `randomNonce` / `secret` are all injectable.
+ */
+export interface DaemonClientOptions {
+    /** Base URL of the dashboard process (default `http://127.0.0.1:7891`). */
+    dashboardUrl?: string;
+    /** Override the HMAC key. Production loads from `.dashboard-secret` if omitted. */
+    secret?: string;
+    /** Override `.dashboard-secret` path (tests). */
+    secretPath?: string;
+    /** Identifier this daemon reports in the `X-Botmux-Daemon-AppId` header (audit, not authn). */
+    appId: string;
+    /** Override `fetch` (tests). */
+    fetch?: typeof fetch;
+    /** Override `Date.now` (tests). */
+    now?: () => number;
+    /** Override nonce source (tests). Default 32 random bytes base64url. */
+    randomNonce?: () => string;
+    /** Default retry count for GETs / write+retryUnsafeWrites. Default 3. */
+    retries?: number;
+    /** Override backoff schedule. Default: min(100ms * 2^attempt, 5000ms). */
+    backoffMs?: (attempt: number) => number;
+    /** Per-request timeout default. Default 5000ms. */
+    timeoutMs?: number;
+    /** Skip sleeping between retries — used by tests to keep runtime O(ms). */
+    skipBackoffSleep?: boolean;
+}
+export interface DaemonRequestOptions {
+    method?: string;
+    /** Path + query as a single string, e.g. '/__daemon/sessions-list?all=1'. Signed verbatim. */
+    path: string;
+    body?: unknown;
+    retryUnsafeWrites?: boolean;
+    retries?: number;
+    timeoutMs?: number;
+}
+export interface DaemonClientResponse {
+    status: number;
+    /** Decoded JSON when the response was JSON; otherwise the raw text. */
+    body: unknown;
+    /** Raw response text (whether or not it was JSON-parseable). */
+    raw: string;
+}
+export interface DaemonClient {
+    request(opts: DaemonRequestOptions): Promise<DaemonClientResponse>;
+}
+export declare function createDaemonClient(opts: DaemonClientOptions): DaemonClient;
+//# sourceMappingURL=daemon-internal-client.d.ts.map

package/dist/dashboard/daemon-internal-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-internal-client.d.ts","sourceRoot":"","sources":["../../src/dashboard/daemon-internal-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAiBH,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC;IACd,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpE;AAsCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAgF1E"}

package/dist/dashboard/daemon-internal-client.js

@@ -0,0 +1,157 @@
+/**
+ * Daemon-internal HTTP client (PR2 C7) — used by daemon processes to talk to
+ * the dashboard's `/__daemon/*` Route B endpoints with HMAC auth.
+ *
+ * Retry policy (codex C7 gate):
+ *   - GET defaults to N retries with exponential backoff. Each attempt mints
+ *     a fresh `ts + nonce + sig`; we never reuse a signature.
+ *   - Non-GET (POST/PUT/DELETE) defaults to NO retry to avoid double-effect
+ *     on close/resume/leave/disband/settings-write/etc. Callers can opt in
+ *     with `retryUnsafeWrites: true` when they're confident the endpoint is
+ *     idempotent end-to-end.
+ *   - 401 is never retried (sig will not become valid by retrying).
+ *   - 4xx other than 408/429 is also never retried.
+ *   - Network errors and timeouts follow the same per-method policy.
+ *
+ * Signed `pathWithQuery` is forwarded BYTE-FOR-BYTE to fetch; we never
+ * canonicalise the query string. Callers that build URLs MUST control their
+ * own parameter order.
+ *
+ * The client never touches the real dashboard in tests — `fetch` / `now` /
+ * `randomNonce` / `secret` are all injectable.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { loadDashboardSecret } from './auth.js';
+import { signDaemonRequest } from './daemon-internal-auth.js';
+const DEFAULT_DASHBOARD_URL = 'http://127.0.0.1:7891';
+const DEFAULT_RETRIES = 3;
+const DEFAULT_TIMEOUT_MS = 5000;
+const DEFAULT_BASE_BACKOFF_MS = 100;
+const DEFAULT_MAX_BACKOFF_MS = 5_000;
+const SECRET_PATH_DEFAULT = join(homedir(), '.botmux', '.dashboard-secret');
+function defaultBackoffMs(attempt) {
+    return Math.min(DEFAULT_BASE_BACKOFF_MS * 2 ** attempt, DEFAULT_MAX_BACKOFF_MS);
+}
+function defaultNonce() {
+    return randomBytes(32).toString('base64url');
+}
+function loadSecretFromFile(secretPath) {
+    const secret = loadDashboardSecret(secretPath);
+    if (!secret)
+        throw new Error('dashboard_secret_missing');
+    return secret;
+}
+/**
+ * Decide whether the failed attempt is retriable.
+ *  - 401 → never (signature mismatch / replay etc. — retrying with the same
+ *    parameters cannot fix it).
+ *  - Other 4xx except 408 (Request Timeout) and 429 (Too Many Requests) →
+ *    never retry; these are caller-side errors.
+ *  - 5xx / 408 / 429 / network error → retry only when `retryAllowed`.
+ */
+function isRetriable(status, retryAllowed) {
+    if (!retryAllowed)
+        return false;
+    if (status === undefined)
+        return true; // network error / timeout
+    if (status === 401)
+        return false;
+    if (status >= 400 && status < 500) {
+        return status === 408 || status === 429;
+    }
+    return status >= 500;
+}
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+export function createDaemonClient(opts) {
+    const dashboardUrl = opts.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
+    const secret = opts.secret?.trim() ?? loadSecretFromFile(opts.secretPath ?? SECRET_PATH_DEFAULT);
+    if (!secret)
+        throw new Error('dashboard_secret_missing');
+    const appId = opts.appId;
+    const fetchFn = opts.fetch ?? fetch;
+    const now = opts.now ?? Date.now;
+    const nonceFn = opts.randomNonce ?? defaultNonce;
+    const defaultRetries = opts.retries ?? DEFAULT_RETRIES;
+    const backoffMs = opts.backoffMs ?? defaultBackoffMs;
+    const defaultTimeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const skipSleep = opts.skipBackoffSleep === true;
+    async function request(reqOpts) {
+        const method = (reqOpts.method ?? 'GET').toUpperCase();
+        const isGet = method === 'GET';
+        const retryAllowed = isGet || reqOpts.retryUnsafeWrites === true;
+        // `retries` is the number of EXTRA attempts on top of the initial one,
+        // so `retries=0` means one attempt and no retry. Negative values clamp
+        // to 0 rather than throwing — caller intent is "no retry".
+        const retryCount = Math.max(0, reqOpts.retries ?? defaultRetries);
+        const maxAttempts = retryAllowed ? retryCount + 1 : 1;
+        const timeoutMs = reqOpts.timeoutMs ?? defaultTimeoutMs;
+        const bodyRaw = reqOpts.body === undefined ? '' : JSON.stringify(reqOpts.body);
+        const fetchUrl = dashboardUrl + reqOpts.path;
+        let lastResponse;
+        let lastError;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            // Every attempt MUST mint a fresh ts + nonce + sig — server enforces a
+            // 10-min nonce TTL but ALSO has a ±60s ts window, and reusing the same
+            // (ts, nonce) just causes a guaranteed `replay` rejection.
+            const ts = String(now());
+            const nonce = nonceFn();
+            const { wire } = signDaemonRequest({
+                secret, ts, nonce, method, pathWithQuery: reqOpts.path, bodyRaw,
+            });
+            const controller = new AbortController();
+            const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                const res = await fetchFn(fetchUrl, {
+                    method,
+                    headers: {
+                        'x-botmux-daemon-ts': ts,
+                        'x-botmux-daemon-nonce': nonce,
+                        'x-botmux-daemon-sig': wire,
+                        'x-botmux-daemon-appid': appId,
+                        'content-type': 'application/json',
+                    },
+                    body: bodyRaw.length > 0 ? bodyRaw : undefined,
+                    signal: controller.signal,
+                });
+                const text = await res.text();
+                let parsed;
+                try {
+                    parsed = text.length > 0 ? JSON.parse(text) : undefined;
+                }
+                catch {
+                    parsed = text;
+                }
+                lastResponse = { status: res.status, body: parsed, raw: text };
+                if (res.status < 400)
+                    return lastResponse;
+                if (!isRetriable(res.status, retryAllowed))
+                    return lastResponse;
+                if (attempt === maxAttempts - 1)
+                    return lastResponse;
+                if (!skipSleep)
+                    await sleep(backoffMs(attempt));
+            }
+            catch (error) {
+                lastError = error;
+                if (!isRetriable(undefined, retryAllowed))
+                    throw error;
+                if (attempt === maxAttempts - 1)
+                    throw error;
+                if (!skipSleep)
+                    await sleep(backoffMs(attempt));
+            }
+            finally {
+                clearTimeout(timeoutHandle);
+            }
+        }
+        if (lastResponse)
+            return lastResponse;
+        throw lastError ?? new Error('daemon_client_unknown_error');
+    }
+    return { request };
+}
+//# sourceMappingURL=daemon-internal-client.js.map

package/dist/dashboard/daemon-internal-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-internal-client.js","sourceRoot":"","sources":["../../src/dashboard/daemon-internal-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAiD5E,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,GAAG,CAAC,IAAI,OAAO,EAAE,sBAAsB,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,MAA0B,EAAE,YAAqB;IACpE,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IACjE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,IAAI,GAAG,CAAC;AACvB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACjD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACrD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAEjD,KAAK,UAAU,OAAO,CAAC,OAA6B;QAClD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC;QACjE,uEAAuE;QACvE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;QAE7C,IAAI,YAA8C,CAAC;QACnD,IAAI,SAAkB,CAAC;QAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,uEAAuE;YACvE,uEAAuE;YACvE,2DAA2D;YAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;YACxB,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC;gBACjC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO;aAChE,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;oBAClC,MAAM;oBACN,OAAO,EAAE;wBACP,oBAAoB,EAAE,EAAE;wBACxB,uBAAuB,EAAE,KAAK;wBAC9B,qBAAqB,EAAE,IAAI;wBAC3B,uBAAuB,EAAE,KAAK;wBAC9B,cAAc,EAAE,kBAAkB;qBACnC;oBACD,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;oBAC9C,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAAC,CAAC;gBAChE,MAAM,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,CAAC;gBACxB,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;gBAE/D,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;oBAAE,OAAO,YAAY,CAAC;gBAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC;oBAAE,OAAO,YAAY,CAAC;gBAChE,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;oBAAE,OAAO,YAAY,CAAC;gBACrD,IAAI,CAAC,SAAS;oBAAE,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,SAAS,GAAG,KAAK,CAAC;gBAClB,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACvD,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC7C,IAAI,CAAC,SAAS;oBAAE,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/dist/dashboard/dashboard-admins.d.ts

@@ -0,0 +1,8 @@
+export interface DashboardAdminLookupDeps {
+    getDashboardAdminOpenIds?: (larkAppId: string) => ReadonlyArray<string> | undefined;
+    /** Legacy test seam retained while callers migrate from first-owner checks. */
+    getOwnerOpenId?: (larkAppId: string) => string | undefined;
+}
+export declare function resolveDashboardAdminOpenIds(larkAppId: string, deps?: DashboardAdminLookupDeps): string[];
+export declare function isDashboardAdmin(larkAppId: string, openId: string | undefined, deps?: DashboardAdminLookupDeps): openId is string;
+//# sourceMappingURL=dashboard-admins.d.ts.map

package/dist/dashboard/dashboard-admins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-admins.d.ts","sourceRoot":"","sources":["../../src/dashboard/dashboard-admins.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,wBAAwB;IACvC,wBAAwB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACpF,+EAA+E;IAC/E,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,wBAA6B,GAClC,MAAM,EAAE,CASV;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,GAAE,wBAA6B,GAClC,MAAM,IAAI,MAAM,CAElB"}

package/dist/dashboard/dashboard-admins.js

@@ -0,0 +1,15 @@
+import { getDashboardAdminOpenIds as defaultGetDashboardAdminOpenIds } from '../bot-registry.js';
+export function resolveDashboardAdminOpenIds(larkAppId, deps = {}) {
+    if (deps.getDashboardAdminOpenIds) {
+        return [...(deps.getDashboardAdminOpenIds(larkAppId) ?? [])].filter(Boolean);
+    }
+    if (deps.getOwnerOpenId) {
+        const owner = deps.getOwnerOpenId(larkAppId);
+        return owner ? [owner] : [];
+    }
+    return defaultGetDashboardAdminOpenIds(larkAppId).filter(Boolean);
+}
+export function isDashboardAdmin(larkAppId, openId, deps = {}) {
+    return !!openId && resolveDashboardAdminOpenIds(larkAppId, deps).includes(openId);
+}
+//# sourceMappingURL=dashboard-admins.js.map

package/dist/dashboard/dashboard-admins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-admins.js","sourceRoot":"","sources":["../../src/dashboard/dashboard-admins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,IAAI,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAQjG,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,OAAiC,EAAE;IAEnC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,+BAA+B,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,MAA0B,EAC1B,OAAiC,EAAE;IAEnC,OAAO,CAAC,CAAC,MAAM,IAAI,4BAA4B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC"}