ssh-mcp-pro 1.2.3 → 1.4.2

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqKxB;;GAEG;AACH,MAAM,CAAN,IAAY,SAaX;AAbD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,4BAAe,CAAA;IACf,kCAAqB,CAAA;IACrB,gCAAmB,CAAA;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,8BAAiB,CAAA;IACjB,gCAAmB,CAAA;IACnB,gCAAmB,CAAA;IACnB,kCAAqB,CAAA;IACrB,8BAAiB,CAAA;IACjB,0CAA6B,CAAA;AAC/B,CAAC,EAbW,SAAS,KAAT,SAAS,QAapB;AAED;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAE3B;IAEA;IACA;IACA;IACA;IANT,YACS,IAAe,EACtB,OAAe,EACR,IAAa,EACb,mBAA4B,EAC5B,cAAuB,IAAI,EAC3B,eAAwB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAPR,SAAI,GAAJ,IAAI,CAAW;QAEf,SAAI,GAAJ,IAAI,CAAS;QACb,wBAAmB,GAAnB,mBAAmB,CAAS;QAC5B,gBAAW,GAAX,WAAW,CAAgB;QAC3B,oBAAe,GAAf,eAAe,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC;IACJ,CAAC;CACF;AAED,mCAAmC;AACnC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACnE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;CACzE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACjG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACjG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAC3D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;CAC1E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACjG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;SACtE,OAAO,CAAC,SAAS,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqKxB;;GAEG;AACH,MAAM,CAAN,IAAY,SAaX;AAbD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,4BAAe,CAAA;IACf,kCAAqB,CAAA;IACrB,gCAAmB,CAAA;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,8BAAiB,CAAA;IACjB,gCAAmB,CAAA;IACnB,gCAAmB,CAAA;IACnB,kCAAqB,CAAA;IACrB,8BAAiB,CAAA;IACjB,0CAA6B,CAAA;AAC/B,CAAC,EAbW,SAAS,KAAT,SAAS,QAapB;AAED;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAE3B;IAEA;IACA;IACA;IACA;IANT,YACS,IAAe,EACtB,OAAe,EACR,IAAa,EACb,mBAA4B,EAC5B,cAAuB,IAAI,EAC3B,eAAwB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAPR,SAAI,GAAJ,IAAI,CAAW;QAEf,SAAI,GAAJ,IAAI,CAAS;QACb,wBAAmB,GAAnB,mBAAmB,CAAS;QAC5B,gBAAW,GAAX,WAAW,CAAgB;QAC3B,oBAAe,GAAf,eAAe,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC;IACJ,CAAC;CACF;AAED,mCAAmC;AACnC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;CACzE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACjG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACjG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAC3D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;CAC1E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACjG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;SACtE,OAAO,CAAC,SAAS,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC"}

package/docs/adding-a-device.md

@@ -28,32 +28,53 @@ token and a chosen capability profile.
 Start with the least privilege a device needs. You can raise the profile
 later (see [Changing a policy later](#changing-a-policy-later)).
 
-## Step 1 — Create an enrollment token (on the control plane side)
+## Step 1 — Create an enrollment token
 
-Tokens are one-time and short-lived. Pick the profile here.
+### Option A: From the web dashboard (recommended)
 
-### Option A: HTTP API
+On a deployed control plane with HTTPS and OAuth configured:
+
+1. Open its HTTPS URL and choose **Sign in with GitHub** or **Sign in with Google**.
+2. Select **Add Device**, enter the device alias, and choose a capability profile.
+   Start with `read-only` unless you need additional permissions.
+3. Choose **Generate Install Command**. The dashboard creates a short-lived,
+   one-time token and displays **Linux**, **Windows**, and **npm** commands.
+4. Copy the command for the target device and run it there. The Linux and
+   Windows installer commands install the agent, enroll it, and configure
+   startup; the npm command only enrolls and starts the process in that shell.
+
+Treat a generated command as a secret: it contains a one-time enrollment
+token. Do not share it in tickets, logs, chat messages, or screenshots. If
+the token expires, generate a new one in the dashboard.
+
+### Option B: From the HTTP API (automation)
+
+For an OAuth access token carrying the `agents:admin` scope:
 
 ```bash
 curl -sS -X POST "https://your-control-plane.example.com/api/agents/enrollment-tokens" \
   -H "Authorization: Bearer <admin-access-token>" \
   -H "Content-Type: application/json" \
-  -d '{"alias":"office-pc","requested_profile":"operations"}'
+  -d '{"alias":"office-pc","requested_profile":"read-only"}'
 ```
 
-The response includes a one-time `enrollment_token` and a ready-to-paste
-install command. The calling identity must have the `agents:admin` scope.
+The response includes `enrollment_token` and `commands.npm` / `commands.run`.
+The npm commands do not install a background service. To install and
+register a persistent service, use the platform installer in Step 2 with
+that one-time token.
 
-### Option B: From ChatGPT
+### Option C: From an authenticated MCP client
 
-If your connector has the `agents:admin` scope, ask it to call the
-`create_enrollment_token` tool with the alias and requested profile. It
-returns the same token and install command.
+If your authenticated connector has the `agents:admin` scope, call
+`create_enrollment_token` with an alias and requested profile. Use the
+returned token with the installer in Step 2 or the returned npm commands.
 
 ## Step 2 — Run the bootstrap on the new device
 
-The bootstrap installs the package, enrolls the machine, and registers a
-service so the agent reconnects on boot. It needs Node 22.22+ or 24+.
+The Linux/Windows bootstrap installs the package, enrolls the machine, and
+registers startup so the agent reconnects after restarts. It needs Node
+22.22+ or 24+. The dashboard-generated command is the shortest path; the
+manual commands below are alternatives if you already have a one-time token.
 
 ### Linux / WSL
 
@@ -88,9 +109,10 @@ On the device:
 ssh-mcp-pro-agent status
 ```
 
-It prints the agent id, alias, server, and active profile. On the control
-plane side the agent shows up as `online` in the fleet list, and the audit
-log records `enrollment_token_created` and `agent_connected`.
+It prints the agent id, alias, server, and active profile. This checks local
+enrollment, **not** live connectivity. In the dashboard, open **Enrolled
+Devices** and verify the device reports **Live Online**. The audit log
+should contain `enrollment_token_created` and `agent_connected`.
 
 ## Changing a policy later
 
@@ -123,5 +145,5 @@ restart is required.
   Windows) and that the device can reach the control plane URL over HTTPS.
 - **Enrollment fails with an expired token**: tokens are single-use and
   short-lived. Create a fresh one and retry.
-- **WebSocket error on start**: the runtime is too old. Install Node 22.22+
-  or 24+.
+- **WebSocket error on start**: confirm Node 22.22+ or 24+, DNS/TLS
+  connectivity to the configured server, and that the agent has not been revoked.

package/docs/agent-activity-monitor.md

@@ -0,0 +1,34 @@
+# Outbound Agent Activity Monitor
+
+The outbound agent streams timestamped events to its terminal and a **local, rotating diagnostic log**. This is useful when a Windows Scheduled Task displays a connection window, when a service restarts, or when an agent fails to authenticate. The agent does not need to expose a new HTTP API for this.
+
+## Live monitor
+
+Open a separate PowerShell 7 (Windows) or terminal (Linux/macOS) under the **same operating-system account** as the installed agent:
+
+```shell
+ssh-mcp-pro-agent logs --follow
+```
+
+To display the most recent events without remaining attached:
+
+```shell
+ssh-mcp-pro-agent logs --tail 80
+ssh-mcp-pro-agent status
+```
+
+During `ssh-mcp-pro-agent run`, the console also displays a compact connection panel and continuously appends activity. The **transport-open** event means the WebSocket opened, while **agent-ready** appears only after the control plane acknowledges the agent identity. Policy updates, request start/completion, rejected or expired requests, connection errors and disconnects have distinct INFO / OK / WARN / ERROR labels.
+
+## Log storage and privacy
+
+- Windows: `%USERPROFILE%\.sshautomator\logs\agent-activity.jsonl` for the Scheduled Task's user.
+- Linux/macOS: `~/.sshautomator/logs/agent-activity.jsonl` for the systemd or launchd user.
+- Log files rotate at 512 KiB with two older archives (`.1` and `.2`), preventing indefinite growth. On Unix, the log directory and files are created with restrictive permissions.
+- Records contain only timestamps, event types and safe diagnostic descriptions. **No command arguments, command output, SSH passwords, private keys, OAuth access tokens, enrollment tokens or raw server error messages** are recorded.
+- The viewer reads only this local file. There is no log upload, remote log streaming endpoint or new background service. To troubleshoot a connection, inspect its recent events and the agent supervisor's own logs as needed.
+
+## Windows Scheduled Task
+
+The Windows installer registers `ssh-mcp-pro-agent run` as a Scheduled Task for the current account. A Scheduled Task may not open a visible console window on every Windows configuration. Use **a second PowerShell window** with `ssh-mcp-pro-agent logs --follow` for reliable live visibility. If you do not see log files, verify which account owns the Scheduled Task and whether that account has launched a version of the agent that includes the activity monitor.
+
+Dashboard host, OS, architecture and policy version are sent by the agent and exposed by the server under the JSON fields `host_metadata` and `policy_version`. The web UI consumes those fields directly rather than expecting camelCase properties.

package/docs/coolify.md

@@ -0,0 +1,29 @@
+# Coolify deployment
+
+Deploy the repository with **Dockerfile** build pack and Dockerfile path `Dockerfile.coolify`.
+
+- Domain: `https://ssh-mcp-pro.oaslananka.dev`
+- Container port: `3000` (do not expose the port directly to the internet)
+- Persistent volume: mount a named volume at `/app/data` (SQLite database and signing keys)
+- One replica: SQLite is local and is not a shared multi-instance database
+- Start command: baked into `Dockerfile.coolify` (`node dist/render-http.js`)
+
+Configure secrets in Coolify (never commit them): `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`, `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` and the project's other required credentials. Set:
+
+```dotenv
+NODE_ENV=production
+PUBLIC_BASE_URL=https://ssh-mcp-pro.oaslananka.dev
+MCP_RESOURCE_URL=https://ssh-mcp-pro.oaslananka.dev/mcp
+SSH_MCP_REMOTE_AGENT_CONTROL_PLANE=true
+SSH_MCP_HTTP_HOST=0.0.0.0
+SSH_MCP_HTTP_PORT=3000
+DATABASE_URL=file:/app/data/sshautomator.db
+CONTROL_PLANE_SIGNING_KEY_PATH=/app/data/control-plane-ed25519.json
+JWT_SIGNING_KEY_PATH=/app/data/jwt-ed25519.json
+GOOGLE_CALLBACK_URL=https://ssh-mcp-pro.oaslananka.dev/oauth/callback/google
+GITHUB_CALLBACK_URL=https://ssh-mcp-pro.oaslananka.dev/oauth/callback/github
+```
+
+Dashboard login callback URLs additionally use `/auth/callback/google` and `/auth/callback/github`; register both with the relevant OAuth providers. Keep authentication allowlists configured as appropriate. Do not enable anonymous access as a workaround.
+
+Before deployment verify local OAuth login, dashboard and MCP flow. After deployment check health, login callbacks, device connectivity, and persistent state across a controlled restart. Do not run the SSH test fixture service in production.

package/docs/development/dependency-management.md

@@ -4,7 +4,7 @@
 
 - **[renovate.json](../../renovate.json)** manages the `npm` ecosystem (production and
   dev dependencies). Patch/minor devDependency updates automerge; the MCP SDK
-  (`@modelcontextprotocol/sdk`) is explicitly excluded from automerge given how central
+  (`@modelcontextprotocol/server`, `@modelcontextprotocol/core`, and related v2 packages) is explicitly excluded from automerge given how central
   it is; typescript-eslint packages are grouped.
 - **[.github/dependabot.yml](../../.github/dependabot.yml)** manages the
   `github-actions` ecosystem only, weekly, capped at 5 open PRs.

package/docs/development/local-setup.md

@@ -9,7 +9,7 @@ it adds the one-command shortcuts.
 ```bash
 git clone https://github.com/oaslananka/ssh-mcp-pro.git
 cd ssh-mcp-pro
-task install   # or: corepack enable && corepack prepare pnpm@11.5.1 --activate && pnpm install --frozen-lockfile
+task install   # or: corepack enable && corepack prepare pnpm@11.28.10 --activate && pnpm install --frozen-lockfile
 task verify    # lint + format:check + typecheck + test + build
 ```
 

package/docs/development/mcp-protocol-2026.md

@@ -0,0 +1,33 @@
+# MCP protocol compatibility (2026-07-28)
+
+This repository uses the official TypeScript v2 MCP SDK. The canonical SSH tool registry and policy checks are shared across the modern and legacy protocol eras; there is no second domain, gateway, or server deployment.
+
+## Supported paths
+
+- **stdio**: `serveStdio` negotiates the 2026-07-28 era and preserves the 2025 `initialize` handshake for legacy clients.
+- **Standard `/mcp` HTTP**: the SDK's `createMcpHandler` handles modern per-request traffic. The existing session registry and Node Streamable HTTP transport still handle legacy sessionful traffic, selected using the SDK's `isLegacyRequest` classifier.
+- **Legacy SSE**: the optional `/sse` and `/messages` endpoints use the official `server-legacy` compatibility transport. SSE remains disabled by default; do not remove it without a documented client compatibility decision.
+- **Remote-agent control plane**: when its MCP routing is enabled, the distinct authenticated endpoint now serves the 2026-07-28 protocol through the official `createMcpHandler` and preserves its earlier 2025 `initialize` contract for legacy clients. Every incoming request must pass JWT validation before either era is routed; the per-request modern handler is created only with that principal's capability-filtered tool descriptors. This endpoint never falls back to the standard SSH MCP tool registry or another user's agent inventory. Official SDK clients with `versionNegotiation: { mode: "auto" }` select modern, pinned 2026 clients succeed, and explicitly legacy clients continue to work. See `test/integration/remote-mcp-auth-boundary.integration.test.ts` for real HTTP acceptance.
+
+## Security and operation
+
+The existing HTTP router enforces authentication, origin policy, request-size limits, and public-boundary controls before dispatching either protocol era. The remote authorization server also includes the RFC 9207 issuer parameter on authorization-code redirects and advertises issuer-identification support in OAuth metadata. The modern SDK supplies header/body consistency validation, protocol discovery, default private/no-cache hints, and 2026 transport behavior. Do not use user-provided MCP metadata to authorize SSH host access; the existing authenticated identity and host policy remain authoritative.
+
+Tool output schemas, structured results and annotations are preserved. New Tasks, Skills, interactive elicitation, and custom cache TTLs are not enabled without a concrete use case; protocol support does not require them.
+
+## Acceptance
+
+- `pnpm run check:quality`
+- `pnpm run test:coverage`
+- `pnpm run check:package`
+- `pnpm exec vitest run --project integration test/integration/http-server-boundary.integration.test.ts`
+- `pnpm exec vitest run --project unit test/unit/mcp-v2-transport.test.ts`
+- `pnpm exec vitest run --project integration test/integration/remote-mcp-auth-boundary.integration.test.ts`
+
+The standard HTTP boundary tests exercise modern SDK client discovery/tool calls, malformed modern header rejection, existing legacy session lifecycle, bearer/OAuth rejection and opt-in SSE routing. The stdio-era tests exercise both modern and legacy clients against the same tool contract. The remote-agent acceptance test separately covers JWT-scoped modern discovery and calls, a pinned 2026 client, explicit legacy initialization, forged version headers, unauthenticated rejection and cross-tenant tool isolation.
+
+Official migration references:
+
+- https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2
+- https://ts.sdk.modelcontextprotocol.io/v2/migration/support-2026-07-28
+- https://modelcontextprotocol.io/specification/2026-07-28

package/docs/docker.md

@@ -3,15 +3,15 @@
 Published release images are available from GitHub Container Registry:
 
 ```bash
-docker pull ghcr.io/oaslananka/ssh-mcp-pro:1.0.0
-docker run --rm ghcr.io/oaslananka/ssh-mcp-pro:1.0.0 --version
+docker pull ghcr.io/oaslananka/ssh-mcp-pro:1.4.1
+docker run --rm ghcr.io/oaslananka/ssh-mcp-pro:1.4.1 --version
 ```
 
 Each release publishes a multi-platform OCI image for `linux/amd64` and
 `linux/arm64`. The release workflow publishes two exact tags:
 
-- `ghcr.io/oaslananka/ssh-mcp-pro:<semver>` such as `1.0.0`
-- `ghcr.io/oaslananka/ssh-mcp-pro:<git-tag>` such as `v1.0.0`
+- `ghcr.io/oaslananka/ssh-mcp-pro:<semver>` such as `1.4.1`
+- `ghcr.io/oaslananka/ssh-mcp-pro:<git-tag>` such as `ssh-mcp-pro-v1.4.1`
 
 The project does not publish a mutable `latest` tag. Prefer digest-pinned
 references in production so container deployments match the npm package,

package/docs/doppler-guide.md

@@ -0,0 +1,34 @@
+# Doppler secrets for hosted SSH MCP Pro
+
+Hosted deployments use **Coolify's native Doppler secret-manager integration**. The app must not require a Doppler CLI process, an extra credential in the container, or a GitHub Actions `DOPPLER_TOKEN` merely to start.
+
+## Configure once
+
+1. In Coolify, open **Keys & Tokens → Integration Tokens** and configure a Doppler token with access only to the intended project/config. Prefer a service token scoped to one environment.
+2. Open the SSH MCP Pro application and select **Environment Variables → Secret manager**. Attach the existing Doppler integration token. If the token does not already fix a project and config, enter the correct project and config.
+3. Add the following runtime environment variable **references** in Coolify. The values are placeholders resolved by Coolify at deployment; the provider secrets themselves must not be copied into GitHub or the image.
+
+   ```dotenv
+   GITHUB_CLIENT_ID={{vault.GITHUB_CLIENT_ID}}
+   GITHUB_CLIENT_SECRET={{vault.GITHUB_CLIENT_SECRET}}
+   GOOGLE_CLIENT_ID={{vault.GOOGLE_CLIENT_ID}}
+   GOOGLE_CLIENT_SECRET={{vault.GOOGLE_CLIENT_SECRET}}
+   ```
+
+4. Keep non-secret settings such as `PUBLIC_BASE_URL`, `MCP_RESOURCE_URL`, callback URLs and port configuration as normal Coolify environment variables. For the SQLite single-instance deployment, use `DATABASE_URL=file:/app/data/sshautomator.db` and persist **/app/data** for the database and both signing-key files.
+5. Keep `AUTH_ALLOW_ALL_USERS=false` until real multi-user isolation and OAuth acceptance tests pass. Configure account allowlists intentionally, without embedding personal accounts in public documentation.
+
+Coolify resolves `{{vault.KEY}}` references at startup or deployment and does not store the resolved provider values in its application configuration. A missing provider key should block deployment instead of falling back to an anonymous or insecure mode.
+
+## Operations
+
+- Rotate or update values in Doppler, then restart the application for runtime-only secrets or redeploy when build-time values changed.
+- Verify both GitHub and Google callback routes, OAuth issuer/audience/nonce validation, authorization decisions and device enrollment before public launch.
+- Protect the persistent SQLite data and signing keys with an independently recoverable backup. Keep only the production replica and a verified rollback image.
+- Never expose a Doppler service token, Google/GitHub client secret, access token, callback code, or full environment dump in logs or issue reports.
+
+## Local development
+
+Local work can use the existing `doppler run -- pnpm run start:http` workflow, or a local non-committed `.env` file. The local bootstrap script is optional and does not modify the Coolify integration.
+
+See [Coolify deployment](coolify.md) for build and data paths and [Coolify's secret-manager documentation](https://coolify.io/docs/integrations/security/using-secret-managers) for the current integration UI.

package/docs/openssf-evidence.md

@@ -1,7 +1,7 @@
 # OpenSSF Best Practices — Evidence
 
 Self-assessment against the [OpenSSF Best Practices Passing criteria](https://www.bestpractices.dev/en/criteria/0),
-current as of 2026-07-03. This is a repo-side evidence log, not an official OpenSSF
+originally assessed 2026-07-03; published release notes independently rechecked 2026-11-10. This is a repo-side evidence log, not an official OpenSSF
 artifact — the actual badge is issued by submitting these answers at
 [bestpractices.dev](https://www.bestpractices.dev/). See `.bestpractices.json` for the
 same answers in a structured tracking form used to prepare that submission.
@@ -19,7 +19,7 @@ vocabulary.
 | License is OSI-approved | Met | MIT |
 | Documentation: basic description of purpose | Met | README.md intro |
 | Documentation: how to obtain/provide feedback and contribute | Met | CONTRIBUTING.md, SUPPORT.md |
-| Interim versions/releases are identifiable | Met | Conventional Commits + release-please tagging (pending first tag — see gap analysis) |
+| Interim versions/releases are identifiable | Met | Conventional Commits + release-please tagging (GitHub releases v1.4.0 and v1.4.1 verified 2026-11-10) |
 
 ## Change control
 
@@ -68,8 +68,12 @@ vocabulary.
 
 ## Bottom line
 
-As of 2026-07-03, the CodeQL blocker has been resolved. The remaining blocker is
-"cut a first release," already tracked in [ROADMAP.md](../ROADMAP.md), plus triaging
-the new Trivy container-image findings noted above. Nothing in this evidence log claims
-Silver or Gold; see [docs/openssf-gap-analysis.md](openssf-gap-analysis.md) for why
-those are out of reach right now.
+As of 2026-11-10 the historical first-release blocker is resolved:
+GitHub Releases v1.4.0 and v1.4.1 are published with notes. npm
+`latest` remains v1.4.0 due to the intentionally separate manual registry
+publication. Do not equate release notes with an npm publication or hosted deployment.
+
+Historical 2026-07-03 image-scanning findings below are not a current scan.
+Do not claim a current container CVE count without a new scan.
+This internal self-assessment is still not submitted to Best Practices;
+no Passing, Silver or Gold badge is claimed.

package/docs/openssf-gap-analysis.md

@@ -11,10 +11,10 @@ See [docs/openssf-evidence.md](openssf-evidence.md) for the full criterion table
 ~~Seven open CodeQL alerts (one High) with no fully-current documented disposition.~~
 **Resolved 2026-07-03** — see `SECURITY_DECISIONS.md`.
 
-The remaining concrete blocker: no release has been cut yet, so "release notes exist
-for each release" is unverified in practice even though the mechanism (release-please +
-CHANGELOG) is implemented. Tracked in [ROADMAP.md](../ROADMAP.md) and as a recommended
-issue in [docs/repo-maturity-report.md](repo-maturity-report.md).
+**2026-11-10 update:** The first-release blocker is resolved: GitHub Releases
+v1.4.0 and v1.4.1 contain release notes. npm `latest` remains
+v1.4.0 under a separate manual publishing workflow. This does not imply
+an official Best Practices submission or a completed hosted deployment.
 
 A new, unrelated item surfaced the same day: Trivy container-image scanning (added
 after this document was first written) found 50+ open findings against the built
@@ -57,7 +57,6 @@ preconditions are absent — and they are absent here:
 | High test coverage sustained over time | Coverage thresholds exist (85–90%) but "sustained over time" needs release/version history that doesn't exist yet (repo is 5 days old) |
 | Repeatable/reproducible release process | Implemented (SBOM, checksums, provenance) but never executed — zero releases published |
 
-**This is a gap list, not a target with a date.** None of these should be worked toward
-by editing files; they require either time (release/contribution history accruing
-naturally) or a maintainer decision (branch protection, recruiting a co-maintainer).
-Revisit this analysis after the "Silver" preconditions above are met.
+**This is a dated internal self-assessment, not an official badge.**
+Do not require a second human maintainer solely for a score. Re-evaluate
+criteria using current evidence before making an external submission.

package/docs/reference/cli.md

@@ -33,9 +33,20 @@ with extra arguments don't break the server.
 
 ## `ssh-mcp-pro-agent`
 
-Delegates directly to `src/remote/agent-cli.ts` via `argv` passthrough. See
-[docs/remote-mcp-hardening.md](../remote-mcp-hardening.md) and
-[docs/adding-a-device.md](../adding-a-device.md) for the documented agent workflows —
-this reference intentionally doesn't restate flags that aren't yet enumerated in one
-place in the source, to avoid documenting something that could drift silently from the
-implementation.
+Source of truth: [src/remote/agent-cli.ts](../../src/remote/agent-cli.ts).
+
+| Command | Effect |
+| --- | --- |
+| (no args), `help`, `--help`, `-h` | Print usage and exit successfully |
+| `--version`, `-v` | Print the installed package version and exit |
+| `enroll --server <url> --token <token> [--alias <alias>]` | Exchange a one-time enrollment token and save agent credentials |
+| `run` | Connect the enrolled outbound agent to its control plane |
+| `status` | Show local enrollment and current policy, not live connectivity |
+| `logs [--tail 60] [--follow]` | Read agent activity logs; `--follow` streams updates |
+| `install-service` | Print platform service setup guidance; does not install anything |
+| `uninstall-service` | Print platform service removal guidance; does not remove anything |
+
+Unknown commands fail with a nonzero exit code. For a persistent service, use the
+[platform bootstrap installer](../adding-a-device.md#step-2--run-the-bootstrap-on-the-new-device).
+The `install-service` and `uninstall-service` commands are advisory, not installers.
+Treat enrollment tokens as secrets and never paste them into issues or logs.

package/docs/reference/compatibility.md

@@ -13,7 +13,7 @@ LTS line). This is expected, not an oversight.
 
 ## Package manager
 
-pnpm `11.28.5`, enforced via `packageManager` in `package.json` and `engine-strict=true`.
+pnpm `11.28.10`, enforced via `packageManager` in `package.json` and `engine-strict=true`.
 npm/yarn are not supported installation paths for *developing* this repo (consumers
 installing the published package via npm/npx are unaffected — see
 [README.md#installation](../../README.md#installation)).

package/docs/security/dependency-audit-exceptions.md

@@ -4,12 +4,8 @@ Dependency audit exceptions are a last resort. They must be scoped to a specific
 
 The canonical workspace, Docker image, and release lockfile must remain free of known moderate-or-higher advisories. `pnpm run audit:packed` separately installs the generated npm tarball as an external consumer and rejects every advisory that is not listed in the exception file. It also rejects expired or stale exceptions.
 
-## Active exception
+## Active exceptions
 
-| Advisory | Package path | Scope | Reachability assessment | Owner | Expires |
-| --- | --- | --- | --- | --- | --- |
-| `GHSA-frvp-7c67-39w9` | `ssh-mcp-pro > @modelcontextprotocol/sdk > @hono/node-server` | Published npm consumer graph | The affected `serve-static` implementation is not imported or invoked by ssh-mcp-pro. HTTP entrypoints use the project's own Node HTTP implementation. | `@oaslananka` | 2026-08-23 |
+**None as of 2026-11-02.** The v2 MCP SDK package migration replaces the legacy v1 SDK graph. The published-consumer audit reports zero accepted time-bounded exceptions; the machine-readable list is empty.
 
-The latest `@modelcontextprotocol/sdk` release still constrains `@hono/node-server` to the vulnerable 1.x major. Local, CI, and container installs use the patched 2.x major through the root workspace override. npm consumers do not inherit dependency-package overrides, so the exception remains visible only for the independently installed tarball.
-
-Remove the exception immediately when the MCP SDK accepts `@hono/node-server >=2.0.5`, or before introducing any use of the Hono Node adapter or `serve-static`.
+The historical `GHSA-frvp-7c67-39w9` exception for the old v1 SDK's transitive `@hono/node-server` chain is no longer active. The v2 Node adapter resolves the patched `@hono/node-server` 2.x dependency. Future exceptions require an explicit evidence-based review and a machine-readable expiry, not an informal ignore rule.

package/docs/security/hosted-data-inventory.md

@@ -0,0 +1,81 @@
+# Hosted remote-agent data inventory
+
+**Engineering evidence only — not a privacy notice or terms of service.**
+This document describes the repository's remote control-plane source
+on 2026-11-04, **not necessarily the version deployed in production**.
+It does not claim legal compliance or promise any retention period.
+
+## Data handled in the remote control plane
+
+| Category | Recorded data | Implementation evidence |
+| --- | --- | --- |
+| Account identity | GitHub ID/login/name or Google ID/email/name when configured | SQLite `users` in [remote store](../../src/remote/store.ts) |
+| Dashboard sessions | Random browser session token, a stored token hash, user ID and expiry | `dashboard_sessions` in [remote store](../../src/remote/store.ts) and [dashboard](../../src/remote/web-dashboard.ts) |
+| OAuth clients/codes | Client identity, redirect URIs, scopes and hashed authorization codes with expiry and use status | `oauth_clients` and `oauth_authorization_codes` in [remote store](../../src/remote/store.ts) |
+| Devices | Alias, public key, policy, status, host metadata and last seen | `agents` in [remote store](../../src/remote/store.ts) |
+| Enrollment | Hashed one-time tokens with expiration and use status | `agent_enrollment_tokens` in [remote store](../../src/remote/store.ts) |
+| Remote actions | Tool and capability, **arguments**, status, deadline, **result**, and error details | `actions` in [remote store](../../src/remote/store.ts) |
+| Security events | Event type/severity/time, optional user/device/action IDs and metadata | `audit_events` in [remote store](../../src/remote/store.ts) |
+| Local agent credentials | Agent private key, server URL, device ID and execution policy | Local file described in [agent CLI](../../src/remote/agent-cli.ts) |
+
+Remote actions can return stdout, stderr, file output and host logs.
+The [executor](../../src/remote/agent-executor.ts) bounds output sizes,
+but bounded size is **not** automatic secret redaction. Arguments and
+results can contain sensitive host information and are persisted as JSON
+in the action table.
+
+## Expiration and erasure: observed behavior
+
+- Dashboard cookies and session records are valid for 24 hours. Logout
+  deletes the current session, while periodic maintenance also deletes
+  session rows whose expiration time has passed.
+- OAuth authorization codes and device enrollment tokens expire logically
+  and can be used only once. The existing minute maintenance tick also
+  removes physically expired code/token rows. Non-expired rows are retained
+  even if already used.
+- The periodic cleanup also clears in-memory OAuth and connection state.
+  It does **not** impose automatic retention/deletion on users, OAuth
+  clients, devices, action history, audit events or infrastructure logs.
+- Dashboard **Remove device** revokes/disconnects that device, then deletes
+  the device row, associated enrollment token records and its action rows.
+  **Audit events remain** for security review. **Revoke** by itself
+  changes device status and is not the same as Remove device.
+- No account-level export/erasure workflow, audit-erasure workflow, or
+  global retention/deletion job for users, clients, actions and audit
+  events was found in the inspected remote routes and store.
+
+Source: [dashboard](../../src/remote/web-dashboard.ts),
+[store](../../src/remote/store.ts),
+[OAuth handler](../../src/remote/oauth-handler.ts),
+[control plane](../../src/remote/control-plane.ts).
+
+## Deployment and third-party boundaries
+
+The documented [Coolify deployment](../coolify.md) uses one SQLite
+replica and a persistent `/app/data` volume for the database and
+signing keys. Redeploying the application does not itself remove the
+volume. OAuth login involves GitHub or Google depending on configuration.
+Infrastructure access logs, provider-side logs, external processing,
+hosting jurisdiction and infrastructure-level backups **cannot be
+inferred from the repository's database schema**.
+
+## Verify before drafting a user-facing privacy notice and terms
+
+1. Confirm operator identity, responsible contact and intended account scope.
+2. Verify actual hosting region, infrastructure/OAuth processors, logs and
+   their configured retention; do not purchase new services to do so.
+3. Decide accurate retention and deletion behavior for identities, sessions,
+   authorization records, command args/results and audit events. Explain
+   the surviving audit trail after Remove device.
+4. Define an actionable access/correction/deletion request process before
+   promising rights, methods or timelines.
+5. Verify agent/SSH-host data transfer, user responsibilities and any
+   external storage or telemetry not visible in these source files.
+6. Publish **separate**, reviewed HTTPS privacy and terms documents.
+   `SECURITY.md` concerns vulnerability reports; the MIT `LICENSE`
+   concerns source licensing. Neither is a substitute.
+
+ChatGPT, Claude and Gemini application metadata must remain
+`publishReady: false` until these and the other launch conditions
+are genuinely complete. This inventory is engineering
+evidence, **not** a published privacy policy.

package/docs/sonarcloud-analysis.md

@@ -0,0 +1,9 @@
+# SonarQube Cloud analysis
+
+This repository uses **SonarQube Cloud Automatic Analysis** for GitHub pull requests and the default branch. SonarScanner must not run in GitHub Actions while automatic analysis is enabled; the two methods conflict.
+
+The GitHub CI workflow runs Node 24 and 26 test/coverage gates and uploads LCOV coverage artifacts. Vitest enforces local coverage thresholds independently of SonarQube Cloud. SonarQube Cloud automatic analysis **cannot import LCOV coverage**: its quality gate must not be interpreted as measuring this repository's test coverage. The project coverage minimum remains enforced in CI.
+
+Do not add `SONAR_TOKEN`, another Doppler credential-fetch step, or `sonarqube-scan-action` to this workflow for automatic analysis. To migrate back to CI analysis, first explicitly switch off Automatic Analysis in SonarQube Cloud, then implement a single authenticated scanner pipeline and restore LCOV import.
+
+Security and maintainability findings, especially new-code duplication, remain enforced by SonarQube Cloud's independent GitHub PR check. Do not weaken duplication thresholds or bypass repository rules to make CI green.

package/docs/tutorials/getting-started.md

@@ -10,7 +10,7 @@ and [Reference](../reference/README.md) for the full option set.
 
 You need:
 
-- Node.js `>=22.22.2` (or `>=24.15.0` / `>=26.3.0`) and pnpm `>=11.0.9`.
+- Node.js `>=22.22.2` (or `>=24.15.0` / `>=26.3.0`) and pnpm `^11.28.10`.
 - At least one host you can already reach with plain `ssh`, with its key already in
   your `~/.ssh/known_hosts` (this tutorial uses the default `strict` host-key policy —
   see [SECURITY_DECISIONS.md](../../SECURITY_DECISIONS.md) for why).

package/mcp.json

@@ -2,7 +2,7 @@
   "name": "ssh-mcp-pro",
   "display_name": "ssh-mcp-pro",
   "description": "Secure MCP SSH automation server with policy controls, resources, prompts, stdio, and HTTP.",
-  "version": "1.2.3",
+  "version": "1.4.2",
   "author": "Osman Aslan",
   "license": "MIT",
   "runtime": "node",