devchain-cli 0.14.1 → 0.16.0

package/dist/server/modules/cloud-tunnel/services/tunnel-rpc-crypto.service.d.ts

@@ -0,0 +1,45 @@
+import { E2eeKeypairService } from '../../e2ee/services/e2ee-keypair.service';
+import { E2eeDeviceStoreService } from '../../e2ee/services/e2ee-device-store.service';
+export declare const E2EE_REQUIRED_POLICY = "E2EE_REQUIRED_POLICY";
+export declare const RPC_BOOTSTRAP_METHODS: Set<string>;
+export declare const RPC_SEALED_ONLY_METHODS: Set<string>;
+export interface RpcCryptoContext {
+    senderKid: string;
+}
+export interface JsonRpcRequestLike {
+    jsonrpc: '2.0';
+    id: string;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcResponseLike {
+    jsonrpc: '2.0';
+    id: string;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export type SealedRpcResult = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+};
+export declare class TunnelRpcCryptoService {
+    private readonly keypair;
+    private readonly deviceStore;
+    private readonly e2eeRequired;
+    constructor(keypair: E2eeKeypairService, deviceStore: E2eeDeviceStoreService, e2eeRequired?: boolean);
+    private readonly randomBytes;
+    handle(req: JsonRpcRequestLike, instanceId: string | null, dispatch: (plain: JsonRpcRequestLike, cryptoCtx?: RpcCryptoContext) => Promise<JsonRpcResponseLike>): Promise<JsonRpcResponseLike>;
+    private buildEnvelopeService;
+    private ctx;
+}

package/dist/server/modules/cloud-tunnel/services/tunnel-rpc-crypto.service.js

@@ -0,0 +1,126 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TunnelRpcCryptoService = exports.RPC_SEALED_ONLY_METHODS = exports.RPC_BOOTSTRAP_METHODS = exports.E2EE_REQUIRED_POLICY = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const shared_1 = require("@devchain/shared");
+const logger_1 = require("../../../common/logging/logger");
+const e2ee_keypair_service_1 = require("../../e2ee/services/e2ee-keypair.service");
+const e2ee_device_store_service_1 = require("../../e2ee/services/e2ee-device-store.service");
+const logger = (0, logger_1.createLogger)('TunnelRpcCrypto');
+exports.E2EE_REQUIRED_POLICY = 'E2EE_REQUIRED_POLICY';
+exports.RPC_BOOTSTRAP_METHODS = new Set(['e2ee.adoptDeviceKey']);
+exports.RPC_SEALED_ONLY_METHODS = new Set(['e2ee.revokeDeviceKey']);
+let TunnelRpcCryptoService = class TunnelRpcCryptoService {
+    constructor(keypair, deviceStore, e2eeRequired = false) {
+        this.keypair = keypair;
+        this.deviceStore = deviceStore;
+        this.e2eeRequired = e2eeRequired;
+        this.randomBytes = (n) => new Uint8Array((0, crypto_1.randomBytes)(n));
+    }
+    async handle(req, instanceId, dispatch) {
+        const params = req.params;
+        if (!(0, shared_1.isE2eeEnvelope)(params)) {
+            if (exports.RPC_SEALED_ONLY_METHODS.has(req.method)) {
+                logger.warn({ id: req.id, method: req.method }, 'Plaintext RPC rejected — method is sealed-only');
+                return {
+                    jsonrpc: '2.0',
+                    id: req.id,
+                    error: { code: -32603, message: 'E2EE required' },
+                };
+            }
+            if (this.e2eeRequired && !exports.RPC_BOOTSTRAP_METHODS.has(req.method)) {
+                logger.warn({ id: req.id, method: req.method }, 'Plaintext RPC rejected — E2EE is required on this instance');
+                return {
+                    jsonrpc: '2.0',
+                    id: req.id,
+                    error: { code: -32603, message: 'E2EE required' },
+                };
+            }
+            return dispatch(req);
+        }
+        if (!instanceId) {
+            logger.warn({ id: req.id, method: req.method }, 'Encrypted RPC arrived before tunnel ready — cannot bind AAD');
+            return { jsonrpc: '2.0', id: req.id, error: { code: -32603, message: 'E2EE unavailable' } };
+        }
+        const service = await this.buildEnvelopeService(params.kid);
+        if (!service) {
+            logger.warn({ id: req.id, method: req.method, kid: params.kid }, 'No paired device for RPC envelope kid — rejecting');
+            return {
+                jsonrpc: '2.0',
+                id: req.id,
+                error: { code: -32602, message: 'E2EE decrypt failed' },
+            };
+        }
+        let plainParams;
+        try {
+            plainParams = await service.open(params, this.ctx('mobile-to-pc', instanceId, req.method));
+        }
+        catch (err) {
+            logger.warn({ err: err?.name, id: req.id, method: req.method }, 'RPC params decryption failed — rejecting');
+            return {
+                jsonrpc: '2.0',
+                id: req.id,
+                error: { code: -32602, message: 'E2EE decrypt failed' },
+            };
+        }
+        const plainReq = {
+            ...req,
+            params: plainParams && typeof plainParams === 'object' && !Array.isArray(plainParams)
+                ? plainParams
+                : {},
+        };
+        const cryptoCtx = { senderKid: params.kid };
+        const resp = await dispatch(plainReq, cryptoCtx);
+        const payload = resp.error
+            ? { ok: false, error: resp.error }
+            : { ok: true, data: resp.result };
+        const sealed = await service.seal(payload, this.ctx('pc-to-mobile', instanceId, req.method));
+        return { jsonrpc: '2.0', id: req.id, result: sealed };
+    }
+    async buildEnvelopeService(peerKid) {
+        const device = this.deviceStore.get(peerKid);
+        if (!device)
+            return null;
+        let devicePub;
+        try {
+            devicePub = (0, shared_1.base64ToBytes)(device.publicKeyB64);
+        }
+        catch {
+            return null;
+        }
+        if (devicePub.length !== shared_1.X25519_PUBLIC_KEY_BYTES)
+            return null;
+        const pc = await this.keypair.getOrCreate();
+        const sharedKey = (0, shared_1.deriveSharedKey)(pc.privateKey, devicePub);
+        const provider = {
+            resolveSealKey: () => ({ kid: pc.kid, key: sharedKey }),
+            getKeyById: (kid) => (kid === device.kid || kid === pc.kid ? sharedKey : undefined),
+        };
+        return new shared_1.CryptoEnvelopeService(provider, this.randomBytes);
+    }
+    ctx(direction, instanceId, method) {
+        return { lane: 'rpc', direction, instanceId, routeKey: method };
+    }
+};
+exports.TunnelRpcCryptoService = TunnelRpcCryptoService;
+exports.TunnelRpcCryptoService = TunnelRpcCryptoService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(exports.E2EE_REQUIRED_POLICY)),
+    __metadata("design:paramtypes", [e2ee_keypair_service_1.E2eeKeypairService,
+        e2ee_device_store_service_1.E2eeDeviceStoreService, Boolean])
+], TunnelRpcCryptoService);
+//# sourceMappingURL=tunnel-rpc-crypto.service.js.map

package/dist/server/modules/cloud-tunnel/services/tunnel-rpc-crypto.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-rpc-crypto.service.js","sourceRoot":"","sources":["../../../../src/modules/cloud-tunnel/services/tunnel-rpc-crypto.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8D;AAC9D,mCAAwD;AACxD,6CAQ0B;AAC1B,2DAA8D;AAC9D,mFAA8E;AAC9E,6FAAuF;AAEvF,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,iBAAiB,CAAC,CAAC;AAUlC,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAU9C,QAAA,qBAAqB,GAAG,IAAI,GAAG,CAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAWjE,QAAA,uBAAuB,GAAG,IAAI,GAAG,CAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAyD1E,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,OAA2B,EAC3B,WAAmC,EACV,eAAyC,KAAK;QAFvE,YAAO,GAAP,OAAO,CAAoB;QAC3B,gBAAW,GAAX,WAAW,CAAwB;QACO,iBAAY,GAAZ,YAAY,CAAiB;QAIzE,gBAAW,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,UAAU,CAAC,IAAA,oBAAe,EAAC,CAAC,CAAC,CAAC,CAAC;IAH1F,CAAC;IAWJ,KAAK,CAAC,MAAM,CACV,GAAuB,EACvB,UAAyB,EACzB,QAGiC;QAEjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAM1B,IAAI,CAAC,IAAA,uBAAc,EAAC,MAAM,CAAC,EAAE,CAAC;YAK5B,IAAI,+BAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CACT,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAClC,gDAAgD,CACjD,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,6BAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CACT,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAClC,4DAA4D,CAC7D,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE;iBAClD,CAAC;YACJ,CAAC;YAGD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAID,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CACT,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAClC,6DAA6D,CAC9D,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YAGb,MAAM,CAAC,IAAI,CACT,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACnD,mDAAmD,CACpD,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE;aACxD,CAAC;QACJ,CAAC;QAGD,IAAI,WAAoB,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAG,GAAa,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC7D,0CAA0C,CAC3C,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE;aACxD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,GAAG,GAAG;YACN,MAAM,EACJ,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC3E,CAAC,CAAE,WAAuC;gBAC1C,CAAC,CAAC,EAAE;SACT,CAAC;QAMF,MAAM,SAAS,GAAqB,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAI9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAKjD,MAAM,OAAO,GAAoB,IAAI,CAAC,KAAK;YACzC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAClC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxD,CAAC;IAQO,KAAK,CAAC,oBAAoB,CAAC,OAAe;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,GAAG,IAAA,sBAAa,EAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,gCAAuB;YAAE,OAAO,IAAI,CAAC;QAE9D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAoB;YAEhC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;YAGvD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;SACpF,CAAC;QACF,OAAO,IAAI,8BAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IAEO,GAAG,CACT,SAA0C,EAC1C,UAAkB,EAClB,MAAc;QAEd,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;CACF,CAAA;AAzKY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,4BAAoB,CAAC,CAAA;qCAFf,yCAAkB;QACd,kDAAsB;GAH3C,sBAAsB,CAyKlC"}

package/dist/server/modules/cloud-tunnel/services/tunnel-viewport-crypto.service.d.ts

@@ -0,0 +1,20 @@
+import { type E2eeEnvelope, type E2eeNegotiationReason, type ViewportScreen } from '@devchain/shared';
+import { E2eeKeypairService } from '../../e2ee/services/e2ee-keypair.service';
+import { E2eeDeviceStoreService } from '../../e2ee/services/e2ee-device-store.service';
+export type ViewportChannelMode = 'encrypted' | 'plaintext' | 'blocked';
+export interface ViewportChannel {
+    mode: ViewportChannelMode;
+    reason: E2eeNegotiationReason;
+    sealScreen?: (sessionId: string, seq: number, screen: ViewportScreen) => Promise<E2eeEnvelope>;
+}
+export declare class TunnelViewportCryptoService {
+    private readonly keypair;
+    private readonly deviceStore;
+    private readonly e2eeRequired;
+    constructor(keypair: E2eeKeypairService, deviceStore: E2eeDeviceStoreService, e2eeRequired?: boolean);
+    private readonly randomBytes;
+    resolveViewportChannel(instanceId: string | null): Promise<ViewportChannel>;
+    private ctx;
+    private selectPeerDevice;
+    private isUsable;
+}

package/dist/server/modules/cloud-tunnel/services/tunnel-viewport-crypto.service.js

@@ -0,0 +1,114 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TunnelViewportCryptoService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const shared_1 = require("@devchain/shared");
+const logger_1 = require("../../../common/logging/logger");
+const e2ee_keypair_service_1 = require("../../e2ee/services/e2ee-keypair.service");
+const e2ee_device_store_service_1 = require("../../e2ee/services/e2ee-device-store.service");
+const tunnel_rpc_crypto_service_1 = require("./tunnel-rpc-crypto.service");
+const logger = (0, logger_1.createLogger)('TunnelViewportCrypto');
+let TunnelViewportCryptoService = class TunnelViewportCryptoService {
+    constructor(keypair, deviceStore, e2eeRequired = false) {
+        this.keypair = keypair;
+        this.deviceStore = deviceStore;
+        this.e2eeRequired = e2eeRequired;
+        this.randomBytes = (n) => new Uint8Array((0, crypto_1.randomBytes)(n));
+    }
+    async resolveViewportChannel(instanceId) {
+        if (!instanceId) {
+            return { mode: 'plaintext', reason: 'plaintext-mixed' };
+        }
+        let pcKid;
+        let pcPrivateKey;
+        let selfCap;
+        try {
+            const kp = await this.keypair.getOrCreate();
+            pcKid = kp.kid;
+            pcPrivateKey = kp.privateKey;
+            selfCap = (0, shared_1.buildE2eeCapability)({
+                e2eeRequired: this.e2eeRequired,
+                key: { kid: kp.kid, publicKeyB64: Buffer.from(kp.publicKey).toString('base64') },
+            });
+        }
+        catch (err) {
+            if (this.e2eeRequired) {
+                logger.warn({ err }, 'E2EE keypair unavailable — viewport BLOCKED (E2EE required)');
+                return { mode: 'blocked', reason: 'peer-incapable-required' };
+            }
+            logger.warn({ err }, 'E2EE keypair unavailable — viewport falls back to plaintext');
+            return { mode: 'plaintext', reason: 'plaintext-mixed' };
+        }
+        const device = this.selectPeerDevice();
+        const peerCap = device
+            ? { v: 1, envelopeVersion: 1, e2eeSupported: true, e2eeRequired: false }
+            : null;
+        const neg = (0, shared_1.negotiateE2ee)(selfCap, peerCap, { hasExistingKey: !!device });
+        if (neg.mode !== 'encrypted' || !device) {
+            return { mode: neg.mode, reason: neg.reason };
+        }
+        const devicePub = (0, shared_1.base64ToBytes)(device.publicKeyB64);
+        const sharedKey = (0, shared_1.deriveSharedKey)(pcPrivateKey, devicePub);
+        const provider = {
+            resolveSealKey: () => ({ kid: pcKid, key: sharedKey }),
+            getKeyById: (kid) => (kid === pcKid || kid === device.kid ? sharedKey : undefined),
+        };
+        const service = new shared_1.CryptoEnvelopeService(provider, this.randomBytes);
+        return {
+            mode: 'encrypted',
+            reason: neg.reason,
+            sealScreen: (sessionId, seq, screen) => service.seal(screen, this.ctx(instanceId, sessionId, seq)),
+        };
+    }
+    ctx(instanceId, sessionId, seq) {
+        return {
+            lane: 'viewport',
+            direction: 'pc-to-mobile',
+            instanceId,
+            routeKey: sessionId,
+            seq,
+        };
+    }
+    selectPeerDevice() {
+        const usable = this.deviceStore.list().filter((d) => this.isUsable(d));
+        if (usable.length === 0)
+            return null;
+        if (usable.length === 1)
+            return usable[0];
+        const [latest] = [...usable].sort((a, b) => (a.addedAt < b.addedAt ? 1 : -1));
+        logger.debug({ count: usable.length, kid: latest.kid }, 'Multiple paired devices — sealing viewport for the most recently added (v1 single-recipient)');
+        return latest;
+    }
+    isUsable(device) {
+        if (device.trust === 'revoked')
+            return false;
+        try {
+            return (0, shared_1.base64ToBytes)(device.publicKeyB64).length === shared_1.X25519_PUBLIC_KEY_BYTES;
+        }
+        catch {
+            return false;
+        }
+    }
+};
+exports.TunnelViewportCryptoService = TunnelViewportCryptoService;
+exports.TunnelViewportCryptoService = TunnelViewportCryptoService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(tunnel_rpc_crypto_service_1.E2EE_REQUIRED_POLICY)),
+    __metadata("design:paramtypes", [e2ee_keypair_service_1.E2eeKeypairService,
+        e2ee_device_store_service_1.E2eeDeviceStoreService, Boolean])
+], TunnelViewportCryptoService);
+//# sourceMappingURL=tunnel-viewport-crypto.service.js.map

package/dist/server/modules/cloud-tunnel/services/tunnel-viewport-crypto.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-viewport-crypto.service.js","sourceRoot":"","sources":["../../../../src/modules/cloud-tunnel/services/tunnel-viewport-crypto.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8D;AAC9D,mCAAwD;AACxD,6CAa0B;AAC1B,2DAA8D;AAC9D,mFAA8E;AAC9E,6FAGuD;AACvD,2EAAmE;AAEnE,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,sBAAsB,CAAC,CAAC;AAsC7C,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACtC,YACmB,OAA2B,EAC3B,WAAmC,EACV,eAAyC,KAAK;QAFvE,YAAO,GAAP,OAAO,CAAoB;QAC3B,gBAAW,GAAX,WAAW,CAAwB;QACO,iBAAY,GAAZ,YAAY,CAAiB;QAIzE,gBAAW,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,UAAU,CAAC,IAAA,oBAAe,EAAC,CAAC,CAAC,CAAC,CAAC;IAH1F,CAAC;IAWJ,KAAK,CAAC,sBAAsB,CAAC,UAAyB;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,KAAa,CAAC;QAClB,IAAI,YAAwB,CAAC;QAC7B,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5C,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC;YACf,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC;YAC7B,OAAO,GAAG,IAAA,4BAAmB,EAAC;gBAC5B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aACjF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAMb,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,6DAA6D,CAAC,CAAC;gBACpF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,6DAA6D,CAAC,CAAC;YACpF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,OAAO,GAA0B,MAAM;YAC3C,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;YACxE,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,GAAG,GAAG,IAAA,sBAAa,EAAC,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAE1E,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,sBAAa,EAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAoB;YAChC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;YACtD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;SACnF,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,8BAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEtE,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,GAAG,CAAC,UAAkB,EAAE,SAAiB,EAAE,GAAW;QAC5D,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,cAAc;YACzB,UAAU;YAGV,QAAQ,EAAE,SAAS;YACnB,GAAG;SACJ,CAAC;IACJ,CAAC;IAOO,gBAAgB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACzC,8FAA8F,CAC/F,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,QAAQ,CAAC,MAAsB;QACrC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,IAAA,sBAAa,EAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,gCAAuB,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AA9GY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,gDAAoB,CAAC,CAAA;qCAFf,yCAAkB;QACd,kDAAsB;GAH3C,2BAA2B,CA8GvC"}

package/dist/server/modules/cloud-tunnel/services/viewport-frame-sink.d.ts

@@ -0,0 +1,6 @@
+import type { TunnelViewportFrame } from '@devchain/shared';
+export declare abstract class ViewportFrameSink {
+    abstract sendViewport(frame: TunnelViewportFrame): boolean;
+    abstract onPushReady(listener: () => void): () => void;
+    abstract getInstanceId(): string | null;
+}

package/dist/server/modules/cloud-tunnel/services/viewport-frame-sink.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ViewportFrameSink = void 0;
+class ViewportFrameSink {
+}
+exports.ViewportFrameSink = ViewportFrameSink;
+//# sourceMappingURL=viewport-frame-sink.js.map

package/dist/server/modules/cloud-tunnel/services/viewport-frame-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewport-frame-sink.js","sourceRoot":"","sources":["../../../../src/modules/cloud-tunnel/services/viewport-frame-sink.ts"],"names":[],"mappings":";;;AAWA,MAAsB,iBAAiB;CAWtC;AAXD,8CAWC"}

package/dist/server/modules/cloud-tunnel/services/viewport-streamer.service.d.ts

@@ -0,0 +1,30 @@
+import { OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { ActiveSessionLookup } from '../../sessions/services/active-session-lookup.service';
+import { TerminalViewportFacade } from '../../terminal/services/terminal-viewport/terminal-viewport.facade';
+import { ViewportFrameSink } from './viewport-frame-sink';
+import { TunnelViewportCryptoService } from './tunnel-viewport-crypto.service';
+export declare class ViewportStreamerService implements OnModuleInit, OnModuleDestroy {
+    private readonly activeSessions;
+    private readonly terminalViewport;
+    private readonly sink;
+    private readonly viewportCrypto;
+    private readonly subscriptions;
+    private subscriptionSeq;
+    private detachReadyListener;
+    constructor(activeSessions: ActiveSessionLookup, terminalViewport: TerminalViewportFacade, sink: ViewportFrameSink, viewportCrypto: TunnelViewportCryptoService);
+    onModuleInit(): void;
+    subscribe(params: Record<string, unknown>): Promise<{
+        subscriptionId: string;
+    }>;
+    unsubscribe(params: Record<string, unknown>): {
+        ok: boolean;
+    };
+    onModuleDestroy(): void;
+    private markDirty;
+    private scheduleCapture;
+    private runScheduledCapture;
+    private captureAndSend;
+    private reanchorAll;
+    private teardown;
+    private assertSessionInProject;
+}

package/dist/server/modules/cloud-tunnel/services/viewport-streamer.service.js

@@ -0,0 +1,228 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ViewportStreamerService = void 0;
+const common_1 = require("@nestjs/common");
+const shared_1 = require("@devchain/shared");
+const active_session_lookup_service_1 = require("../../sessions/services/active-session-lookup.service");
+const terminal_viewport_facade_1 = require("../../terminal/services/terminal-viewport/terminal-viewport.facade");
+const error_types_1 = require("../../../common/errors/error-types");
+const logger_1 = require("../../../common/logging/logger");
+const viewport_frame_sink_1 = require("./viewport-frame-sink");
+const tunnel_viewport_crypto_service_1 = require("./tunnel-viewport-crypto.service");
+const logger = (0, logger_1.createLogger)('ViewportStreamer');
+const MIN_CAPTURE_INTERVAL_MS = 350;
+let ViewportStreamerService = class ViewportStreamerService {
+    constructor(activeSessions, terminalViewport, sink, viewportCrypto) {
+        this.activeSessions = activeSessions;
+        this.terminalViewport = terminalViewport;
+        this.sink = sink;
+        this.viewportCrypto = viewportCrypto;
+        this.subscriptions = new Map();
+        this.subscriptionSeq = 0;
+        this.detachReadyListener = null;
+    }
+    onModuleInit() {
+        this.detachReadyListener = this.sink.onPushReady(() => this.reanchorAll());
+    }
+    async subscribe(params) {
+        const sessionId = params['sessionId'];
+        const projectId = params['projectId'];
+        await this.assertSessionInProject(sessionId, projectId);
+        if (!this.terminalViewport.hasSession(sessionId)) {
+            throw new error_types_1.AppError('No running terminal session for this session id. Launch/restore it first.', 'SESSION_NOT_RUNNING', 409, { sessionId, projectId });
+        }
+        const subscriptionId = `vp-${++this.subscriptionSeq}`;
+        const sub = {
+            subscriptionId,
+            sessionId,
+            seq: 0,
+            lastScreen: null,
+            detachData: () => { },
+            disposed: false,
+            dirty: false,
+            capturing: false,
+            lastCaptureAt: 0,
+            timer: null,
+        };
+        this.subscriptions.set(subscriptionId, sub);
+        sub.detachData = this.terminalViewport.onData(sessionId, () => this.markDirty(sub));
+        await this.captureAndSend(sub);
+        return { subscriptionId };
+    }
+    unsubscribe(params) {
+        const subscriptionId = params['subscriptionId'];
+        const sub = this.subscriptions.get(subscriptionId);
+        if (!sub)
+            return { ok: false };
+        this.teardown(sub);
+        return { ok: true };
+    }
+    onModuleDestroy() {
+        this.detachReadyListener?.();
+        this.detachReadyListener = null;
+        for (const sub of [...this.subscriptions.values()]) {
+            this.teardown(sub);
+        }
+    }
+    markDirty(sub) {
+        if (sub.disposed)
+            return;
+        sub.dirty = true;
+        this.scheduleCapture(sub);
+    }
+    scheduleCapture(sub) {
+        if (sub.disposed || sub.timer || sub.capturing)
+            return;
+        const elapsed = Date.now() - sub.lastCaptureAt;
+        const delay = Math.max(0, MIN_CAPTURE_INTERVAL_MS - elapsed);
+        sub.timer = setTimeout(() => {
+            sub.timer = null;
+            void this.runScheduledCapture(sub);
+        }, delay);
+        if (typeof sub.timer.unref === 'function')
+            sub.timer.unref();
+    }
+    async runScheduledCapture(sub) {
+        if (sub.disposed)
+            return;
+        sub.capturing = true;
+        sub.dirty = false;
+        try {
+            await this.captureAndSend(sub);
+        }
+        finally {
+            sub.capturing = false;
+        }
+        if (!sub.disposed && sub.dirty)
+            this.scheduleCapture(sub);
+    }
+    async captureAndSend(sub) {
+        if (sub.disposed)
+            return;
+        sub.lastCaptureAt = Date.now();
+        const capture = await this.terminalViewport.capture(sub.sessionId);
+        if (sub.disposed)
+            return;
+        if (!capture) {
+            if (!this.terminalViewport.hasSession(sub.sessionId)) {
+                logger.debug({ sessionId: sub.sessionId }, 'Viewport session ended; tearing down');
+                this.teardown(sub);
+            }
+            return;
+        }
+        const screen = {
+            lines: capture.lines,
+            cursor: capture.cursor,
+            cols: capture.cols,
+            rows: capture.rows,
+        };
+        const channel = await this.viewportCrypto.resolveViewportChannel(this.sink.getInstanceId());
+        if (sub.disposed)
+            return;
+        let body;
+        if (channel.mode === 'blocked') {
+            return;
+        }
+        else if (channel.mode === 'encrypted') {
+            if (sub.lastScreen && diffScreens(sub.lastScreen, screen) === null)
+                return;
+            const enc = await channel.sealScreen(sub.sessionId, sub.seq, screen);
+            if (sub.disposed)
+                return;
+            body = { kind: 'enc-full', enc };
+        }
+        else {
+            body = sub.lastScreen ? diffScreens(sub.lastScreen, screen) : fullBody(screen);
+        }
+        if (!body)
+            return;
+        const frame = {
+            type: shared_1.TUNNEL_VIEWPORT_FRAME_TYPE,
+            v: shared_1.TUNNEL_VIEWPORT_FRAME_VERSION,
+            subscriptionId: sub.subscriptionId,
+            sessionId: sub.sessionId,
+            seq: sub.seq,
+            body,
+        };
+        if (this.sink.sendViewport(frame)) {
+            sub.seq += 1;
+            sub.lastScreen = screen;
+        }
+    }
+    reanchorAll() {
+        for (const sub of this.subscriptions.values()) {
+            if (sub.disposed)
+                continue;
+            sub.lastScreen = null;
+            this.scheduleCapture(sub);
+        }
+    }
+    teardown(sub) {
+        if (sub.disposed)
+            return;
+        sub.disposed = true;
+        if (sub.timer) {
+            clearTimeout(sub.timer);
+            sub.timer = null;
+        }
+        sub.detachData();
+        this.subscriptions.delete(sub.subscriptionId);
+    }
+    async assertSessionInProject(sessionId, projectId) {
+        const scope = await this.activeSessions.getSessionProjectScope(sessionId);
+        if (!scope) {
+            throw new error_types_1.NotFoundError('Session', sessionId);
+        }
+        if (scope.projectId !== projectId) {
+            throw new error_types_1.ForbiddenError('Session does not belong to the requested project', {
+                code: 'SESSION_PROJECT_MISMATCH',
+                sessionId,
+                projectId,
+            });
+        }
+    }
+};
+exports.ViewportStreamerService = ViewportStreamerService;
+exports.ViewportStreamerService = ViewportStreamerService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(viewport_frame_sink_1.ViewportFrameSink)),
+    __metadata("design:paramtypes", [active_session_lookup_service_1.ActiveSessionLookup,
+        terminal_viewport_facade_1.TerminalViewportFacade,
+        viewport_frame_sink_1.ViewportFrameSink,
+        tunnel_viewport_crypto_service_1.TunnelViewportCryptoService])
+], ViewportStreamerService);
+function fullBody(screen) {
+    return { kind: 'full', screen };
+}
+function diffScreens(last, next) {
+    if (last.cols !== next.cols ||
+        last.rows !== next.rows ||
+        last.lines.length !== next.lines.length) {
+        return fullBody(next);
+    }
+    const changedLines = [];
+    for (let row = 0; row < next.lines.length; row++) {
+        if (next.lines[row] !== last.lines[row]) {
+            changedLines.push({ row, text: next.lines[row] });
+        }
+    }
+    const cursorMoved = last.cursor.x !== next.cursor.x || last.cursor.y !== next.cursor.y;
+    if (changedLines.length === 0 && !cursorMoved)
+        return null;
+    return cursorMoved
+        ? { kind: 'diff', changedLines, cursor: next.cursor }
+        : { kind: 'diff', changedLines };
+}
+//# sourceMappingURL=viewport-streamer.service.js.map

package/dist/server/modules/cloud-tunnel/services/viewport-streamer.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewport-streamer.service.js","sourceRoot":"","sources":["../../../../src/modules/cloud-tunnel/services/viewport-streamer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAmF;AACnF,6CAM0B;AAC1B,yGAA4F;AAC5F,iHAA4G;AAC5G,oEAA6F;AAC7F,2DAA8D;AAC9D,+DAA0D;AAC1D,qFAA+E;AAE/E,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,kBAAkB,CAAC,CAAC;AAMhD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAiC7B,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAKlC,YACmB,cAAmC,EACnC,gBAAwC,EAK9B,IAAwC,EAElD,cAA2C;QAR3C,mBAAc,GAAd,cAAc,CAAqB;QACnC,qBAAgB,GAAhB,gBAAgB,CAAwB;QAKb,SAAI,GAAJ,IAAI,CAAmB;QAElD,mBAAc,GAAd,cAAc,CAA6B;QAb7C,kBAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;QACjE,oBAAe,GAAG,CAAC,CAAC;QACpB,wBAAmB,GAAwB,IAAI,CAAC;IAYrD,CAAC;IAEJ,YAAY;QAGV,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IAQD,KAAK,CAAC,SAAS,CAAC,MAA+B;QAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAW,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAW,CAAC;QAGhD,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAExD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,sBAAQ,CAChB,2EAA2E,EAC3E,qBAAqB,EACrB,GAAG,EACH,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;QACtD,MAAM,GAAG,GAAyB;YAChC,cAAc;YACd,SAAS;YACT,GAAG,EAAE,CAAC;YACN,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,GAAG,EAAE,GAAE,CAAC;YACpB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAI5C,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAGpF,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAE/B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC5B,CAAC;IAGD,WAAW,CAAC,MAA+B;QACzC,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAW,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,eAAe;QACb,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAIO,SAAS,CAAC,GAAyB;QACzC,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO;QACzB,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAGO,eAAe,CAAC,GAAyB;QAC/C,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,CAAC;QAC7D,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;YACjB,KAAK,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAyB;QACzD,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO;QACzB,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IAGO,KAAK,CAAC,cAAc,CAAC,GAAyB;QACpD,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO;QACzB,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO;QAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;YAGb,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;gBACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAmB;YAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC;QAKF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5F,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO;QAEzB,IAAI,IAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAE/B,OAAO;QACT,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAIxC,IAAI,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI;gBAAE,OAAO;YAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,GAAG,CAAC,QAAQ;gBAAE,OAAO;YACzB,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACnC,CAAC;aAAM,CAAC;YAEN,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,mCAA0B;YAChC,CAAC,EAAE,sCAA6B;YAChC,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,IAAI;SACL,CAAC;QAEF,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAGlC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACb,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;QAC1B,CAAC;IACH,CAAC;IAGO,WAAW;QACjB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,GAAG,CAAC,QAAQ;gBAAE,SAAS;YAC3B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAyB;QACxC,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO;QACzB,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,GAAG,CAAC,UAAU,EAAE,CAAC;QACjB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAChD,CAAC;IAOO,KAAK,CAAC,sBAAsB,CAAC,SAAiB,EAAE,SAAiB;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAc,CAAC,kDAAkD,EAAE;gBAC3E,IAAI,EAAE,0BAA0B;gBAChC,SAAS;gBACT,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAhOY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAaR,WAAA,IAAA,eAAM,EAAC,uCAAiB,CAAC,CAAA;qCANO,mDAAmB;QACjB,iDAAsB;QAKP,uCAAiB;QAElC,4DAA2B;GAdnD,uBAAuB,CAgOnC;AAGD,SAAS,QAAQ,CAAC,MAAsB;IACtC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAOD,SAAS,WAAW,CAAC,IAAoB,EAAE,IAAoB;IAC7D,IACE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QACvB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EACvC,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,YAAY,GAAyC,EAAE,CAAC;IAC9D,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE3D,OAAO,WAAW;QAChB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACrD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACrC,CAAC"}

package/dist/server/modules/core/core-normal.module.js

@@ -10,7 +10,6 @@ exports.CoreNormalModule = void 0;
 const common_1 = require("@nestjs/common");
 const preflight_controller_1 = require("./controllers/preflight.controller");
 const preflight_service_1 = require("./services/preflight.service");
-const gemini_trusted_folders_module_1 = require("./services/gemini-trusted-folders.module");
 const storage_module_1 = require("../storage/storage.module");
 const providers_module_1 = require("../providers/providers.module");
 const adapters_1 = require("../providers/adapters");
@@ -20,16 +19,10 @@ let CoreNormalModule = class CoreNormalModule {
 exports.CoreNormalModule = CoreNormalModule;
 exports.CoreNormalModule = CoreNormalModule = __decorate([
     (0, common_1.Module)({
-        imports: [
-            storage_module_1.StorageModule,
-            providers_module_1.ProvidersModule,
-            adapters_1.ProviderAdaptersModule,
-            process_executor_module_1.ProcessExecutorModule,
-            gemini_trusted_folders_module_1.GeminiTrustedFoldersModule,
-        ],
+        imports: [storage_module_1.StorageModule, providers_module_1.ProvidersModule, adapters_1.ProviderAdaptersModule, process_executor_module_1.ProcessExecutorModule],
         controllers: [preflight_controller_1.PreflightController],
         providers: [preflight_service_1.PreflightService],
-        exports: [preflight_service_1.PreflightService, gemini_trusted_folders_module_1.GeminiTrustedFoldersModule],
+        exports: [preflight_service_1.PreflightService],
     })
 ], CoreNormalModule);
 //# sourceMappingURL=core-normal.module.js.map

package/dist/server/modules/core/core-normal.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-normal.module.js","sourceRoot":"","sources":["../../../src/modules/core/core-normal.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,6EAAyE;AACzE,oEAAgE;AAChE,4FAAsF;AACtF,8DAA0D;AAC1D,oEAAgE;AAChE,oDAA+D;AAC/D,2GAAsG;AAc/F,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAZ5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,8BAAa;YACb,kCAAe;YACf,iCAAsB;YACtB,+CAAqB;YACrB,0DAA0B;SAC3B;QACD,WAAW,EAAE,CAAC,0CAAmB,CAAC;QAClC,SAAS,EAAE,CAAC,oCAAgB,CAAC;QAC7B,OAAO,EAAE,CAAC,oCAAgB,EAAE,0DAA0B,CAAC;KACxD,CAAC;GACW,gBAAgB,CAAG"}
+{"version":3,"file":"core-normal.module.js","sourceRoot":"","sources":["../../../src/modules/core/core-normal.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,6EAAyE;AACzE,oEAAgE;AAChE,8DAA0D;AAC1D,oEAAgE;AAChE,oDAA+D;AAC/D,2GAAsG;AAQ/F,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAN5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,8BAAa,EAAE,kCAAe,EAAE,iCAAsB,EAAE,+CAAqB,CAAC;QACxF,WAAW,EAAE,CAAC,0CAAmB,CAAC;QAClC,SAAS,EAAE,CAAC,oCAAgB,CAAC;QAC7B,OAAO,EAAE,CAAC,oCAAgB,CAAC;KAC5B,CAAC;GACW,gBAAgB,CAAG"}