@opsregistry/bridge-client 0.4.0

package/README.md

@@ -0,0 +1,95 @@
+# @opsregistry/bridge-client
+
+Общая TypeScript-библиотека для безопасного взаимодействия браузерных приложений с локальным
+[`opsregistry-bridge`](https://gitflic.ru/project/opsregistry/bridge). Она позволяет любому
+приложению использовать локальные операции OpsRegistry и не содержит кода, специфичного для VARM.
+
+Клиент:
+
+- находит локальный Bridge и проверяет версию протокола;
+- связывает origin приложения с локальной службой;
+- принимает короткоживущий допуск к каждой операции;
+- проверяет запросы и ответы схемами `@opsregistry/contracts`;
+- предоставляет типизированные методы для настройки электронной подписи, поиска устройств и
+  сертификатов, а также создания подписи;
+- различает недоступность службы, нарушение протокола и ошибку самой операции.
+
+Библиотека не содержит интерфейс, криптографию, закрытые ключи и бизнес-логику провайдеров.
+Приложение само показывает пользователю установку и подписание, а допуски к операциям выдаёт его
+backend после проверки прав пользователя.
+
+`operationGrant` — не произвольный API-токен, а короткоживущий компактный JWS с `EdDSA`. Перед
+обращением к backend приложение получает `requestId` через `createRequestId()`. Grant связан с
+конкретными Bridge, origin, кодом операции, `requestId` и SHA-256 канонизированного input, поэтому
+его нельзя перенести на другой запрос или повторно использовать. Backend должен вычислять хеш input
+по JSON Canonicalization Scheme (RFC 8785); формат claims экспортируется из
+`@opsregistry/contracts/bridge/grant`.
+
+## Пример
+
+```ts
+import { BridgeClient } from '@opsregistry/bridge-client';
+
+const bridge = new BridgeClient();
+const manifest = await bridge.discover();
+const requestId = bridge.createRequestId();
+
+// Backend signs bridgeId, origin, operation, requestId and the RFC 8785 input hash.
+const operationGrant = await getOperationGrant({ bridgeId: manifest.bridgeId, requestId });
+
+const environment = await bridge.inspectSigningEnvironment(
+	{
+		requirements: {
+			signatureFormats: ['cadesBes'],
+			qualifiedSignature: 'required'
+		}
+	},
+	{ requestId, operationGrant }
+);
+```
+
+Для полного сценария приложение сначала вызывает `discover()`, при необходимости выполняет
+`pair()`, открывает возвращённый `approvalUrl` в новой вкладке и опрашивает `getPairing(requestId)`.
+После локального подтверждения оно получает допуск от своего backend и вызывает нужную операцию.
+Специализированные методы доступны для следующих контрактов:
+
+- `trust.signingEnvironment.inspect`;
+- `trust.signingEnvironment.configure`;
+- `trust.device.list`;
+- `trust.certificate.list`;
+- `trust.certificate.resolve`;
+- `trust.digitalSignature.create`.
+
+Для остальных операций можно использовать типизированное ядро `execute()` с соответствующей
+Zod-схемой результата.
+
+Результат `discover()` содержит `modules` и `operations`. Поле состояния операции позволяет
+интерфейсу различить готовую возможность, модуль, который можно установить, текущую установку и
+ошибку настройки. Старого общего `operationCodes` нет: оно не позволяло отличить установленный
+функционал от доступного для загрузки.
+
+Manifest также возвращает `operatingSystem`, `architecture` и полный `targetTriple`. Клиент не
+угадывает совместимость платформ: выбор конкретного бинарника выполняет сам Bridge по точному
+совпадению с подписанным каталогом. Поэтому один и тот же клиент работает с Bridge на Windows,
+Linux, macOS и будущих поддерживаемых системах.
+
+## Безопасность транспорта
+
+По умолчанию клиент обращается к `http://127.0.0.1:47831`. Удалённые хосты отклоняются даже при
+явной настройке. В production HTTPS-приложение должно быть связано с Bridge и передавать новый
+короткоживущий допуск для каждой операции.
+
+## Разработка
+
+```bash
+bun install
+bun run check
+bun test
+bun run build
+```
+
+## English
+
+`@opsregistry/bridge-client` is a framework-neutral TypeScript client for secure communication
+between browser applications and a local OpsRegistry Bridge. It validates loopback endpoints,
+protocol envelopes and operation payloads without implementing UI or cryptography.

package/dist/client.d.ts

@@ -0,0 +1,43 @@
+import { type BridgeManifest, type BridgePairingRequest, type BridgePairingResult } from '@opsregistry/contracts/bridge/protocol';
+import { type CertificateListInput, type CertificateListResult } from '@opsregistry/contracts/trust/certificate-list';
+import { type CertificateResolveInput, type CertificateResolveResult } from '@opsregistry/contracts/trust/certificate-resolve';
+import { type DeviceListInput, type DeviceListResult } from '@opsregistry/contracts/trust/device-list';
+import { type DigitalSignatureCreateInput, type DigitalSignatureCreateResult } from '@opsregistry/contracts/trust/digital-signature-create';
+import { type SigningEnvironmentConfigureInput, type SigningEnvironmentConfigureResult } from '@opsregistry/contracts/trust/signing-environment-configure';
+import { type SigningEnvironmentInspectInput, type SigningEnvironmentInspectResult } from '@opsregistry/contracts/trust/signing-environment-inspect';
+import type { ZodType } from 'zod';
+export declare const defaultBridgeBaseUrl = "http://127.0.0.1:47831";
+type Fetch = typeof globalThis.fetch;
+type PairingInput = Omit<BridgePairingRequest, 'protocolVersion'>;
+export type OperationAuthorization = {
+    requestId: string;
+    operationGrant: string;
+};
+export type BridgeClientOptions = {
+    baseUrl?: string;
+    fetch?: Fetch;
+    timeoutMs?: number;
+    randomUuid?: () => string;
+};
+export declare const normalizeBridgeBaseUrl: (value: string) => string;
+export declare class BridgeClient {
+    readonly baseUrl: string;
+    readonly timeoutMs: number;
+    readonly fetch: Fetch;
+    readonly randomUuid: () => string;
+    constructor(options?: BridgeClientOptions);
+    createRequestId(): string;
+    discover(): Promise<BridgeManifest>;
+    pair(input: PairingInput): Promise<BridgePairingResult>;
+    getPairing(requestId: string): Promise<BridgePairingResult>;
+    execute<T>(operationCode: string, input: unknown, authorization: OperationAuthorization, resultSchema: ZodType<T>): Promise<T>;
+    inspectSigningEnvironment(input: SigningEnvironmentInspectInput, authorization: OperationAuthorization): Promise<SigningEnvironmentInspectResult>;
+    configureSigningEnvironment(input: SigningEnvironmentConfigureInput, authorization: OperationAuthorization): Promise<SigningEnvironmentConfigureResult>;
+    listDevices(input: DeviceListInput, authorization: OperationAuthorization): Promise<DeviceListResult>;
+    listCertificates(input: CertificateListInput, authorization: OperationAuthorization): Promise<CertificateListResult>;
+    resolveCertificate(input: CertificateResolveInput, authorization: OperationAuthorization): Promise<CertificateResolveResult>;
+    createDigitalSignature(input: DigitalSignatureCreateInput, authorization: OperationAuthorization): Promise<DigitalSignatureCreateResult>;
+    private request;
+}
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAON,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGN,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAGN,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAGN,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAGN,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAGN,KAAK,gCAAgC,EACrC,KAAK,iCAAiC,EACtC,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAGN,KAAK,8BAA8B,EACnC,KAAK,+BAA+B,EACpC,MAAM,0DAA0D,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAOnC,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,KAAK,KAAK,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AACrC,KAAK,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAAG;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B,CAAC;AAYF,eAAO,MAAM,sBAAsB,UAAW,MAAM,WAanD,CAAC;AAEF,qBAAa,YAAY;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,MAAM,CAAC;IAElC,YAAY,OAAO,GAAE,mBAAwB,EAK5C;IAED,eAAe,IAAI,MAAM,CAExB;IAEK,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,CASxC;IAEK,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiB5D;IAEK,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWhE;IAEK,OAAO,CAAC,CAAC,EACd,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,OAAO,EACd,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CAsCZ;IAED,yBAAyB,CACxB,KAAK,EAAE,8BAA8B,EACrC,aAAa,EAAE,sBAAsB,GACnC,OAAO,CAAC,+BAA+B,CAAC,CAO1C;IAED,2BAA2B,CAC1B,KAAK,EAAE,gCAAgC,EACvC,aAAa,EAAE,sBAAsB,GACnC,OAAO,CAAC,iCAAiC,CAAC,CAO5C;IAED,WAAW,CACV,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,sBAAsB,GACnC,OAAO,CAAC,gBAAgB,CAAC,CAO3B;IAED,gBAAgB,CACf,KAAK,EAAE,oBAAoB,EAC3B,aAAa,EAAE,sBAAsB,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAOhC;IAED,kBAAkB,CACjB,KAAK,EAAE,uBAAuB,EAC9B,aAAa,EAAE,sBAAsB,GACnC,OAAO,CAAC,wBAAwB,CAAC,CAOnC;IAED,sBAAsB,CACrB,KAAK,EAAE,2BAA2B,EAClC,aAAa,EAAE,sBAAsB,GACnC,OAAO,CAAC,4BAA4B,CAAC,CAOvC;YAEa,OAAO;CAiCrB"}

package/dist/client.js

@@ -0,0 +1,167 @@
+import { bridgeManifestSchema, bridgeOperationRequestSchema, bridgeOperationResponseSchema, bridgePairingRequestSchema, bridgePairingResultSchema, bridgeProtocolVersion } from '@opsregistry/contracts/bridge/protocol';
+import { certificateListInputSchema, certificateListResultSchema } from '@opsregistry/contracts/trust/certificate-list';
+import { certificateResolveInputSchema, certificateResolveResultSchema } from '@opsregistry/contracts/trust/certificate-resolve';
+import { deviceListInputSchema, deviceListResultSchema } from '@opsregistry/contracts/trust/device-list';
+import { digitalSignatureCreateInputSchema, digitalSignatureCreateResultSchema } from '@opsregistry/contracts/trust/digital-signature-create';
+import { signingEnvironmentConfigureInputSchema, signingEnvironmentConfigureResultSchema } from '@opsregistry/contracts/trust/signing-environment-configure';
+import { signingEnvironmentInspectInputSchema, signingEnvironmentInspectResultSchema } from '@opsregistry/contracts/trust/signing-environment-inspect';
+import { BridgeOperationError, BridgeProtocolError, BridgeUnavailableError } from './errors.js';
+export const defaultBridgeBaseUrl = 'http://127.0.0.1:47831';
+const isLoopbackHost = (hostname) => {
+    const normalized = hostname.replace(/^\[|\]$/g, '');
+    return (normalized === 'localhost' ||
+        normalized.endsWith('.localhost') ||
+        normalized === '::1' ||
+        /^127(?:\.\d{1,3}){3}$/.test(normalized));
+};
+export const normalizeBridgeBaseUrl = (value) => {
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol)) {
+        throw new BridgeProtocolError('Bridge URL must use HTTP or HTTPS');
+    }
+    if (!isLoopbackHost(url.hostname)) {
+        throw new BridgeProtocolError('Bridge URL must resolve to a loopback host');
+    }
+    if (url.username || url.password || url.search || url.hash) {
+        throw new BridgeProtocolError('Bridge URL must not contain credentials, query or fragment');
+    }
+    url.pathname = url.pathname.replace(/\/+$/, '');
+    return url.toString().replace(/\/$/, '');
+};
+export class BridgeClient {
+    baseUrl;
+    timeoutMs;
+    fetch;
+    randomUuid;
+    constructor(options = {}) {
+        this.baseUrl = normalizeBridgeBaseUrl(options.baseUrl ?? defaultBridgeBaseUrl);
+        this.timeoutMs = options.timeoutMs ?? 3_000;
+        this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+        this.randomUuid = options.randomUuid ?? (() => globalThis.crypto.randomUUID());
+    }
+    createRequestId() {
+        return this.randomUuid();
+    }
+    async discover() {
+        const value = await this.request('/v1/manifest', { method: 'GET' });
+        const parsed = bridgeManifestSchema.safeParse(value);
+        if (!parsed.success) {
+            throw new BridgeProtocolError('Local bridge returned an invalid manifest', {
+                cause: parsed.error
+            });
+        }
+        return parsed.data;
+    }
+    async pair(input) {
+        const request = bridgePairingRequestSchema.parse({
+            ...input,
+            protocolVersion: bridgeProtocolVersion
+        });
+        const value = await this.request('/v1/pairings', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(request)
+        });
+        const parsed = bridgePairingResultSchema.safeParse(value);
+        if (!parsed.success) {
+            throw new BridgeProtocolError('Local bridge returned an invalid pairing response', {
+                cause: parsed.error
+            });
+        }
+        return parsed.data;
+    }
+    async getPairing(requestId) {
+        const value = await this.request(`/v1/pairings/${encodeURIComponent(requestId)}`, {
+            method: 'GET'
+        });
+        const parsed = bridgePairingResultSchema.safeParse(value);
+        if (!parsed.success || parsed.data.requestId !== requestId) {
+            throw new BridgeProtocolError('Local bridge returned an invalid pairing status', {
+                cause: parsed.success ? undefined : parsed.error
+            });
+        }
+        return parsed.data;
+    }
+    async execute(operationCode, input, authorization, resultSchema) {
+        const { requestId, operationGrant } = authorization;
+        const request = bridgeOperationRequestSchema.parse({
+            protocolVersion: bridgeProtocolVersion,
+            requestId,
+            operationCode,
+            operationGrant,
+            input
+        });
+        const value = await this.request(`/v1/operations/${encodeURIComponent(operationCode)}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(request)
+        }, true);
+        const envelope = bridgeOperationResponseSchema.safeParse(value);
+        if (!envelope.success) {
+            throw new BridgeProtocolError('Local bridge returned an invalid operation response', {
+                cause: envelope.error
+            });
+        }
+        if (envelope.data.requestId !== requestId || envelope.data.operationCode !== operationCode) {
+            throw new BridgeProtocolError('Local bridge response does not match the request');
+        }
+        if (envelope.data.error) {
+            throw new BridgeOperationError(envelope.data.error.code, envelope.data.error.message, envelope.data.error.retryable, envelope.data.error.details);
+        }
+        const parsed = resultSchema.safeParse(envelope.data.result);
+        if (!parsed.success) {
+            throw new BridgeProtocolError(`Invalid result for ${operationCode}`, {
+                cause: parsed.error
+            });
+        }
+        return parsed.data;
+    }
+    inspectSigningEnvironment(input, authorization) {
+        return this.execute('trust.signingEnvironment.inspect', signingEnvironmentInspectInputSchema.parse(input), authorization, signingEnvironmentInspectResultSchema);
+    }
+    configureSigningEnvironment(input, authorization) {
+        return this.execute('trust.signingEnvironment.configure', signingEnvironmentConfigureInputSchema.parse(input), authorization, signingEnvironmentConfigureResultSchema);
+    }
+    listDevices(input, authorization) {
+        return this.execute('trust.device.list', deviceListInputSchema.parse(input), authorization, deviceListResultSchema);
+    }
+    listCertificates(input, authorization) {
+        return this.execute('trust.certificate.list', certificateListInputSchema.parse(input), authorization, certificateListResultSchema);
+    }
+    resolveCertificate(input, authorization) {
+        return this.execute('trust.certificate.resolve', certificateResolveInputSchema.parse(input), authorization, certificateResolveResultSchema);
+    }
+    createDigitalSignature(input, authorization) {
+        return this.execute('trust.digitalSignature.create', digitalSignatureCreateInputSchema.parse(input), authorization, digitalSignatureCreateResultSchema);
+    }
+    async request(path, init, allowOperationError = false) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetch(`${this.baseUrl}${path}`, {
+                ...init,
+                cache: 'no-store',
+                credentials: 'omit',
+                mode: 'cors',
+                signal: controller.signal
+            });
+            const value = await response.json().catch(() => undefined);
+            if (!response.ok && !allowOperationError) {
+                throw new BridgeProtocolError(`Local bridge request failed with HTTP ${response.status}`);
+            }
+            return value;
+        }
+        catch (error) {
+            if (error instanceof BridgeProtocolError || error instanceof BridgeOperationError) {
+                throw error;
+            }
+            throw new BridgeUnavailableError('Local OpsRegistry Bridge is unavailable', {
+                cause: error
+            });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EAIrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACN,0BAA0B,EAC1B,2BAA2B,EAG3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAG9B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,qBAAqB,EACrB,sBAAsB,EAGtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACN,iCAAiC,EACjC,kCAAkC,EAGlC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACN,sCAAsC,EACtC,uCAAuC,EAGvC,MAAM,4DAA4D,CAAC;AACpE,OAAO,EACN,oCAAoC,EACpC,qCAAqC,EAGrC,MAAM,0DAA0D,CAAC;AAElE,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAiB7D,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,EAAE;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,CACN,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,KAAK,KAAK;QACpB,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CACxC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAE,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,mBAAmB,CAAC,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAAC,4DAA4D,CAAC,CAAC;IAC7F,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,OAAO,YAAY;IACf,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,KAAK,CAAQ;IACb,UAAU,CAAe;IAElC,YAAY,OAAO,GAAwB,EAAE;QAC5C,IAAI,CAAC,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,eAAe;QACd,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,EAAE;gBAC1E,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAmB;QAC7B,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC;YAChD,GAAG,KAAK;YACR,eAAe,EAAE,qBAAqB;SACtC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC7B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,EAAE;gBAClF,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE;YACjF,MAAM,EAAE,KAAK;SACb,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,EAAE;gBAChF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;aAChD,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,aAAqB,EACrB,KAAc,EACd,aAAqC,EACrC,YAAwB;QAExB,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC;QACpD,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC;YAClD,eAAe,EAAE,qBAAqB;YACtC,SAAS;YACT,aAAa;YACb,cAAc;YACd,KAAK;SACL,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,kBAAkB,CAAC,aAAa,CAAC,EAAE,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC7B,EAAE,IAAI,CAAC,CAAC;QACT,MAAM,QAAQ,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAmB,CAAC,qDAAqD,EAAE;gBACpF,KAAK,EAAE,QAAQ,CAAC,KAAK;aACrB,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YAC5F,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAC7B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EACxB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAC3B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAC7B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAC3B,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,aAAa,EAAE,EAAE;gBACpE,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,yBAAyB,CACxB,KAAqC,EACrC,aAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAClB,kCAAkC,EAClC,oCAAoC,CAAC,KAAK,CAAC,KAAK,CAAC,EACjD,aAAa,EACb,qCAAqC,CACrC,CAAC;IACH,CAAC;IAED,2BAA2B,CAC1B,KAAuC,EACvC,aAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAClB,oCAAoC,EACpC,sCAAsC,CAAC,KAAK,CAAC,KAAK,CAAC,EACnD,aAAa,EACb,uCAAuC,CACvC,CAAC;IACH,CAAC;IAED,WAAW,CACV,KAAsB,EACtB,aAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAClB,mBAAmB,EACnB,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,EAClC,aAAa,EACb,sBAAsB,CACtB,CAAC;IACH,CAAC;IAED,gBAAgB,CACf,KAA2B,EAC3B,aAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAClB,wBAAwB,EACxB,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,EACvC,aAAa,EACb,2BAA2B,CAC3B,CAAC;IACH,CAAC;IAED,kBAAkB,CACjB,KAA8B,EAC9B,aAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAClB,2BAA2B,EAC3B,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1C,aAAa,EACb,8BAA8B,CAC9B,CAAC;IACH,CAAC;IAED,sBAAsB,CACrB,KAAkC,EAClC,aAAqC;QAErC,OAAO,IAAI,CAAC,OAAO,CAClB,+BAA+B,EAC/B,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9C,aAAa,EACb,kCAAkC,CAClC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CACpB,IAAY,EACZ,IAAiB,EACjB,mBAAmB,GAAG,KAAK;QAE3B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC3D,GAAG,IAAI;gBACP,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,MAAM;gBACnB,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,UAAU,CAAC,MAAM;aACzB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,IAAI,mBAAmB,CAC5B,yCAAyC,QAAQ,CAAC,MAAM,EAAE,CAC1D,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBACnF,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,IAAI,sBAAsB,CAAC,yCAAyC,EAAE;gBAC3E,KAAK,EAAE,KAAK;aACZ,CAAC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;CACD"}

package/dist/errors.d.ts

@@ -0,0 +1,13 @@
+export declare class BridgeUnavailableError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class BridgeProtocolError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare class BridgeOperationError extends Error {
+    readonly code: string;
+    readonly retryable: boolean;
+    readonly details: Record<string, unknown>;
+    constructor(code: string, message: string, retryable?: boolean, details?: Record<string, unknown>);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACD;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE1C,YACC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,UAAQ,EACjB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAOrC;CACD"}

package/dist/errors.js

@@ -0,0 +1,25 @@
+export class BridgeUnavailableError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'BridgeUnavailableError';
+    }
+}
+export class BridgeProtocolError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'BridgeProtocolError';
+    }
+}
+export class BridgeOperationError extends Error {
+    code;
+    retryable;
+    details;
+    constructor(code, message, retryable = false, details = {}) {
+        super(message);
+        this.name = 'BridgeOperationError';
+        this.code = code;
+        this.retryable = retryable;
+        this.details = details;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAAsB;QAClD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACtC,CAAC;CACD;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe,EAAE,OAAsB;QAClD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACrC,IAAI,CAAS;IACb,SAAS,CAAU;IACnB,OAAO,CAA0B;IAE1C,YACC,IAAY,EACZ,OAAe,EACf,SAAS,GAAG,KAAK,EACjB,OAAO,GAA4B,EAAE;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './client.js';
+export * from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from './client.js';
+export * from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+	"name": "@opsregistry/bridge-client",
+	"version": "0.4.0",
+	"description": "Browser client for secure communication with a local OpsRegistry Bridge.",
+	"type": "module",
+	"license": "MIT",
+	"packageManager": "bun@1.4.0",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"files": ["dist", "README.md"],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js"
+		}
+	},
+	"scripts": {
+		"build": "rm -rf dist && tsc -p tsconfig.json",
+		"check": "tsc -p tsconfig.json --noEmit",
+		"test": "bun test"
+	},
+	"peerDependencies": {
+		"@opsregistry/contracts": ">=0.12.0 <1",
+		"zod": ">=4.5.0 <5"
+	},
+	"devDependencies": {
+		"@opsregistry/contracts": "file:../contracts",
+		"@types/bun": "^1.4.0",
+		"typescript": "7.0.2",
+		"zod": "^4.5.4"
+	}
+}