@intentic/sandbox-contract 1.337.0 → 1.338.0

package/dist/policy/keyring-seal.d.ts

@@ -0,0 +1,48 @@
+import { type KeyringGrant, type SealedBox, type SignedKeyringGrant } from "../schemas/keyring.js";
+export interface KeyringKeyPair {
+    readonly publicKey: string;
+    readonly privateKey: string;
+}
+export declare const newSealKeyPair: () => KeyringKeyPair;
+export declare const newSignKeyPair: () => KeyringKeyPair;
+export type SealPurpose = {
+    readonly kind: "release";
+    readonly sandbox: string;
+    readonly secret: string;
+    readonly nonce: string;
+} | {
+    readonly kind: "type";
+    readonly sandbox: string;
+    readonly secret: string;
+    readonly nonce: string;
+} | {
+    readonly kind: "inbox";
+    readonly sandbox: string;
+    readonly secret: string;
+} | {
+    readonly kind: "copy";
+    readonly sandbox: string;
+    readonly secret: string;
+    readonly updatedAt: number;
+} | {
+    readonly kind: "sync";
+    readonly account: string;
+    readonly device: string;
+    readonly revision: number;
+};
+export declare const sealAad: (purpose: SealPurpose) => Buffer;
+export declare const seal: (recipient: string, plaintext: string, purpose: SealPurpose) => SealedBox;
+export declare const unseal: (pair: KeyringKeyPair, box: SealedBox, purpose: SealPurpose) => string;
+export declare const grantNonce: () => string;
+export declare const signGrant: (pair: KeyringKeyPair, grant: KeyringGrant) => SignedKeyringGrant;
+export type GrantVerdict = {
+    readonly ok: true;
+    readonly grant: KeyringGrant;
+} | {
+    readonly ok: false;
+    readonly code: "bad-grant" | "expired";
+    readonly reason: string;
+};
+export declare const verifyGrant: (signKey: string, signed: SignedKeyringGrant, nowMs: number) => GrantVerdict;
+export declare const keyFingerprint: (key: string) => string;
+//# sourceMappingURL=keyring-seal.d.ts.map

package/dist/policy/keyring-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring-seal.d.ts","sourceRoot":"","sources":["../../src/policy/keyring-seal.ts"],"names":[],"mappings":"AAEA,OAAO,EAIH,KAAK,YAAY,EACjB,KAAK,SAAS,EAEd,KAAK,kBAAkB,EAC1B,MAAM,uBAAuB,CAAC;AAa/B,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC/B;AAaD,eAAO,MAAM,cAAc,QAAO,cAAkC,CAAC;AACrE,eAAO,MAAM,cAAc,QAAO,cAAmC,CAAC;AAQtE,MAAM,MAAM,WAAW,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G,eAAO,MAAM,OAAO,YAAa,WAAW,KAAG,MAY9C,CAAC;AAMF,eAAO,MAAM,IAAI,cAAe,MAAM,aAAa,MAAM,WAAW,WAAW,KAAG,SAQjF,CAAC;AAGF,eAAO,MAAM,MAAM,SAAU,cAAc,OAAO,SAAS,WAAW,WAAW,KAAG,MAOnF,CAAC;AAGF,eAAO,MAAM,UAAU,QAAO,MAA+C,CAAC;AAE9E,eAAO,MAAM,SAAS,SAAU,cAAc,SAAS,YAAY,KAAG,kBAQrE,CAAC;AAEF,MAAM,MAAM,YAAY,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAI9F,eAAO,MAAM,WAAW,YAAa,MAAM,UAAU,kBAAkB,SAAS,MAAM,KAAG,YA4BxF,CAAC;AAGF,eAAO,MAAM,cAAc,QAAS,MAAM,KAAG,MAI5C,CAAC"}

package/dist/policy/keyring-seal.js

@@ -0,0 +1,94 @@
+import { createCipheriv, createDecipheriv, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, sign, verify } from "node:crypto";
+import { z } from "zod";
+import { KEYRING_GRANT_TTL_MAX_MS, KEYRING_KEY_RE, KeyringGrantSchema, SealedBoxSchema, } from "../schemas/keyring.js";
+const SEAL_INFO = Buffer.from("intentic-keyring/seal/v1", "utf8");
+const GRANT_DOMAIN = Buffer.from("intentic-keyring/grant/v1\0", "utf8");
+const GRANT_SKEW_MS = 30_000;
+const OkpJwkSchema = z.object({ x: z.string().regex(KEYRING_KEY_RE), d: z.string().regex(KEYRING_KEY_RE) });
+const pairOf = (curve) => {
+    const { privateKey } = curve === "X25519" ? generateKeyPairSync("x25519") : generateKeyPairSync("ed25519");
+    const jwk = OkpJwkSchema.parse(privateKey.export({ format: "jwk" }));
+    return { publicKey: jwk.x, privateKey: jwk.d };
+};
+export const newSealKeyPair = () => pairOf("X25519");
+export const newSignKeyPair = () => pairOf("Ed25519");
+const publicKeyOf = (curve, x) => createPublicKey({ key: { kty: "OKP", crv: curve, x }, format: "jwk" });
+const privateKeyOf = (curve, pair) => createPrivateKey({ key: { kty: "OKP", crv: curve, x: pair.publicKey, d: pair.privateKey }, format: "jwk" });
+export const sealAad = (purpose) => {
+    switch (purpose.kind) {
+        case "release":
+        case "type":
+            return Buffer.from(`${purpose.kind}\0${purpose.sandbox}\0${purpose.secret}\0${purpose.nonce}`, "utf8");
+        case "inbox":
+            return Buffer.from(`inbox\0${purpose.sandbox}\0${purpose.secret}`, "utf8");
+        case "copy":
+            return Buffer.from(`copy\0${purpose.sandbox}\0${purpose.secret}\0${String(purpose.updatedAt)}`, "utf8");
+        case "sync":
+            return Buffer.from(`sync\0${purpose.account}\0${purpose.device}\0${String(purpose.revision)}`, "utf8");
+    }
+};
+const boxKey = (shared, epk, recipient) => Buffer.from(hkdfSync("sha256", shared, Buffer.concat([Buffer.from(epk, "base64url"), Buffer.from(recipient, "base64url")]), SEAL_INFO, 32));
+export const seal = (recipient, plaintext, purpose) => {
+    const ephemeral = newSealKeyPair();
+    const shared = diffieHellman({ privateKey: privateKeyOf("X25519", ephemeral), publicKey: publicKeyOf("X25519", recipient) });
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", boxKey(shared, ephemeral.publicKey, recipient), iv);
+    cipher.setAAD(sealAad(purpose));
+    const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return { v: 1, epk: ephemeral.publicKey, iv: iv.toString("base64url"), tag: cipher.getAuthTag().toString("base64url"), data: data.toString("base64url") };
+};
+export const unseal = (pair, box, purpose) => {
+    const parsed = SealedBoxSchema.parse(box);
+    const shared = diffieHellman({ privateKey: privateKeyOf("X25519", pair), publicKey: publicKeyOf("X25519", parsed.epk) });
+    const decipher = createDecipheriv("aes-256-gcm", boxKey(shared, parsed.epk, pair.publicKey), Buffer.from(parsed.iv, "base64url"));
+    decipher.setAAD(sealAad(purpose));
+    decipher.setAuthTag(Buffer.from(parsed.tag, "base64url"));
+    return Buffer.concat([decipher.update(Buffer.from(parsed.data, "base64url")), decipher.final()]).toString("utf8");
+};
+export const grantNonce = () => randomBytes(16).toString("base64url");
+export const signGrant = (pair, grant) => {
+    const body = KeyringGrantSchema.parse(grant);
+    if (body.expiresAt - body.issuedAt > KEYRING_GRANT_TTL_MAX_MS || body.expiresAt <= body.issuedAt) {
+        throw new Error(`a keyring grant lives at most ${String(KEYRING_GRANT_TTL_MAX_MS / 1000)} s`);
+    }
+    const payload = Buffer.from(JSON.stringify(body), "utf8");
+    const sig = sign(null, Buffer.concat([GRANT_DOMAIN, payload]), privateKeyOf("Ed25519", pair));
+    return { payload: payload.toString("base64url"), sig: sig.toString("base64url") };
+};
+export const verifyGrant = (signKey, signed, nowMs) => {
+    let payload;
+    try {
+        payload = Buffer.from(signed.payload, "base64url");
+        if (!verify(null, Buffer.concat([GRANT_DOMAIN, payload]), publicKeyOf("Ed25519", signKey), Buffer.from(signed.sig, "base64url"))) {
+            return { ok: false, code: "bad-grant", reason: "the grant's signature is not the sandbox's" };
+        }
+    }
+    catch {
+        return { ok: false, code: "bad-grant", reason: "the grant could not be read" };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(payload.toString("utf8"));
+    }
+    catch {
+        return { ok: false, code: "bad-grant", reason: "the grant is not JSON" };
+    }
+    const grant = KeyringGrantSchema.safeParse(parsed);
+    if (!grant.success) {
+        return { ok: false, code: "bad-grant", reason: "the grant is not one this keyring knows how to read" };
+    }
+    const { issuedAt, expiresAt } = grant.data;
+    if (expiresAt - issuedAt > KEYRING_GRANT_TTL_MAX_MS || expiresAt <= issuedAt || issuedAt > nowMs + GRANT_SKEW_MS) {
+        return { ok: false, code: "bad-grant", reason: "the grant's times are not ones this sandbox would sign" };
+    }
+    if (expiresAt <= nowMs) {
+        return { ok: false, code: "expired", reason: "the grant has expired: the sandbox asks again" };
+    }
+    return { ok: true, grant: grant.data };
+};
+export const keyFingerprint = (key) => {
+    const raw = Buffer.from(key, "base64url");
+    const hex = raw.subarray(0, 8).toString("hex").toUpperCase();
+    return hex.replace(/(.{4})(?=.)/gu, "$1-");
+};
+//# sourceMappingURL=keyring-seal.js.map

package/dist/policy/keyring-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring-seal.js","sourceRoot":"","sources":["../../src/policy/keyring-seal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAC3L,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACH,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EAGlB,eAAe,GAElB,MAAM,uBAAuB,CAAC;AAO/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;AAClE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;AAExE,MAAM,aAAa,GAAG,MAAM,CAAC;AAW7B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAE5G,MAAM,MAAM,GAAG,CAAC,KAAY,EAAkB,EAAE;IAC5C,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAmB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAmB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAEtE,MAAM,WAAW,GAAG,CAAC,KAAY,EAAE,CAAS,EAAa,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACnI,MAAM,YAAY,GAAG,CAAC,KAAY,EAAE,IAAoB,EAAa,EAAE,CACnE,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAWhH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAoB,EAAU,EAAE;IACpD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS,CAAC;QACf,KAAK,MAAM;YACP,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3G,KAAK,OAAO;YACR,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/E,KAAK,MAAM;YACP,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5G,KAAK,MAAM;YACP,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/G,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,SAAiB,EAAU,EAAE,CACtE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AAGhJ,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAE,OAAoB,EAAa,EAAE;IAC1F,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7H,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9J,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAoB,EAAE,GAAc,EAAE,OAAoB,EAAU,EAAE;IACzF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAClI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtH,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAoB,EAAE,KAAmB,EAAsB,EAAE;IACvF,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,GAAG,wBAAwB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACtF,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,MAA0B,EAAE,KAAa,EAAgB,EAAE;IACpG,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YAC/H,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QAClG,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IAC3G,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3C,IAAI,SAAS,GAAG,QAAQ,GAAG,wBAAwB,IAAI,SAAS,IAAI,QAAQ,IAAI,QAAQ,GAAG,KAAK,GAAG,aAAa,EAAE,CAAC;QAC/G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC"}

package/dist/policy/message-limits.d.ts

@@ -1,11 +1,13 @@
 export declare const MESSAGE_LIMITS: {
     readonly bluesky: 300;
     readonly discord: 2000;
+    readonly facebook: 63206;
     readonly instagram: 2200;
     readonly linkedin: 3000;
     readonly mastodon: 500;
     readonly slack: 4000;
     readonly telegram: 4096;
+    readonly tiktok: 4000;
     readonly whatsapp: 65536;
     readonly x: 280;
     readonly youtube: 5000;

package/dist/policy/message-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message-limits.d.ts","sourceRoot":"","sources":["../../src/policy/message-limits.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,cAAc;sBACd,GAAG;sBACH,IAAK;wBACH,IAAK;uBACN,IAAK;uBACL,GAAG;oBAEN,IAAK;uBAEF,IAAK;uBAEL,KAAM;gBACb,GAAG;sBACG,IAAK;CACmC,CAAC;AAMtD,eAAO,MAAM,cAAc,aAAc,MAAM,KAAG,MAAM,GAAG,SAA+C,CAAC"}
+{"version":3,"file":"message-limits.d.ts","sourceRoot":"","sources":["../../src/policy/message-limits.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,cAAc;sBACd,GAAG;sBACH,IAAK;uBACJ,KAAM;wBACL,IAAK;uBACN,IAAK;uBACL,GAAG;oBAEN,IAAK;uBAEF,IAAK;qBAEP,IAAK;uBAEH,KAAM;gBACb,GAAG;sBACG,IAAK;CACmC,CAAC;AAMtD,eAAO,MAAM,cAAc,aAAc,MAAM,KAAG,MAAM,GAAG,SAA+C,CAAC"}

package/dist/policy/message-limits.js

@@ -1,11 +1,13 @@
 export const MESSAGE_LIMITS = {
     bluesky: 300,
     discord: 2_000,
+    facebook: 63_206,
     instagram: 2_200,
     linkedin: 3_000,
     mastodon: 500,
     slack: 4_000,
     telegram: 4_096,
+    tiktok: 4_000,
     whatsapp: 65_536,
     x: 280,
     youtube: 5_000,

package/dist/policy/message-limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"message-limits.js","sourceRoot":"","sources":["../../src/policy/message-limits.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC1B,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,GAAG;IAEb,KAAK,EAAE,KAAK;IAEZ,QAAQ,EAAE,KAAK;IAEf,QAAQ,EAAE,MAAM;IAChB,CAAC,EAAE,GAAG;IACN,OAAO,EAAE,KAAK;CACmC,CAAC;AAItD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAsB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC"}
+{"version":3,"file":"message-limits.js","sourceRoot":"","sources":["../../src/policy/message-limits.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC1B,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,KAAK;IAChB,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,GAAG;IAEb,KAAK,EAAE,KAAK;IAEZ,QAAQ,EAAE,KAAK;IAEf,MAAM,EAAE,KAAK;IAEb,QAAQ,EAAE,MAAM;IAChB,CAAC,EAAE,GAAG;IACN,OAAO,EAAE,KAAK;CACmC,CAAC;AAItD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAsB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC"}

package/dist/policy/org-locks.d.ts

@@ -0,0 +1,58 @@
+import { type OrgPolicy, type OrgSection } from "../schemas/organisation.js";
+export declare const ORG_SECTION_ROUTES: {
+    readonly models: {
+        readonly changes: readonly ["accounts.start", "accounts.complete", "accounts.rename", "accounts.disconnect"];
+    };
+    readonly agent: {
+        readonly changes: readonly ["settings.set", "settings.setAgentDomain", "privacy.setPolicy", "privacy.forget", "safety.setPolicy", "skills.save", "skills.remove"];
+        readonly reveals: readonly ["privacy.reveal"];
+    };
+    readonly environment: {
+        readonly changes: readonly ["POST /environment/approve", "POST /environment/runtime-install", "POST /environment/remove", "POST /engines/channel", "POST /engines/update", "POST /engines/revert"];
+    };
+    readonly secrets: {
+        readonly changes: readonly ["secrets.set", "secrets.generate", "secrets.remove", "secrets.setGate", "secrets.removeGate", "secrets.setHosts", "secrets.setPolicy", "capabilities.add", "capabilities.remove", "capabilities.rename", "capabilities.setSecret", "capabilities.sshKey", "capabilities.login"];
+        readonly reveals: readonly ["secrets.reveal"];
+    };
+    readonly "data-protection": {
+        readonly changes: readonly ["compliance.applyPreset"];
+    };
+    readonly extensions: {
+        readonly changes: readonly ["extensions.create", "extensions.remove", "extensions.setSettings", "extensions.approve", "extensions.setEnabled", "extensions.applyUpdate", "extensions.revert", "extensions.setUpdatePolicy", "extensions.devSet", "extensions.devClear", "extensions.devReload"];
+    };
+    readonly access: {
+        readonly changes: readonly ["POST /members", "DELETE /members"];
+    };
+    readonly areas: {
+        readonly changes: readonly ["areas.save", "areas.remove"];
+    };
+    readonly personas: {
+        readonly changes: readonly ["personas.save", "personas.remove", "personas.savePrompt", "personas.saveSkill", "personas.removeSkill"];
+    };
+    readonly updates: {
+        readonly changes: readonly ["system.autoUpdate", "system.skipUpdate"];
+    };
+};
+export declare const ORG_BOUND_ROUTES: readonly string[];
+export declare const orgSectionOfRoute: (routeName: string) => OrgSection | undefined;
+export interface OrgLockRefusal {
+    readonly error: string;
+    readonly reason: "org-locked";
+    readonly section: OrgSection;
+    readonly org: string;
+}
+export declare const orgLockRefusal: (policy: OrgPolicy | undefined, routeName: string | undefined) => OrgLockRefusal | undefined;
+export interface OrgPinRefusal {
+    readonly error: string;
+    readonly reason: "org-pinned";
+    readonly items: readonly string[];
+    readonly org: string;
+}
+export declare const orgPinRefusal: (policy: Pick<OrgPolicy, "orgName">, items: readonly string[]) => OrgPinRefusal;
+export interface OrgMembersOnlyRefusal {
+    readonly error: string;
+    readonly reason: "org-members-only";
+    readonly org: string;
+}
+export declare const orgMembersOnlyRefusal: (policy: Pick<OrgPolicy, "orgName">) => OrgMembersOnlyRefusal;
+//# sourceMappingURL=org-locks.d.ts.map

package/dist/policy/org-locks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-locks.d.ts","sourceRoot":"","sources":["../../src/policy/org-locks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,UAAU,EAAkB,MAAM,4BAA4B,CAAC;AAkB3G,eAAO,MAAM,kBAAkB;;iBACjB,OAAO;;;iBAGb,OAAO;iBASP,OAAO;;;iBAIP,OAAO;;;iBAYP,OAAO;iBAeP,OAAO;;;iBAEU,OAAO;;;iBAExB,OAAO;;;iBAeD,OAAO;;;iBACR,OAAO;;;iBACJ,OAAO;;;iBACR,OAAO;;CAC0C,CAAC;AAMjE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAoC,CAAC;AAsBnF,eAAO,MAAM,iBAAiB,cAAe,MAAM,KAAG,UAAU,GAAG,SAA4C,CAAC;AAEhH,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAID,eAAO,MAAM,cAAc,WAAY,SAAS,GAAG,SAAS,aAAa,MAAM,GAAG,SAAS,KAAG,cAAc,GAAG,SAkB9G,CAAC;AAIF,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,aAAa,WAAY,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,SAAS,MAAM,EAAE,KAAG,aAK3F,CAAC;AAIH,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,qBAAqB,WAAY,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,KAAG,qBAIzE,CAAC"}

package/dist/policy/org-locks.js

@@ -0,0 +1,113 @@
+import { ORG_SECTIONS, orgSectionMode } from "../schemas/organisation.js";
+export const ORG_SECTION_ROUTES = {
+    models: { changes: ["accounts.start", "accounts.complete", "accounts.rename", "accounts.disconnect"] },
+    agent: {
+        changes: [
+            "settings.set",
+            "settings.setAgentDomain",
+            "privacy.setPolicy",
+            "privacy.forget",
+            "safety.setPolicy",
+            "skills.save",
+            "skills.remove",
+        ],
+        reveals: ["privacy.reveal"],
+    },
+    environment: {
+        changes: [
+            "POST /environment/approve",
+            "POST /environment/runtime-install",
+            "POST /environment/remove",
+            "POST /engines/channel",
+            "POST /engines/update",
+            "POST /engines/revert",
+        ],
+    },
+    secrets: {
+        changes: [
+            "secrets.set",
+            "secrets.generate",
+            "secrets.remove",
+            "secrets.setGate",
+            "secrets.removeGate",
+            "secrets.setHosts",
+            "secrets.setPolicy",
+            "capabilities.add",
+            "capabilities.remove",
+            "capabilities.rename",
+            "capabilities.setSecret",
+            "capabilities.sshKey",
+            "capabilities.login",
+        ],
+        reveals: ["secrets.reveal"],
+    },
+    "data-protection": { changes: ["compliance.applyPreset"] },
+    extensions: {
+        changes: [
+            "extensions.create",
+            "extensions.remove",
+            "extensions.setSettings",
+            "extensions.approve",
+            "extensions.setEnabled",
+            "extensions.applyUpdate",
+            "extensions.revert",
+            "extensions.setUpdatePolicy",
+            "extensions.devSet",
+            "extensions.devClear",
+            "extensions.devReload",
+        ],
+    },
+    access: { changes: ["POST /members", "DELETE /members"] },
+    areas: { changes: ["areas.save", "areas.remove"] },
+    personas: { changes: ["personas.save", "personas.remove", "personas.savePrompt", "personas.saveSkill", "personas.removeSkill"] },
+    updates: { changes: ["system.autoUpdate", "system.skipUpdate"] },
+};
+export const ORG_BOUND_ROUTES = ["POST /system/access/disable"];
+const COVERED = (() => {
+    const covered = new Map();
+    for (const section of ORG_SECTIONS) {
+        const routes = ORG_SECTION_ROUTES[section];
+        for (const name of routes.changes) {
+            covered.set(name, { section, kind: "change" });
+        }
+        for (const name of routes.reveals ?? []) {
+            covered.set(name, { section, kind: "reveal" });
+        }
+    }
+    for (const name of ORG_BOUND_ROUTES) {
+        covered.set(name, { section: "access", kind: "bound" });
+    }
+    return covered;
+})();
+export const orgSectionOfRoute = (routeName) => COVERED.get(routeName)?.section;
+export const orgLockRefusal = (policy, routeName) => {
+    if (policy === undefined || routeName === undefined) {
+        return undefined;
+    }
+    const covered = COVERED.get(routeName);
+    if (covered === undefined) {
+        return undefined;
+    }
+    const mode = orgSectionMode(policy, covered.section);
+    const refused = covered.kind === "bound" || (covered.kind === "change" ? mode !== "open" : mode === "hidden");
+    return refused
+        ? {
+            error: `${policy.orgName} manages this part of the sandbox (${covered.section}); ask your organisation's admin to change it`,
+            reason: "org-locked",
+            section: covered.section,
+            org: policy.orgName,
+        }
+        : undefined;
+};
+export const orgPinRefusal = (policy, items) => ({
+    error: `${policy.orgName} requires ${items.join(", ")} to stay as it set them; ask your organisation's admin to change it`,
+    reason: "org-pinned",
+    items,
+    org: policy.orgName,
+});
+export const orgMembersOnlyRefusal = (policy) => ({
+    error: `${policy.orgName} gives access to its sandboxes only to its own members; ask your organisation's admin to add this person first`,
+    reason: "org-members-only",
+    org: policy.orgName,
+});
+//# sourceMappingURL=org-locks.js.map

package/dist/policy/org-locks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-locks.js","sourceRoot":"","sources":["../../src/policy/org-locks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAmC,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAkB3G,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,EAAE;IACtG,KAAK,EAAE;QAEH,OAAO,EAAE;YACL,cAAc;YACd,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,kBAAkB;YAClB,aAAa;YACb,eAAe;SAClB;QACD,OAAO,EAAE,CAAC,gBAAgB,CAAC;KAC9B;IAED,WAAW,EAAE;QACT,OAAO,EAAE;YACL,2BAA2B;YAC3B,mCAAmC;YACnC,0BAA0B;YAC1B,uBAAuB;YACvB,sBAAsB;YACtB,sBAAsB;SACzB;KACJ;IAGD,OAAO,EAAE;QACL,OAAO,EAAE;YACL,aAAa;YACb,kBAAkB;YAClB,gBAAgB;YAChB,iBAAiB;YACjB,oBAAoB;YACpB,kBAAkB;YAClB,mBAAmB;YACnB,kBAAkB;YAClB,qBAAqB;YACrB,qBAAqB;YACrB,wBAAwB;YACxB,qBAAqB;YACrB,oBAAoB;SACvB;QACD,OAAO,EAAE,CAAC,gBAAgB,CAAC;KAC9B;IACD,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE;IAC1D,UAAU,EAAE;QACR,OAAO,EAAE;YACL,mBAAmB;YACnB,mBAAmB;YACnB,wBAAwB;YACxB,oBAAoB;YACpB,uBAAuB;YACvB,wBAAwB;YACxB,mBAAmB;YACnB,4BAA4B;YAC5B,mBAAmB;YACnB,qBAAqB;YACrB,sBAAsB;SACzB;KACJ;IAED,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE;IACzD,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE;IAClD,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,CAAC,EAAE;IAChI,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,EAAE;CACJ,CAAC;AAMjE,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,6BAA6B,CAAC,CAAC;AAInF,MAAM,OAAO,GAAiC,CAAC,GAAG,EAAE;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GAAkB,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC,EAAE,CAAC;AAGL,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAA0B,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;AAWhH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAA6B,EAAE,SAA6B,EAA8B,EAAE;IACvH,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC9G,OAAO,OAAO;QACV,CAAC,CAAC;YACI,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,sCAAsC,OAAO,CAAC,OAAO,+CAA+C;YAC5H,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,MAAM,CAAC,OAAO;SACtB;QACH,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAkC,EAAE,KAAwB,EAAiB,EAAE,CAAC,CAAC;IAC3G,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE;IAC1H,MAAM,EAAE,YAAY;IACpB,KAAK;IACL,GAAG,EAAE,MAAM,CAAC,OAAO;CACtB,CAAC,CAAC;AAUH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAkC,EAAyB,EAAE,CAAC,CAAC;IACjG,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,gHAAgH;IACxI,MAAM,EAAE,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAC,OAAO;CACtB,CAAC,CAAC"}

package/dist/policy/reserved-servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-servers.d.ts","sourceRoot":"","sources":["../../src/policy/reserved-servers.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAAC;AAKrD,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAezE,CAAC;AAGF,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAA4C,CAAC;AAIvG,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAInD,CAAC;AAOF,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAwD,CAAC;AAIlH,eAAO,MAAM,0BAA0B,SAAU,MAAM,MAAM,MAAM,KAAG,OACK,CAAC"}
+{"version":3,"file":"reserved-servers.d.ts","sourceRoot":"","sources":["../../src/policy/reserved-servers.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAAC;AAKrD,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAezE,CAAC;AAGF,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAA4C,CAAC;AAIvG,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAInD,CAAC;AAQF,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAgE,CAAC;AAI1H,eAAO,MAAM,0BAA0B,SAAU,MAAM,MAAM,MAAM,KAAG,OACK,CAAC"}

package/dist/policy/reserved-servers.js

@@ -19,6 +19,6 @@ export const RESERVED_MCP_SERVER_NAMES = new Set(Object.keys(DAEMON_MCP_SERVERS)
 export const CONTROL_MCP_SERVERS = new Set(Object.entries(DAEMON_MCP_SERVERS)
     .filter(([, provenance]) => provenance === "control")
     .map(([name]) => name));
-export const MCP_SERVER_MINTING_KINDS = new Set(["mcp", ...contributedServerMintingKinds()]);
+export const MCP_SERVER_MINTING_KINDS = new Set(["mcp", "link", ...contributedServerMintingKinds()]);
 export const collidesWithReservedServer = (kind, id) => MCP_SERVER_MINTING_KINDS.has(kind) && RESERVED_MCP_SERVER_NAMES.has(id);
 //# sourceMappingURL=reserved-servers.js.map

package/dist/policy/reserved-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-servers.js","sourceRoot":"","sources":["../../src/policy/reserved-servers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAc7E,MAAM,CAAC,MAAM,kBAAkB,GAA+C;IAC1E,EAAE,EAAE,SAAS;IACb,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,SAAS;IACtB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACrB,CAAC;AAGF,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAIvG,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC3D,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;KAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC;KACpD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAC7B,CAAC;AAOF,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAIlH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAE,EAAU,EAAW,EAAE,CAC5E,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC"}
+{"version":3,"file":"reserved-servers.js","sourceRoot":"","sources":["../../src/policy/reserved-servers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAc7E,MAAM,CAAC,MAAM,kBAAkB,GAA+C;IAC1E,EAAE,EAAE,SAAS;IACb,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,SAAS;IACtB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACrB,CAAC;AAGF,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAIvG,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC3D,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;KAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC;KACpD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAC7B,CAAC;AAQF,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAI1H,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAE,EAAU,EAAW,EAAE,CAC5E,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC"}

package/dist/protocol/doors/webext-links.d.ts

@@ -2,6 +2,9 @@ export declare const webextConnectUrl: (sandboxUrl: string) => string;
 export declare const webextEnrollUrl: (sandboxUrl: string) => string;
 export declare const webextSessionUrl: (sandboxUrl: string) => string;
 export declare const webextLendUrl: (sandboxUrl: string) => string;
+export declare const webextSecretUrl: (sandboxUrl: string) => string;
+export declare const WEBEXT_TICKET_TOOL = "type_ticket";
+export declare const WEBEXT_TICKET_TTL_MS = 60000;
 export declare const webextPairingCode: (pairing: {
     readonly url: string;
     readonly token: string;

package/dist/protocol/doors/webext-links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webext-links.d.ts","sourceRoot":"","sources":["../../../src/protocol/doors/webext-links.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MAAyF,CAAC;AAIhJ,eAAO,MAAM,eAAe,eAAgB,MAAM,KAAG,MAAiE,CAAC;AAIvH,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MAAkE,CAAC;AAKzH,eAAO,MAAM,aAAa,eAAgB,MAAM,KAAG,MAA+D,CAAC;AAQnH,eAAO,MAAM,iBAAiB,YAAa;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KAAG,MACC,CAAC;AAGhG,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAkBxG,CAAC;AAIF,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,qBAAqB,2BAA2B,CAAC"}
+{"version":3,"file":"webext-links.d.ts","sourceRoot":"","sources":["../../../src/protocol/doors/webext-links.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MAAyF,CAAC;AAIhJ,eAAO,MAAM,eAAe,eAAgB,MAAM,KAAG,MAAiE,CAAC;AAIvH,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MAAkE,CAAC;AAKzH,eAAO,MAAM,aAAa,eAAgB,MAAM,KAAG,MAA+D,CAAC;AAInH,eAAO,MAAM,eAAe,eAAgB,MAAM,KAAG,MAAiE,CAAC;AAKvH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAIhD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,YAAa;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KAAG,MACC,CAAC;AAGhG,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAkBxG,CAAC;AAIF,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,qBAAqB,2BAA2B,CAAC"}

package/dist/protocol/doors/webext-links.js

@@ -2,6 +2,9 @@ export const webextConnectUrl = (sandboxUrl) => `${sandboxUrl.replace(/^http/, "
 export const webextEnrollUrl = (sandboxUrl) => `${sandboxUrl.replace(/\/$/, "")}/system/webext/enroll`;
 export const webextSessionUrl = (sandboxUrl) => `${sandboxUrl.replace(/\/$/, "")}/system/webext/session`;
 export const webextLendUrl = (sandboxUrl) => `${sandboxUrl.replace(/\/$/, "")}/system/webext/lend`;
+export const webextSecretUrl = (sandboxUrl) => `${sandboxUrl.replace(/\/$/, "")}/system/webext/secret`;
+export const WEBEXT_TICKET_TOOL = "type_ticket";
+export const WEBEXT_TICKET_TTL_MS = 60_000;
 const PAIRING_PREFIX = "ixb1_";
 const base64url = (value) => btoa(value).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 export const webextPairingCode = (pairing) => `${PAIRING_PREFIX}${base64url(JSON.stringify({ url: pairing.url, token: pairing.token }))}`;

package/dist/protocol/doors/webext-links.js.map

@@ -1 +1 @@
-{"version":3,"file":"webext-links.js","sourceRoot":"","sources":["../../../src/protocol/doors/webext-links.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;AAIhJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;AAIvH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;AAKzH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC;AAInH,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAEvH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAyD,EAAU,EAAE,CACnG,GAAG,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AAGhG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAgE,EAAE;IACjH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAG9G,CAAC;QAEF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpI,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC"}
+{"version":3,"file":"webext-links.js","sourceRoot":"","sources":["../../../src/protocol/doors/webext-links.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;AAIhJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;AAIvH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;AAKzH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC;AAInH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;AAKvH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAIhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAI3C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAEvH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAyD,EAAU,EAAE,CACnG,GAAG,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AAGhG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAgE,EAAE;IACjH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAG9G,CAAC;QAEF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpI,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC"}