deepdebug-local-agent 1.3.0 → 1.5.0

package/src/la-protocol-v2/strict-json.js

@@ -0,0 +1,47 @@
+/**
+ * strict-json.js - JSON.parse that refuses duplicate object keys (the gateway refuses them too: with a
+ * duplicate, two parsers could disagree about which value a signed field has).
+ *
+ * parseStrict(text) -> value. Throws on invalid JSON or on a duplicate key at any depth.
+ * Implemented as a small scanner for the keys plus the native parser for the values, so the parsed
+ * result is exactly what JSON.parse returns.
+ */
+export function parseStrict(text) {
+    const value = JSON.parse(text); // throws on invalid JSON
+    assertNoDuplicateKeys(text);
+    return value;
+}
+
+function assertNoDuplicateKeys(text) {
+    const stack = []; // one Set of keys per open object; null for arrays
+    let i = 0;
+    const n = text.length;
+    let expectKey = false;
+    while (i < n) {
+        const c = text.charCodeAt(i);
+        if (c === 0x22 /* " */) {
+            const start = i + 1;
+            i++;
+            while (i < n) {
+                const d = text.charCodeAt(i);
+                if (d === 0x5c /* \ */) { i += 2; continue; }
+                if (d === 0x22) break;
+                i++;
+            }
+            const top = stack[stack.length - 1];
+            if (expectKey && top) {
+                const key = JSON.parse(`"${text.slice(start, i)}"`);
+                if (top.has(key)) throw new Error("duplicate key");
+                top.add(key);
+                expectKey = false;
+            }
+            i++;
+            continue;
+        }
+        if (c === 0x7b /* { */) { stack.push(new Set()); expectKey = true; }
+        else if (c === 0x5b /* [ */) { stack.push(null); expectKey = false; }
+        else if (c === 0x7d || c === 0x5d) { stack.pop(); expectKey = false; }
+        else if (c === 0x2c /* , */) { expectKey = stack.length > 0 && stack[stack.length - 1] !== null; }
+        i++;
+    }
+}

package/src/server.js

@@ -19,6 +19,7 @@ import { getSigningConfig, createSignatureMiddleware, captureRawBody, describeSi
 import { decideExec, rejectionBody, resolveExecPolicyConfig } from "./utils/exec-policy.js";
 import { createHash as wsCreateHash } from "node:crypto";
 import { resolveWsMetadataConfig, createWsMetadataGuard, createConnectionState, createOfflinePolicyGuard } from "./ws-channel/index.js";
+import { resolveProtocolV2Config, resolveAgentId } from "./la-protocol-v2/config.js";
 import { resolveEffectiveHeaderRoot } from "./utils/root-recovery.js";
 import { classifyGrepFailure, partialSearchBody } from "./utils/search-outcome.js";
 import { classifyOpenDestination, extractOpenTenantId, isSafeToRemove } from "./utils/open-gate.js";
@@ -644,6 +645,11 @@ console.log(`[exec-policy] mode=${EXEC_POLICY.mode} (allowlist; LOCAL_AGENT_EXEC
 // actions are denied while the control plane is unreachable. off = nothing changes.
 const WS_METADATA = resolveWsMetadataConfig();
 const WS_CONNECTION = createConnectionState();
+// LOCAL_AGENT_PROTOCOL_V2 (F3-05b, default off): with it off the tunnel below is the v1 client, untouched.
+const PROTOCOL_V2 = resolveProtocolV2Config();
+if (!PROTOCOL_V2.enabled && /^(true|1|yes|on)$/i.test(String(process.env.LOCAL_AGENT_CONTENT_HANDLERS ?? '').trim())) {
+    console.warn('[la-v2] LOCAL_AGENT_CONTENT_HANDLERS is set but LOCAL_AGENT_PROTOCOL_V2 is off: content handlers stay off');
+}
 if (WS_METADATA.mode === "enforce") {
     EXEC_POLICY.offlineGuard = createOfflinePolicyGuard({
         connection: WS_CONNECTION,
@@ -6941,7 +6947,7 @@ app.post("/workspace/:workspaceId/run", async (req, res) => {
 //  WEBSOCKET REVERSE TUNNEL
 // Connects Local Agent to Gateway  no public URL needed
 // ============================================
-async function startWebSocketTunnel(port, gatewayUrl, authToken, tenantId) {
+async function startWebSocketTunnel(port, gatewayUrl, authToken, tenantId, agentId = null) {
     if (!gatewayUrl || !tenantId) {
         console.log('WebSocket tunnel skipped: missing gatewayUrl or tenantId');
         return;
@@ -6977,6 +6983,16 @@ async function startWebSocketTunnel(port, gatewayUrl, authToken, tenantId) {
         const out = metaGuard ? guardedFrame : JSON.stringify(legacyObj);
         if (out) ws.send(out);
     };
+    // Protocol v2 (F3-05b): only when LOCAL_AGENT_PROTOCOL_V2=true. null = the v1 client exactly as before.
+    let v2Link = null;
+    if (PROTOCOL_V2.enabled) {
+        try {
+            const { buildV2Link } = await import('./la-protocol-v2/runtime.js');
+            v2Link = await buildV2Link({ tenantId, agentId, signing: SIGNING, wsManager, getWorkspaceRoot: () => WORKSPACE_ROOT });
+        } catch (err) {
+            console.warn(`[la-v2] off: ${err.code || err.name} while loading the protocol module`);
+        }
+    }
 
     async function connect() {
         if (isShuttingDown) return;
@@ -6989,10 +7005,12 @@ async function startWebSocketTunnel(port, gatewayUrl, authToken, tenantId) {
                 reconnectDelay = 2000;
                 WS_CONNECTION.markOpen();
                 const legacyRegister = { type: 'register', tenantId, port, workspacePath: WORKSPACE_ROOT || null };
-                sendFrame(legacyRegister, metaGuard && metaGuard.frameMessage({
+                const sendLegacyRegister = () => sendFrame(legacyRegister, metaGuard && metaGuard.frameMessage({
                     type: 'register', tenantId, port: Number(port),
                     ...(WORKSPACE_ROOT ? { workspaceHash: wsCreateHash("sha256").update(String(WORKSPACE_ROOT)).digest('hex') } : {}),
                 }));
+                // v2 owns the registration while it negotiates; the v1 register goes out only if the gateway does not speak v2.
+                if (!(v2Link && v2Link.begin(ws, sendLegacyRegister))) sendLegacyRegister();
                 const hb = setInterval(() => {
                     if (ws.readyState === WebSocket.OPEN) {
                         ws.send('ping');
@@ -7005,10 +7023,12 @@ async function startWebSocketTunnel(port, gatewayUrl, authToken, tenantId) {
 
             ws.on('pong', () => WS_CONNECTION.markSeen());
 
-            ws.on('message', async (data) => {
+            ws.on('message', async (data, isBinary) => {
                 WS_CONNECTION.markSeen();
                 const text = data.toString();
                 if (text === 'pong') return;
+                // v2 frames (schemaVersion) are handled by the protocol module; v1 commands fall through to the handler below.
+                if (v2Link && v2Link.handleMessage(ws, text, isBinary)) return;
                 let request;
                 try { request = JSON.parse(text); } catch { return; }
                 const { requestId, command } = request;
@@ -7035,6 +7055,7 @@ async function startWebSocketTunnel(port, gatewayUrl, authToken, tenantId) {
 
             ws.on('close', () => {
                 WS_CONNECTION.markClosed();
+                if (v2Link) v2Link.onClose(ws);
                 if (!isShuttingDown) {
                     console.log(`WS disconnected. Reconnecting in ${reconnectDelay/1000}s...`);
                     setTimeout(connect, reconnectDelay);
@@ -8164,7 +8185,7 @@ app.listen(PORT, BIND_HOST, async () => {
     }
 
     if (process.env.DISABLE_WS_TUNNEL !== 'true') {
-        startWebSocketTunnel(PORT, gwUrl, wsToken, tenantId);
+        startWebSocketTunnel(PORT, gwUrl, wsToken, tenantId, resolveAgentId(process.env, cfg));
     }
 
     // Sibling plane (started here so the frozen monolith is untouched): metrics

package/test/contract/la-protocol-v2/vectors/ack.vectors.json

@@ -0,0 +1,149 @@
+{
+  "type": "ack",
+  "schema": "ack.schema.json",
+  "vectors": [
+    {
+      "name": "minimal-valid",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "ack",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 0,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "payload": {
+          "ackSeq": 1,
+          "status": "accepted"
+        },
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
+      }
+    },
+    {
+      "name": "extra-top-level-field",
+      "why": "envelope is closed (additionalProperties:false)",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "ack",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 0,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "payload": {
+          "ackSeq": 1,
+          "status": "accepted"
+        },
+        "extra": "x",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
+      }
+    },
+    {
+      "name": "extra-payload-field",
+      "why": "payload is closed: no free-form fields",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "ack",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 0,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "payload": {
+          "ackSeq": 1,
+          "status": "accepted",
+          "freeText": "client text"
+        },
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
+      }
+    },
+    {
+      "name": "tenant-id-not-uuid",
+      "why": "tenantId must be a UUID",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "ack",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 0,
+        "tenantId": "tenant-1",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "payload": {
+          "ackSeq": 1,
+          "status": "accepted"
+        },
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
+      }
+    },
+    {
+      "name": "ack-with-sig",
+      "why": "control frames are not signed",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "ack",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 0,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "payload": {
+          "ackSeq": 1,
+          "status": "accepted"
+        },
+        "sig": {
+          "keyId": "vh-cp-2026-10",
+          "timestamp": "1793268000",
+          "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+          "workspaceId": "ws-1",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+        },
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
+      }
+    },
+    {
+      "name": "missing-agent-id",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "required"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "ack",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 0,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "payload": {
+          "ackSeq": 1,
+          "status": "accepted"
+        }
+      },
+      "why": "agentId is required on ack/error (the gateway refuses a frame without it: agent_mismatch)"
+    }
+  ]
+}

package/test/contract/la-protocol-v2/vectors/alert.vectors.json

@@ -0,0 +1,101 @@
+{
+  "type": "alert",
+  "schema": "alert.schema.json",
+  "vectors": [
+    {
+      "name": "minimal-valid",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "alert",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "code": "index_stale",
+          "severity": "warning",
+          "value": 86400
+        }
+      }
+    },
+    {
+      "name": "extra-top-level-field",
+      "why": "envelope is closed (additionalProperties:false)",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "alert",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "code": "index_stale",
+          "severity": "warning",
+          "value": 86400
+        },
+        "extra": "x"
+      }
+    },
+    {
+      "name": "extra-payload-field",
+      "why": "payload is closed: no free-form fields",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "alert",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "code": "index_stale",
+          "severity": "warning",
+          "value": 86400,
+          "freeText": "client text"
+        }
+      }
+    },
+    {
+      "name": "tenant-id-not-uuid",
+      "why": "tenantId must be a UUID",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "alert",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "tenant-1",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "code": "index_stale",
+          "severity": "warning",
+          "value": 86400
+        }
+      }
+    }
+  ]
+}

package/test/contract/la-protocol-v2/vectors/approval.decision.vectors.json

@@ -0,0 +1,165 @@
+{
+  "type": "approval.decision",
+  "schema": "approval.decision.schema.json",
+  "vectors": [
+    {
+      "name": "minimal-valid",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "approval.decision",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "paramsRaw": "{\"approvalId\":\"d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80\",\"decision\":\"approved\",\"token\":\"vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl\"}",
+        "sig": {
+          "keyId": "vh-cp-2026-10",
+          "timestamp": "1793268000",
+          "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+          "workspaceId": "ws-1",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+        },
+        "payload": {
+          "approvalId": "d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80",
+          "decision": "approved",
+          "token": "vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl"
+        }
+      }
+    },
+    {
+      "name": "extra-top-level-field",
+      "why": "envelope is closed (additionalProperties:false)",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "approval.decision",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "paramsRaw": "{\"approvalId\":\"d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80\",\"decision\":\"approved\",\"token\":\"vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl\"}",
+        "sig": {
+          "keyId": "vh-cp-2026-10",
+          "timestamp": "1793268000",
+          "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+          "workspaceId": "ws-1",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+        },
+        "payload": {
+          "approvalId": "d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80",
+          "decision": "approved",
+          "token": "vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl"
+        },
+        "extra": "x"
+      }
+    },
+    {
+      "name": "extra-payload-field",
+      "why": "payload is closed: no free-form fields",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "approval.decision",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "paramsRaw": "{\"approvalId\":\"d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80\",\"decision\":\"approved\",\"token\":\"vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl\"}",
+        "sig": {
+          "keyId": "vh-cp-2026-10",
+          "timestamp": "1793268000",
+          "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+          "workspaceId": "ws-1",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+        },
+        "payload": {
+          "approvalId": "d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80",
+          "decision": "approved",
+          "token": "vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl",
+          "freeText": "client text"
+        }
+      }
+    },
+    {
+      "name": "tenant-id-not-uuid",
+      "why": "tenantId must be a UUID",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "approval.decision",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "tenant-1",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "paramsRaw": "{\"approvalId\":\"d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80\",\"decision\":\"approved\",\"token\":\"vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl\"}",
+        "sig": {
+          "keyId": "vh-cp-2026-10",
+          "timestamp": "1793268000",
+          "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+          "workspaceId": "ws-1",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+        },
+        "payload": {
+          "approvalId": "d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80",
+          "decision": "approved",
+          "token": "vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl"
+        }
+      }
+    },
+    {
+      "name": "token-not-vhapr1",
+      "why": "token must be a vhapr1 token",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "approval.decision",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-10-29T10:00:00Z",
+        "paramsRaw": "{\"approvalId\":\"d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80\",\"decision\":\"approved\",\"token\":\"vhapr1.k1.eyJ0eXAiOiJ2aC1odW1hbi1hcHByb3ZhbCJ9.c2lnbmF0dXJl\"}",
+        "sig": {
+          "keyId": "vh-cp-2026-10",
+          "timestamp": "1793268000",
+          "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+          "workspaceId": "ws-1",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+        },
+        "payload": {
+          "approvalId": "d4e5f6a7-b8c9-4d0e-9f1a-3b4c5d6e7f80",
+          "decision": "approved",
+          "token": "bearer abc"
+        }
+      }
+    }
+  ]
+}