@naylence/runtime 0.3.4 → 0.3.5-test.0

package/dist/esm/src/naylence/fame/security/default-security-manager.js

@@ -0,0 +1,1376 @@
+import { DeliveryOriginType, FameResponseType, } from '@naylence/core';
+import { KeyManagementHandler } from './keys/key-management-handler.js';
+import { SecurityAction, } from './policy/security-policy.js';
+import { EnvelopeSecurityHandler } from '../node/envelope-security-handler.js';
+import { SecureChannelFrameHandler } from '../node/secure-channel-frame-handler.js';
+import { KeyFrameHandler } from '../sentinel/key-frame-handler.js';
+import { getLogger } from '../util/logging.js';
+import { secureDigest } from '../util/util.js';
+import { canonicalJson } from '../security/signing/eddsa-signer-verifier.js';
+import { currentTraceId } from '../util/envelope-context.js';
+import { FameTransportClose } from '../errors/errors.js';
+function normalizeContextAliases(context) {
+    const normalized = context;
+    if (normalized.originType === undefined &&
+        context.origin_type !== undefined) {
+        normalized.originType = context.origin_type;
+    }
+    if (normalized.fromSystemId === undefined &&
+        context.from_system_id !== undefined) {
+        normalized.fromSystemId = context.from_system_id;
+    }
+    if (normalized.expectedResponseType === undefined &&
+        context.expected_response_type !== undefined) {
+        normalized.expectedResponseType = context.expected_response_type;
+    }
+    if (normalized.stickinessRequired === undefined &&
+        context.stickiness_required !== undefined) {
+        normalized.stickinessRequired = context.stickiness_required;
+    }
+    if (normalized.stickySid === undefined && context.sticky_sid !== undefined) {
+        normalized.stickySid = context.sticky_sid;
+    }
+    if (normalized.corrId === undefined && context.corr_id !== undefined) {
+        normalized.corrId = context.corr_id;
+    }
+    if (normalized.traceId === undefined && context.trace_id !== undefined) {
+        normalized.traceId = context.trace_id;
+    }
+    return normalized;
+}
+function hasNodeAttachValidation(authorizer) {
+    return Boolean(authorizer &&
+        typeof authorizer
+            .validateNodeAttachRequest === 'function');
+}
+const logger = getLogger('naylence.fame.security.default_security_manager');
+function hasNodeListenerMethod(candidate, method) {
+    return Boolean(candidate &&
+        typeof candidate[method] === 'function');
+}
+function ensureSecurityContext(context) {
+    if (!context.security) {
+        context.security = {};
+    }
+    return context.security;
+}
+function isDataFrame(frame) {
+    return (typeof frame.type === 'string' &&
+        frame.type === 'Data');
+}
+function isCriticalFrame(frame) {
+    const frameType = frame?.type;
+    return (frameType === 'KeyRequest' ||
+        frameType === 'KeyAnnounce' ||
+        frameType === 'SecureOpen' ||
+        frameType === 'SecureAccept');
+}
+function createLocalContext(node, source) {
+    const normalizedSource = source
+        ? normalizeContextAliases(source)
+        : undefined;
+    const context = {
+        originType: DeliveryOriginType.LOCAL,
+        fromSystemId: node.id,
+        expectedResponseType: FameResponseType.NONE,
+    };
+    if (normalizedSource?.meta) {
+        context.meta = { ...normalizedSource.meta };
+    }
+    if (normalizedSource?.security) {
+        context.security = normalizedSource.security;
+    }
+    if (normalizedSource?.stickinessRequired !== undefined) {
+        context.stickinessRequired = normalizedSource.stickinessRequired;
+    }
+    if (normalizedSource?.stickySid !== undefined) {
+        context.stickySid = normalizedSource.stickySid;
+    }
+    if (normalizedSource?.corrId !== undefined) {
+        context.corrId = normalizedSource.corrId;
+    }
+    if (normalizedSource?.traceId !== undefined) {
+        context.traceId = normalizedSource.traceId;
+    }
+    return context;
+}
+function normalizeDeliveryContext(node, context) {
+    if (!context) {
+        return createLocalContext(node);
+    }
+    const normalized = normalizeContextAliases(context);
+    normalized.originType ?? (normalized.originType = DeliveryOriginType.LOCAL);
+    normalized.fromSystemId ?? (normalized.fromSystemId = node.id);
+    normalized.expectedResponseType ?? (normalized.expectedResponseType = FameResponseType.NONE);
+    return normalized;
+}
+export class DefaultSecurityManager {
+    constructor(policy, envelopeSigner = null, envelopeVerifier = null, encryption = null, keyManager = null, authorizer = null, certificateManager = null, secureChannelManager = null, keyValidator = null) {
+        this.priority = 2000;
+        this._node = null;
+        this._envelopeSecurityHandler = null;
+        this._secureChannelFrameHandler = null;
+        this._keyManagementHandler = null;
+        this._keyFrameHandler = null;
+        this._policy = policy;
+        this._envelopeSigner = envelopeSigner;
+        this._envelopeVerifier = envelopeVerifier;
+        this._encryption = encryption;
+        this._keyManager = keyManager;
+        this._authorizer = authorizer;
+        this._certificateManager = certificateManager;
+        this._secureChannelManager = secureChannelManager;
+        this._keyValidator = keyValidator;
+    }
+    get policy() {
+        return this._policy;
+    }
+    set policy(value) {
+        this._policy = value;
+    }
+    get envelopeSigner() {
+        return this._envelopeSigner;
+    }
+    set envelopeSigner(value) {
+        this._envelopeSigner = value;
+    }
+    get envelopeVerifier() {
+        return this._envelopeVerifier;
+    }
+    set envelopeVerifier(value) {
+        this._envelopeVerifier = value;
+    }
+    get encryption() {
+        return this._encryption;
+    }
+    set encryption(value) {
+        this._encryption = value;
+    }
+    get keyManager() {
+        return this._keyManager;
+    }
+    set keyManager(value) {
+        this._keyManager = value;
+    }
+    get authorizer() {
+        return this._authorizer;
+    }
+    set authorizer(value) {
+        this._authorizer = value;
+    }
+    get certificateManager() {
+        return this._certificateManager;
+    }
+    set certificateManager(value) {
+        this._certificateManager = value;
+    }
+    get cryptoProvider() {
+        if (!this._node) {
+            logger.debug('crypto_provider_requested_before_node_initialized');
+            throw new Error('DefaultSecurityManager has not been initialized with a node');
+        }
+        const provider = this._node.cryptoProvider;
+        logger.debug('crypto_provider_resolved_from_node', {
+            node_id: this._node.id,
+            has_provider: Boolean(provider),
+            provider_type: provider
+                ? (provider.constructor?.name ?? 'unknown')
+                : null,
+            has_private_key: Boolean(provider &&
+                (typeof provider
+                    .signingPrivatePem === 'string' ||
+                    typeof provider
+                        .signing_private_pem === 'string')),
+        });
+        return provider;
+    }
+    get envelopeSecurityHandler() {
+        return this._envelopeSecurityHandler;
+    }
+    get secureChannelFrameHandler() {
+        return this._secureChannelFrameHandler;
+    }
+    get supportsOverlaySecurity() {
+        return Boolean(this._envelopeSigner || this._envelopeVerifier);
+    }
+    getShareableKeys() {
+        const keys = this._getKeysToProvide();
+        if (!keys || keys.length === 0) {
+            return undefined;
+        }
+        if (keys.length === 1) {
+            return keys[0];
+        }
+        return keys;
+    }
+    getEncryptionKeyId() {
+        const provider = this.resolveCryptoProvider();
+        return provider?.encryptionKeyId ?? undefined;
+    }
+    async onNodeStarted(node) {
+        if (this._certificateManager &&
+            hasNodeListenerMethod(this._certificateManager, 'onNodeStarted')) {
+            await this._certificateManager.onNodeStarted(node);
+        }
+        const encryption = this._encryption;
+        if (encryption && hasNodeListenerMethod(encryption, 'onNodeStarted')) {
+            await encryption.onNodeStarted(node);
+        }
+        const keyManager = this._keyManager;
+        if (keyManager && hasNodeListenerMethod(keyManager, 'onNodeStarted')) {
+            await keyManager.onNodeStarted(node);
+        }
+        if (this._keyManager && this.supportsOverlaySecurity) {
+            if (!this._keyValidator) {
+                throw new Error('Key validator must be set when overlay security is enabled');
+            }
+            this._keyManagementHandler = new KeyManagementHandler({
+                node,
+                keyManager: this._keyManager,
+                keyValidator: this._keyValidator,
+                encryptionManager: this._encryption ?? null,
+            });
+            await this._keyManagementHandler.start();
+        }
+        if (this._keyManagementHandler) {
+            this._envelopeSecurityHandler = new EnvelopeSecurityHandler({
+                nodeLike: node,
+                envelopeSigner: this._envelopeSigner,
+                envelopeVerifier: this._envelopeVerifier,
+                encryptionManager: this._encryption ?? null,
+                securityPolicy: this._policy,
+                keyManagementHandler: this._keyManagementHandler,
+            });
+        }
+        else {
+            this._envelopeSecurityHandler = null;
+        }
+        const sendWithContext = async (envelope, context = null) => {
+            const deliveryContext = context ?? {
+                originType: DeliveryOriginType.LOCAL,
+                fromSystemId: node.id,
+                expectedResponseType: FameResponseType.NONE,
+            };
+            await node.deliver(envelope, deliveryContext);
+        };
+        if (this.supportsOverlaySecurity) {
+            this._secureChannelFrameHandler = new SecureChannelFrameHandler({
+                secureChannelManager: this._secureChannelManager,
+                envelopeFactory: node.envelopeFactory,
+                sendCallback: sendWithContext,
+                envelopeSecurityHandler: this._envelopeSecurityHandler,
+            });
+        }
+        else {
+            this._secureChannelFrameHandler = null;
+        }
+        if (this.supportsOverlaySecurity && this.isRoutingNode(node)) {
+            const routingNode = node;
+            const routeManager = node
+                ._route_manager ?? null;
+            const bindingManager = node
+                ._binding_manager ?? null;
+            if (!bindingManager) {
+                throw new Error('Routing node is missing binding manager for key frame handler');
+            }
+            this._keyFrameHandler = new KeyFrameHandler({
+                routingNode,
+                routeManager,
+                bindingManager,
+                acceptKeyAnnounceParent: this._getKeyAnnounceHandler(),
+                keyManager: this._keyManager,
+            });
+            const spawnSource = this.getSpawner(node) ?? this.getSpawner(routingNode);
+            if (spawnSource) {
+                await this._keyFrameHandler.start(spawnSource);
+            }
+            else {
+                logger.warning('no_spawner_available_for_key_frame_handler', {
+                    node_id: node.id,
+                });
+            }
+            logger.debug('key_frame_handler_created_for_sentinel', {
+                node_id: node.id,
+            });
+        }
+        else {
+            this._keyFrameHandler = null;
+        }
+        logger.debug('security_components_initialized', {
+            node_id: node.id,
+            has_certificate_manager: Boolean(this._certificateManager),
+            has_encryption: Boolean(this._encryption),
+            has_key_manager: Boolean(this._keyManager),
+            has_envelope_security_handler: Boolean(this._envelopeSecurityHandler),
+            has_secure_channel_manager: Boolean(this._secureChannelManager),
+        });
+    }
+    async onNodeAttachToUpstream(node, attachInfo) {
+        const attachRecord = attachInfo;
+        const parentKeys = attachRecord.parent_keys ?? attachInfo.parentKeys;
+        const targetSystemId = attachRecord.target_system_id ?? attachInfo.targetSystemId;
+        const targetPhysicalPath = attachRecord.target_physical_path ?? attachInfo.targetPhysicalPath;
+        if (parentKeys) {
+            const validationInput = {
+                peerKeys: parentKeys,
+                nodeLike: node,
+            };
+            const [isValid, reason] = this._policy.validateAttachSecurityCompatibility
+                ? this._policy.validateAttachSecurityCompatibility(validationInput)
+                : [true, undefined];
+            if (!isValid) {
+                logger.error('attach_security_validation_failed', {
+                    reason,
+                    parent_system_id: targetSystemId,
+                    provided_keys_count: Array.isArray(parentKeys)
+                        ? parentKeys.length
+                        : undefined,
+                });
+            }
+            else {
+                logger.debug('attach_security_validation_passed', {
+                    parent_system_id: targetSystemId,
+                    provided_keys_count: Array.isArray(parentKeys)
+                        ? parentKeys.length
+                        : undefined,
+                });
+            }
+            if (this._keyManager) {
+                await this._keyManager.addKeys({
+                    keys: parentKeys,
+                    physicalPath: targetPhysicalPath,
+                    systemId: targetSystemId,
+                    origin: DeliveryOriginType.UPSTREAM,
+                });
+            }
+            else {
+                logger.debug('skipping_parent_keys_no_key_manager');
+            }
+        }
+        else {
+            const requirements = this._policy.requirements();
+            if (requirements.requireSigningKeyExchange ||
+                requirements.requireEncryptionKeyExchange) {
+                logger.warning('attach_missing_required_keys', {
+                    require_signing_keys: requirements.requireSigningKeyExchange,
+                    require_encryption_keys: requirements.requireEncryptionKeyExchange,
+                    parent_system_id: targetSystemId,
+                });
+            }
+        }
+        const handler = node
+            ._key_management_handler ?? this._keyManagementHandler;
+        if (handler) {
+            await handler.retryPendingKeyRequestsAfterAttachment();
+        }
+        const encryption = this._encryption;
+        if (encryption &&
+            hasNodeListenerMethod(encryption, 'onNodeAttachToUpstream')) {
+            await encryption.onNodeAttachToUpstream(node, attachInfo);
+        }
+        logger.debug('node_attach_security_processed', {
+            node_id: node.id,
+            parent_system_id: targetSystemId,
+            parent_keys_count: Array.isArray(parentKeys) ? parentKeys.length : 0,
+        });
+    }
+    async onNodeInitialized(node) {
+        this._node = node;
+        logger.debug('security_manager_node_initialized', {
+            node_id: node.id,
+            has_node_crypto_provider: Boolean(node.cryptoProvider),
+            provider_type: node.cryptoProvider
+                ? (node.cryptoProvider.constructor?.name ?? 'unknown')
+                : null,
+            has_private_key: Boolean(node.cryptoProvider &&
+                (typeof node.cryptoProvider
+                    .signingPrivatePem === 'string' ||
+                    typeof node.cryptoProvider
+                        .signing_private_pem === 'string')),
+        });
+        const keyManager = this._keyManager;
+        if (keyManager && hasNodeListenerMethod(keyManager, 'onNodeInitialized')) {
+            await keyManager.onNodeInitialized(node);
+            logger.debug('key_manager_initialized', { node_id: node.id });
+        }
+        if (this._certificateManager &&
+            hasNodeListenerMethod(this._certificateManager, 'onNodeInitialized')) {
+            await this._certificateManager.onNodeInitialized(node);
+        }
+        const encryption = this._encryption;
+        if (encryption && hasNodeListenerMethod(encryption, 'onNodeInitialized')) {
+            await encryption.onNodeInitialized(node);
+        }
+        logger.debug('node_security_initialization_complete', { node_id: node.id });
+    }
+    async onNodeAttachToPeer(node, attachInfo, connector) {
+        const attachRecord = attachInfo;
+        const peerKeys = attachRecord.parent_keys ?? attachInfo.parentKeys;
+        const targetSystemId = attachRecord.target_system_id ?? attachInfo.targetSystemId;
+        const targetPhysicalPath = attachRecord.target_physical_path ?? attachInfo.targetPhysicalPath;
+        if (peerKeys && this._keyManager) {
+            await this._keyManager.addKeys({
+                keys: peerKeys,
+                physicalPath: targetPhysicalPath,
+                systemId: targetSystemId,
+                origin: DeliveryOriginType.PEER,
+            });
+            logger.debug('peer_keys_added', {
+                peer_system_id: targetSystemId,
+                peer_keys_count: Array.isArray(peerKeys) ? peerKeys.length : 0,
+            });
+        }
+        else if (peerKeys) {
+            logger.debug('skipping_peer_keys_no_key_manager');
+        }
+        else {
+            logger.debug('no_peer_keys_provided', {
+                peer_system_id: targetSystemId,
+            });
+        }
+        if (this._certificateManager &&
+            hasNodeListenerMethod(this._certificateManager, 'onNodeAttachToPeer')) {
+            await this._certificateManager.onNodeAttachToPeer(node, attachInfo, connector);
+        }
+        const encryption = this._encryption;
+        if (encryption && hasNodeListenerMethod(encryption, 'onNodeAttachToPeer')) {
+            await encryption.onNodeAttachToPeer(node, attachInfo, connector);
+        }
+    }
+    async onDeliverLocal(node, address, envelope, context) {
+        if (context) {
+            context = normalizeContextAliases(context);
+        }
+        const localContext = normalizeDeliveryContext(node, context);
+        const securityContext = ensureSecurityContext(localContext);
+        const wasEncrypted = Boolean(envelope.sec?.enc);
+        logger.debug('deliver_local_security_processing', {
+            address: String(address),
+            envp_id: envelope.id,
+            was_encrypted: wasEncrypted,
+            has_signature: Boolean(envelope.sec?.sig),
+        });
+        const frameType = envelope.frame.type;
+        const isSystemFrame = new Set([
+            'SecureOpen',
+            'SecureAccept',
+            'SecureClose',
+            'DeliveryAck',
+            'NodeHeartbeat',
+            'NodeHeartbeatAck',
+            'KeyAnnounce',
+            'KeyRequest',
+            'AddressBind',
+            'AddressUnbind',
+            'AddressBindAck',
+            'AddressUnbindAck',
+            'CapabilityAdvertise',
+            'CapabilityWithdraw',
+            'CapabilityAdvertiseAck',
+            'CapabilityWithdrawAck',
+        ]).has(frameType);
+        if (this._policy && !isSystemFrame) {
+            const inboundCryptoLevel = securityContext.inboundCryptoLevel ??
+                this._policy.classifyMessageCryptoLevel(envelope, undefined);
+            logger.debug('inbound_crypto_level_classified', {
+                envp_id: envelope.id,
+                crypto_level: inboundCryptoLevel,
+                address: String(address),
+            });
+            if (!this._policy.isInboundCryptoLevelAllowed(inboundCryptoLevel, envelope, undefined)) {
+                const violationAction = this._policy.getInboundViolationAction(inboundCryptoLevel, envelope, undefined);
+                logger.warning('inbound_crypto_level_violation', {
+                    envp_id: envelope.id,
+                    crypto_level: inboundCryptoLevel,
+                    action: violationAction,
+                    address: String(address),
+                });
+                if (violationAction === SecurityAction.REJECT) {
+                    logger.error('inbound_message_rejected', {
+                        envp_id: envelope.id,
+                        crypto_level: inboundCryptoLevel,
+                    });
+                    return null;
+                }
+                if (violationAction === SecurityAction.NACK) {
+                    logger.error('inbound_message_nacked', {
+                        envp_id: envelope.id,
+                        crypto_level: inboundCryptoLevel,
+                    });
+                    await this.sendNack(node, envelope, 'crypto_level_violation');
+                    return null;
+                }
+            }
+            const hasSignature = Boolean(envelope.sec?.sig);
+            if (!hasSignature) {
+                const nodeSid = node.sid;
+                const envelopeSid = envelope.sid;
+                const isLocalUnsignedSelfEnvelope = localContext.originType === DeliveryOriginType.LOCAL &&
+                    typeof nodeSid === 'string' &&
+                    nodeSid.length > 0 &&
+                    typeof envelopeSid === 'string' &&
+                    envelopeSid.length > 0 &&
+                    envelopeSid === nodeSid;
+                if (isLocalUnsignedSelfEnvelope) {
+                    logger.debug('local_message_unsigned_skipping_signature_check', {
+                        envp_id: envelope.id,
+                        address: String(address),
+                    });
+                }
+                else if (this._policy.isSignatureRequired(envelope, undefined)) {
+                    const violationAction = this._policy.getUnsignedViolationAction(envelope, undefined);
+                    logger.warning('inbound_signature_violation_unsigned', {
+                        envp_id: envelope.id,
+                        action: violationAction,
+                        address: String(address),
+                    });
+                    if (violationAction === SecurityAction.REJECT) {
+                        logger.error('inbound_message_rejected_unsigned', {
+                            envp_id: envelope.id,
+                        });
+                        return null;
+                    }
+                    if (violationAction === SecurityAction.NACK) {
+                        logger.error('inbound_message_nacked_unsigned', {
+                            envp_id: envelope.id,
+                        });
+                        await this.sendNack(node, envelope, 'signature_required');
+                        return null;
+                    }
+                }
+            }
+            else if (this._envelopeVerifier &&
+                (await this._policy.shouldVerifySignature(envelope, undefined))) {
+                try {
+                    await this._envelopeVerifier.verifyEnvelope(envelope, {
+                        checkPayload: false,
+                    });
+                    logger.debug('inbound_signature_verified', {
+                        envp_id: envelope.id,
+                        address: String(address),
+                    });
+                }
+                catch (error) {
+                    const violationAction = this._policy.getInvalidSignatureViolationAction(envelope, undefined);
+                    logger.warning('inbound_signature_verification_failed', {
+                        envp_id: envelope.id,
+                        error: error instanceof Error ? error.message : String(error),
+                        action: violationAction,
+                        address: String(address),
+                    });
+                    if (violationAction === SecurityAction.REJECT) {
+                        logger.error('inbound_message_rejected_invalid_signature', {
+                            envp_id: envelope.id,
+                        });
+                        return null;
+                    }
+                    if (violationAction === SecurityAction.NACK) {
+                        logger.error('inbound_message_nacked_invalid_signature', {
+                            envp_id: envelope.id,
+                        });
+                        await this.sendNack(node, envelope, 'signature_verification_failed');
+                        return null;
+                    }
+                }
+            }
+        }
+        if (this._envelopeSecurityHandler &&
+            (await this._envelopeSecurityHandler.shouldDecryptEnvelope(envelope, undefined))) {
+            envelope = await this._envelopeSecurityHandler.decryptEnvelope(envelope);
+            logger.debug('deliver_local_after_decrypt', {
+                envp_id: envelope.id,
+                frame_type: envelope.frame.type,
+            });
+        }
+        if (envelope.frame.type === 'SecureAccept' &&
+            this._secureChannelFrameHandler) {
+            await this._secureChannelFrameHandler.handleSecureAccept(envelope, null);
+            return null;
+        }
+        if (envelope.frame.type === 'SecureOpen' &&
+            this._secureChannelFrameHandler) {
+            await this._secureChannelFrameHandler.handleSecureOpen(envelope, null);
+            return null;
+        }
+        if (envelope.frame.type === 'SecureClose' &&
+            this._secureChannelFrameHandler) {
+            await this._secureChannelFrameHandler.handleSecureClose(envelope, null);
+            return null;
+        }
+        if (envelope.sec?.sig && isDataFrame(envelope.frame)) {
+            if (wasEncrypted) {
+                if (!envelope.frame.pd) {
+                    logger.warning('deliver_local_missing_payload_digest', {
+                        envp_id: envelope.id,
+                    });
+                }
+            }
+            else {
+                if (!envelope.frame.pd) {
+                    throw new Error('DataFrame missing payload digest (pd field) for final delivery');
+                }
+                const payload = envelope.frame.payload ?? '';
+                const payloadString = payload === '' ? '' : canonicalJson(payload);
+                const actualDigest = secureDigest(payloadString);
+                if (envelope.frame.pd !== actualDigest) {
+                    logger.error('payload_digest_mismatch_details', {
+                        expected_pd: envelope.frame.pd,
+                        actual_digest: actualDigest,
+                        frame_dict: envelope.frame,
+                    });
+                    throw new Error('Payload digest mismatch on final delivery');
+                }
+                logger.debug('deliver_local_payload_verified', {
+                    expected_pd: envelope.frame.pd,
+                    actual_digest: actualDigest,
+                });
+            }
+        }
+        logger.debug('deliver_local_security_processing_complete', {
+            envp_id: envelope.id,
+            address: String(address),
+        });
+        return envelope;
+    }
+    async onDeliver(_node, envelope, context) {
+        if (context) {
+            context = normalizeContextAliases(context);
+        }
+        if (context &&
+            context.originType !== DeliveryOriginType.LOCAL &&
+            this._policy) {
+            if (isCriticalFrame(envelope.frame)) {
+                const isSigned = Boolean(envelope.sec?.sig);
+                if (!isSigned) {
+                    logger.error('critical_frame_unsigned_rejected', {
+                        envp_id: envelope.id,
+                        frame_type: envelope.frame.type,
+                        reason: 'critical_frames_must_be_signed',
+                    });
+                    return null;
+                }
+            }
+            else if (this._policy.isSignatureRequired(envelope, context)) {
+                const isSigned = Boolean(envelope.sec?.sig);
+                if (!isSigned) {
+                    const violationAction = this._policy.getUnsignedViolationAction(envelope, context);
+                    logger.warning('unsigned_envelope_violation', {
+                        envp_id: envelope.id,
+                        frame_type: envelope.frame.type,
+                        action: violationAction,
+                    });
+                    if (violationAction === SecurityAction.REJECT ||
+                        violationAction === SecurityAction.NACK) {
+                        return null;
+                    }
+                }
+            }
+        }
+        if (context &&
+            context.originType !== DeliveryOriginType.LOCAL &&
+            this._authorizer) {
+            try {
+                const authResult = await this._authorizer.authorize(_node, envelope, context);
+                if (!authResult) {
+                    logger.warning('envelope_authorization_failed', {
+                        envp_id: envelope.id,
+                        frame_type: envelope.frame.type,
+                        origin_type: context.originType ?? 'unknown',
+                    });
+                    return null;
+                }
+                const security = ensureSecurityContext(context);
+                let finalAuthResult = authResult;
+                const authorizer = this._authorizer;
+                if (envelope.frame?.type === 'NodeAttach' &&
+                    hasNodeAttachValidation(authorizer)) {
+                    try {
+                        const validated = await authorizer.validateNodeAttachRequest(_node, envelope.frame, authResult);
+                        if (validated) {
+                            finalAuthResult = validated;
+                        }
+                    }
+                    catch (error) {
+                        logger.error('node_attach_authorization_validation_failed', {
+                            envp_id: envelope.id,
+                            frame_type: envelope.frame.type,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                        return null;
+                    }
+                }
+                security.authorization = finalAuthResult;
+                logger.debug('envelope_authorization_successful', {
+                    envp_id: envelope.id,
+                    frame_type: envelope.frame.type,
+                    principal: finalAuthResult.principal ?? null,
+                });
+            }
+            catch (error) {
+                logger.error('envelope_authorization_error', {
+                    envp_id: envelope.id,
+                    frame_type: envelope.frame.type,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return null;
+            }
+        }
+        if (envelope.frame.type === 'KeyAnnounce') {
+            if (this._keyFrameHandler && context) {
+                await this._keyFrameHandler.acceptKeyAnnounce(envelope, context);
+                return null;
+            }
+            if (this._keyManagementHandler && context) {
+                await this._keyManagementHandler.acceptKeyAnnounce(envelope, context);
+                return null;
+            }
+            logger.debug('keyannounce_frame_ignored_no_key_handler', {
+                envp_id: envelope.id,
+            });
+            return envelope;
+        }
+        if (envelope.frame.type === 'KeyRequest') {
+            if (this._keyFrameHandler && context) {
+                const handledLocally = await this._keyFrameHandler.acceptKeyRequest(envelope, context);
+                if (handledLocally) {
+                    return null;
+                }
+            }
+            else if (this._keyManager && context) {
+                await this.handleChildKeyRequest(envelope, context);
+                return null;
+            }
+            else {
+                logger.debug('keyrequest_frame_ignored_no_handler', {
+                    envp_id: envelope.id,
+                });
+                return envelope;
+            }
+        }
+        if (this._envelopeSecurityHandler) {
+            const [processed, shouldContinue] = await this._envelopeSecurityHandler.handleEnvelopeSecurity(envelope, context);
+            if (!shouldContinue) {
+                return null;
+            }
+            envelope = processed;
+        }
+        logger.debug('on_deliver_security_processing_complete', {
+            envp_id: envelope.id,
+        });
+        return envelope;
+    }
+    async onForwardUpstream(_node, envelope, context) {
+        logger.debug('on_forward_upstream_start', { envp_id: envelope.id });
+        if (context) {
+            context = normalizeContextAliases(context);
+        }
+        if (context?.originType === DeliveryOriginType.LOCAL &&
+            this._envelopeSecurityHandler) {
+            const normalizedContext = normalizeDeliveryContext(_node, context);
+            const handled = await this._envelopeSecurityHandler.handleOutboundSecurity(envelope, normalizedContext);
+            if (!handled) {
+                logger.debug('on_forward_upstream_queued_for_keys', {
+                    envp_id: envelope.id,
+                });
+                return null;
+            }
+        }
+        logger.debug('on_forward_upstream_security_processing_complete', {
+            envp_id: envelope.id,
+        });
+        return envelope;
+    }
+    async onForwardToRoute(node, nextSegment, envelope, context) {
+        logger.debug('on_forward_to_route_start', {
+            envp_id: envelope.id,
+            next_segment: nextSegment,
+        });
+        if (context) {
+            context = normalizeContextAliases(context);
+        }
+        if (context &&
+            this._policy &&
+            isCriticalFrame(envelope.frame) &&
+            !envelope.sec?.sig) {
+            if (this._envelopeSecurityHandler) {
+                const localContext = createLocalContext(node, context);
+                ensureSecurityContext(localContext);
+                ensureSecurityContext(localContext);
+                const handled = await this._envelopeSecurityHandler.handleOutboundSecurity(envelope, localContext);
+                if (!handled) {
+                    logger.warning('critical_frame_forwarding_failed_missing_keys', {
+                        envp_id: envelope.id,
+                        frame_type: envelope.frame.type,
+                        next_segment: nextSegment,
+                    });
+                    return null;
+                }
+            }
+            else {
+                logger.error('critical_frame_forwarding_failed_no_security_handler', {
+                    envp_id: envelope.id,
+                    frame_type: envelope.frame.type,
+                    next_segment: nextSegment,
+                });
+                return null;
+            }
+        }
+        if (context?.originType === DeliveryOriginType.LOCAL &&
+            this._envelopeSecurityHandler) {
+            const normalizedContext = normalizeDeliveryContext(node, context);
+            const handled = await this._envelopeSecurityHandler.handleOutboundSecurity(envelope, normalizedContext);
+            if (!handled) {
+                logger.debug('on_forward_to_route_queued_for_keys', {
+                    envp_id: envelope.id,
+                    next_segment: nextSegment,
+                });
+                return null;
+            }
+        }
+        logger.debug('on_forward_to_route_security_processing_complete', {
+            envp_id: envelope.id,
+            next_segment: nextSegment,
+        });
+        return envelope;
+    }
+    async onForwardToPeer(node, peerSegment, envelope, context) {
+        logger.debug('on_forward_to_peer_start', {
+            envp_id: envelope.id,
+            peer_segment: peerSegment,
+        });
+        if (context) {
+            context = normalizeContextAliases(context);
+        }
+        if (context &&
+            this._policy &&
+            isCriticalFrame(envelope.frame) &&
+            !envelope.sec?.sig) {
+            if (this._envelopeSecurityHandler) {
+                const localContext = createLocalContext(node, context);
+                ensureSecurityContext(localContext);
+                const handled = await this._envelopeSecurityHandler.handleOutboundSecurity(envelope, localContext);
+                if (!handled) {
+                    logger.warning('critical_frame_forwarding_failed_missing_keys', {
+                        envp_id: envelope.id,
+                        frame_type: envelope.frame.type,
+                        peer_segment: peerSegment,
+                    });
+                    return null;
+                }
+            }
+            else {
+                logger.error('critical_frame_forwarding_failed_no_security_handler', {
+                    envp_id: envelope.id,
+                    frame_type: envelope.frame.type,
+                    peer_segment: peerSegment,
+                });
+                return null;
+            }
+        }
+        if (context?.originType === DeliveryOriginType.LOCAL &&
+            this._envelopeSecurityHandler) {
+            const handled = await this._envelopeSecurityHandler.handleOutboundSecurity(envelope, context);
+            if (!handled) {
+                logger.debug('on_forward_to_peer_queued_for_keys', {
+                    envp_id: envelope.id,
+                    peer_segment: peerSegment,
+                });
+                return null;
+            }
+        }
+        logger.debug('on_forward_to_peer_security_processing_complete', {
+            envp_id: envelope.id,
+            peer_segment: peerSegment,
+        });
+        return envelope;
+    }
+    async onForwardToPeers(node, envelope, peers, excludePeers, context) {
+        logger.debug('on_forward_to_peers_start', {
+            envp_id: envelope.id,
+            peers,
+            exclude_peers: excludePeers,
+        });
+        if (context) {
+            context = normalizeContextAliases(context);
+        }
+        if (context &&
+            this._policy &&
+            isCriticalFrame(envelope.frame) &&
+            !envelope.sec?.sig) {
+            if (this._envelopeSecurityHandler) {
+                const localContext = createLocalContext(node, context);
+                const handled = await this._envelopeSecurityHandler.handleOutboundSecurity(envelope, localContext);
+                if (!handled) {
+                    logger.warning('critical_frame_forwarding_failed_missing_keys', {
+                        envp_id: envelope.id,
+                        frame_type: envelope.frame.type,
+                        peers,
+                    });
+                    return null;
+                }
+            }
+            else {
+                logger.error('critical_frame_forwarding_failed_no_security_handler', {
+                    envp_id: envelope.id,
+                    frame_type: envelope.frame.type,
+                    peers,
+                });
+                return null;
+            }
+        }
+        if (context?.originType === DeliveryOriginType.LOCAL &&
+            this._envelopeSecurityHandler) {
+            const handled = await this._envelopeSecurityHandler.handleOutboundSecurity(envelope, context);
+            if (!handled) {
+                logger.debug('on_forward_to_peers_queued_for_keys', {
+                    envp_id: envelope.id,
+                });
+                return null;
+            }
+        }
+        logger.debug('on_forward_to_peers_security_processing_complete', {
+            envp_id: envelope.id,
+        });
+        return envelope;
+    }
+    async onEpochChange(_node, epoch) {
+        logger.debug('handle_epoch_change_security', { epoch });
+        if (this._keyManager && this._keyManager.announceKeysToUpstream) {
+            await this._keyManager.announceKeysToUpstream();
+        }
+        else {
+            logger.debug('skipping_key_announcement_no_key_manager');
+        }
+    }
+    async onNodeStopped(node) {
+        logger.debug('stopping_security_components', { node_id: node.id });
+        if (this._keyFrameHandler) {
+            await this._keyFrameHandler.stop();
+            this._keyFrameHandler = null;
+            logger.debug('key_frame_handler_stopped');
+        }
+        if (this._keyManagementHandler) {
+            await this._keyManagementHandler.stop();
+            this._keyManagementHandler = null;
+            logger.debug('key_management_handler_stopped');
+        }
+        if (this._keyManager &&
+            hasNodeListenerMethod(this._keyManager, 'onNodeStopped')) {
+            await this._keyManager.onNodeStopped(node);
+            logger.debug('key_manager_stopped');
+        }
+        if (this._certificateManager &&
+            hasNodeListenerMethod(this._certificateManager, 'onNodeStopped')) {
+            await this._certificateManager.onNodeStopped(node);
+            logger.debug('certificate_manager_stopped');
+        }
+        if (this._encryption &&
+            hasNodeListenerMethod(this._encryption, 'onNodeStopped')) {
+            await this._encryption.onNodeStopped(node);
+            logger.debug('encryption_manager_stopped');
+        }
+        this._node = null;
+        logger.debug('security_manager_node_cleared', { node_id: node.id });
+    }
+    async onWelcome(welcomeFrame) {
+        if (!this._certificateManager) {
+            return;
+        }
+        try {
+            await this._certificateManager.onWelcome?.(welcomeFrame);
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                error.message.includes('certificate validation failed')) {
+                logger.error('child_node_certificate_validation_failed_stopping_node', {
+                    error: error.message,
+                    node_id: welcomeFrame.system_id ?? null,
+                    assigned_path: welcomeFrame.assigned_path ?? null,
+                    message: 'Child node cannot proceed due to certificate validation failure',
+                });
+                throw error;
+            }
+            logger.warning('certificate_provisioning_error_proceeding_without_cert', {
+                error: error instanceof Error ? error.message : String(error),
+                node_id: welcomeFrame.system_id ?? null,
+                assigned_path: welcomeFrame.assigned_path ?? null,
+                exc_info: true,
+            });
+        }
+    }
+    async onHeartbeatReceived(envelope) {
+        if (envelope.sec?.sig && this._envelopeVerifier) {
+            try {
+                await this._envelopeVerifier.verifyEnvelope(envelope);
+                logger.debug('heartbeat_ack_envelope_verified');
+            }
+            catch (error) {
+                logger.warning('heartbeat_envelope_verification_failed', {
+                    envelope_id: envelope.id,
+                    error: error instanceof Error ? error.message : String(error),
+                    exc_info: true,
+                });
+            }
+            return;
+        }
+        if (envelope.sec?.sig && !this._envelopeVerifier) {
+            try {
+                const requirements = this._policy._requirements ?? this._policy.requirements();
+                const verificationRequired = 'verificationRequired' in requirements
+                    ? requirements.verificationRequired
+                    : Boolean(requirements.verification_required);
+                if (verificationRequired) {
+                    logger.warning('heartbeat_signature_present_but_no_verifier_policy_requires_verification', { envelope_id: envelope.id });
+                }
+            }
+            catch {
+                logger.debug('could_not_determine_verification_policy_allowing_heartbeat', {
+                    envelope_id: envelope.id,
+                });
+            }
+        }
+    }
+    async onChildAttach(options) {
+        const { childSystemId, childKeys, nodeLike, originType, assignedPath, oldAssignedPath, isRebind = false, } = options;
+        const ourKeys = this._getKeysToProvide();
+        if (isRebind && oldAssignedPath && this._keyManager) {
+            try {
+                const removedCount = await this._keyManager.removeKeysForPath(oldAssignedPath);
+                logger.debug('removed_stale_keys_on_rebind', {
+                    system_id: childSystemId,
+                    old_path: oldAssignedPath,
+                    removed_count: removedCount,
+                });
+            }
+            catch (error) {
+                logger.warning('failed_to_remove_stale_keys_on_rebind', {
+                    system_id: childSystemId,
+                    old_path: oldAssignedPath,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        const sentinelPolicy = nodeLike.securityManager?.policy ?? null;
+        if (sentinelPolicy) {
+            if (childKeys) {
+                const childValidationOptions = { nodeLike };
+                if (Array.isArray(childKeys)) {
+                    childValidationOptions.peerKeys = childKeys;
+                }
+                const [validChildKeys, reason] = sentinelPolicy.validateAttachSecurityCompatibility
+                    ? sentinelPolicy.validateAttachSecurityCompatibility(childValidationOptions)
+                    : [true, undefined];
+                if (!validChildKeys) {
+                    logger.warning('attach_child_security_validation_failed', {
+                        reason,
+                        child_system_id: childSystemId,
+                        child_keys_count: childKeys.length ?? 0,
+                    });
+                }
+                else {
+                    logger.debug('attach_child_security_validation_passed', {
+                        child_system_id: childSystemId,
+                        child_keys_count: childKeys.length ?? 0,
+                    });
+                }
+            }
+            const ourValidationOptions = { nodeLike };
+            if (ourKeys) {
+                ourValidationOptions.peerKeys = ourKeys;
+            }
+            const [ourKeysValid, ourReason] = sentinelPolicy.validateAttachSecurityCompatibility
+                ? sentinelPolicy.validateAttachSecurityCompatibility(ourValidationOptions)
+                : [true, undefined];
+            if (!ourKeysValid) {
+                logger.warning('attach_our_security_validation_warning', {
+                    reason: ourReason,
+                    child_system_id: childSystemId,
+                    our_keys_count: ourKeys?.length ?? 0,
+                });
+            }
+            else {
+                logger.debug('attach_our_security_validation_passed', {
+                    child_system_id: childSystemId,
+                    our_keys_count: ourKeys?.length ?? 0,
+                });
+            }
+            const requirements = sentinelPolicy.requirements();
+            if (ourKeys && ourKeys.length > 0) {
+                const hasSigningKey = ourKeys.some((key) => {
+                    const use = key.use;
+                    return ((use === 'sig' || use === undefined || use === null) &&
+                        key.kty === 'OKP' &&
+                        key.crv === 'Ed25519');
+                });
+                const hasEncryptionKey = ourKeys.some((key) => {
+                    const use = key.use;
+                    return ((use === 'enc' || use === undefined || use === null) &&
+                        key.kty === 'OKP' &&
+                        key.crv === 'X25519');
+                });
+                if (requirements.requireSigningKeyExchange && !hasSigningKey) {
+                    logger.warning('attach_missing_signing_key', {
+                        child_system_id: childSystemId,
+                        reason: 'Our policy requires signing but we are not providing signing keys',
+                    });
+                }
+                if (requirements.requireEncryptionKeyExchange && !hasEncryptionKey) {
+                    logger.warning('attach_missing_encryption_key', {
+                        child_system_id: childSystemId,
+                        reason: 'Our policy requires encryption but we are not providing encryption keys',
+                    });
+                }
+            }
+            else if (requirements.requireSigningKeyExchange ||
+                requirements.requireEncryptionKeyExchange) {
+                logger.warning('attach_no_keys_provided', {
+                    child_system_id: childSystemId,
+                    require_signing: requirements.requireSigningKeyExchange,
+                    require_encryption: requirements.requireEncryptionKeyExchange,
+                });
+            }
+        }
+        if (childKeys && this._keyManager && assignedPath && originType) {
+            try {
+                await this._keyManager.addKeys({
+                    keys: childKeys,
+                    physicalPath: assignedPath,
+                    origin: originType,
+                    systemId: childSystemId,
+                });
+                logger.debug('added_child_attach_keys', {
+                    child_system_id: childSystemId,
+                    assigned_path: assignedPath,
+                    keys_count: childKeys.length ?? 0,
+                });
+            }
+            catch (error) {
+                if (error instanceof FameTransportClose) {
+                    logger.error('failed_to_add_attach_keys_will_retry_on_epoch_change', {
+                        parent_id: childSystemId,
+                        trace_id: currentTraceId(),
+                        exc_info: true,
+                    });
+                }
+                else {
+                    logger.error('failed_to_add_attach_keys', {
+                        child_system_id: childSystemId,
+                        assigned_path: assignedPath,
+                        error: error instanceof Error ? error.message : String(error),
+                        exc_info: true,
+                    });
+                }
+            }
+        }
+    }
+    async handleChildKeyRequest(envelope, context) {
+        if (!this._keyManager) {
+            throw new Error('KeyManager must be set for KeyRequest handling');
+        }
+        const frame = envelope.frame;
+        const originSid = context.fromSystemId ?? null;
+        if (!originSid) {
+            logger.warning('missing_origin_sid_for_key_request', {
+                envp_id: envelope.id,
+            });
+            return;
+        }
+        logger.debug('handling_key_request_for_child_node', {
+            address: frame.address ? String(frame.address) : null,
+            kid: frame.kid ?? null,
+            corr_id: envelope.corrId ?? null,
+            origin_sid: originSid,
+        });
+        if (frame.kid) {
+            const requestOptions = {
+                kid: frame.kid,
+                fromSegment: originSid,
+                origin: context.originType ?? DeliveryOriginType.LOCAL,
+            };
+            if (frame.physicalPath !== undefined) {
+                requestOptions.physicalPath = frame.physicalPath;
+            }
+            if (envelope.corrId !== undefined) {
+                requestOptions.correlationId = envelope.corrId;
+            }
+            if (envelope.sid !== undefined) {
+                requestOptions.originalClientSid = envelope.sid;
+            }
+            logger.debug('child_node_forwarding_key_request', {
+                kid: frame.kid,
+                origin_sid: originSid,
+                correlation_id: envelope.corrId ?? null,
+            });
+            await this._keyManager.handleKeyRequest(requestOptions);
+            return;
+        }
+        if (frame.address) {
+            try {
+                const cryptoProvider = this.resolveCryptoProvider();
+                if (!cryptoProvider) {
+                    logger.debug('crypto_provider_key_lookup_failed', {
+                        error: 'no_crypto_provider_available',
+                        envp_id: envelope.id,
+                    });
+                }
+                if (cryptoProvider?.encryptionKeyId) {
+                    const requestOptions = {
+                        kid: cryptoProvider.encryptionKeyId,
+                        fromSegment: originSid,
+                        origin: context.originType ?? DeliveryOriginType.LOCAL,
+                    };
+                    if (envelope.corrId !== undefined) {
+                        requestOptions.correlationId = envelope.corrId;
+                    }
+                    if (envelope.sid !== undefined) {
+                        requestOptions.originalClientSid = envelope.sid;
+                    }
+                    logger.debug('child_node_responding_with_own_encryption_key_id', {
+                        key_id: cryptoProvider.encryptionKeyId,
+                        requested_address: frame.address ? String(frame.address) : null,
+                        envp_id: envelope.id,
+                    });
+                    await this._keyManager.handleKeyRequest(requestOptions);
+                    return;
+                }
+                if (cryptoProvider?.signatureKeyId) {
+                    const requestOptions = {
+                        kid: cryptoProvider.signatureKeyId,
+                        fromSegment: originSid,
+                        origin: context.originType ?? DeliveryOriginType.LOCAL,
+                    };
+                    if (envelope.corrId !== undefined) {
+                        requestOptions.correlationId = envelope.corrId;
+                    }
+                    if (envelope.sid !== undefined) {
+                        requestOptions.originalClientSid = envelope.sid;
+                    }
+                    logger.debug('child_node_responding_with_own_signature_key_id', {
+                        key_id: cryptoProvider.signatureKeyId,
+                        requested_address: frame.address ? String(frame.address) : null,
+                        envp_id: envelope.id,
+                    });
+                    await this._keyManager.handleKeyRequest(requestOptions);
+                    return;
+                }
+            }
+            catch (error) {
+                logger.debug('crypto_provider_key_lookup_failed', {
+                    error: error instanceof Error ? error.message : String(error),
+                    envp_id: envelope.id,
+                });
+            }
+            logger.debug('child_node_cannot_resolve_address_key_request', {
+                address: frame.address,
+                reason: 'no_crypto_provider_keys_found',
+                envp_id: envelope.id,
+            });
+            return;
+        }
+        logger.warning('key_request_missing_both_kid_and_address', {
+            envp_id: envelope.id,
+        });
+    }
+    _getKeyAnnounceHandler() {
+        if (this._keyManagementHandler) {
+            return (envelope, context) => this._keyManagementHandler.acceptKeyAnnounce(envelope, context);
+        }
+        return async () => {
+            // no-op when key management handler not available
+        };
+    }
+    _getKeysToProvide() {
+        if (!this._envelopeSigner) {
+            logger.debug('no_keys_provided_no_crypto_components');
+            return null;
+        }
+        try {
+            const cryptoProvider = this.resolveCryptoProvider();
+            if (!cryptoProvider) {
+                return null;
+            }
+            const keys = [];
+            const nodeJwk = cryptoProvider.nodeJwk?.();
+            if (nodeJwk) {
+                keys.push(nodeJwk);
+            }
+            const jwks = cryptoProvider.getJwks?.();
+            if (jwks?.keys) {
+                for (const jwk of jwks.keys) {
+                    if (nodeJwk &&
+                        jwk.kid === nodeJwk.kid &&
+                        jwk.use !== 'enc') {
+                        continue;
+                    }
+                    keys.push(jwk);
+                }
+            }
+            return keys.length > 0 ? keys : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    resolveCryptoProvider() {
+        if (this._node) {
+            const provider = this._node.cryptoProvider ?? null;
+            logger.debug('resolve_provider_from_node', {
+                node_id: this._node.id,
+                has_provider: Boolean(provider),
+            });
+            return provider;
+        }
+        logger.debug('resolve_provider_without_node_context');
+        return null;
+    }
+    async sendNack(node, originalEnv, reason) {
+        const frameType = originalEnv.frame?.type;
+        if (frameType === 'CreditUpdate' ||
+            frameType === 'NodeHeartbeat' ||
+            frameType === 'NodeHeartbeatAck') {
+            logger.debug('nack_skipped_for_control_frame', {
+                envp_id: originalEnv.id,
+                frame_type: frameType,
+                reason,
+            });
+            return;
+        }
+        if (!originalEnv.replyTo) {
+            logger.debug('nack_no_destination', { envp_id: originalEnv.id });
+            return;
+        }
+        const frame = {
+            type: 'DeliveryAck',
+            ok: false,
+            refId: originalEnv.id,
+            code: reason,
+        };
+        const envelopeOptions = {
+            frame,
+            to: originalEnv.replyTo,
+        };
+        if (originalEnv.traceId !== undefined) {
+            envelopeOptions.traceId = originalEnv.traceId;
+        }
+        if (originalEnv.corrId !== undefined) {
+            envelopeOptions.corrId = originalEnv.corrId;
+        }
+        const envelope = node.envelopeFactory.createEnvelope(envelopeOptions);
+        await node.deliver(envelope, {
+            originType: DeliveryOriginType.LOCAL,
+            fromSystemId: node.id,
+            expectedResponseType: FameResponseType.NONE,
+        });
+    }
+    getSpawner(target) {
+        const candidate = target?.spawn;
+        if (typeof candidate === 'function') {
+            return candidate.bind(target);
+        }
+        return null;
+    }
+    isRoutingNode(node) {
+        return typeof node.forwardToRoute === 'function';
+    }
+}
+//# sourceMappingURL=default-security-manager.js.map