ftown 0.19.51 → 0.19.53

package/dist/security/bridge/audit.d.ts

@@ -0,0 +1,37 @@
+import type { SecurityEvent, SecurityEventStatus, SecurityPage, SecurityPageQuery } from '../protocol.js';
+export interface AuditAdmission {
+    admissionId: string;
+    actionId: string;
+    parentActionId: string | null;
+    clientId: string | null;
+    grantId: string | null;
+    endpointId: string | null;
+    tool: string;
+    operation: string | null;
+    sessionId: string | null;
+    mutating: boolean;
+}
+export interface AuditOptions {
+    now?: () => number;
+    maxEvents?: number;
+}
+/** Durable received-operation evidence. Only fixed, bounded metadata is ever serialized. */
+export declare class BridgeAuditStore {
+    readonly ownerId: string;
+    readonly bridgeId: string;
+    private readonly snapshot;
+    private readonly now;
+    private readonly maxEvents;
+    private ready?;
+    constructor(dataDir: string, ownerId: string, bridgeId: string, options?: AuditOptions);
+    private check;
+    private prune;
+    initialize(): Promise<void>;
+    admit(input: AuditAdmission): Promise<{
+        event: SecurityEvent;
+        isNew: boolean;
+    }>;
+    finish(id: string, status: Exclude<SecurityEventStatus, 'started'>, errorCode?: string | null): Promise<SecurityEvent>;
+    list(query?: SecurityPageQuery): Promise<SecurityPage>;
+    close(): Promise<void>;
+}

package/dist/security/bridge/audit.js

@@ -0,0 +1,185 @@
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { BridgeSecurityError } from './errors.js';
+import { boundedId } from './metadata.js';
+import { AtomicSnapshot } from './snapshot.js';
+const DAY = 86_400_000;
+const knownTools = new Set(['sessions_create', 'sessions_get', 'sessions_update', 'sessions_stop', 'sessions_retry', 'sessions_remove',
+    'sessions_revive', 'sessions_usage', 'sessions_running', 'chats_read', 'chats_search', 'messages_send', 'messages_read',
+    'terminal_input', 'terminal_resize', 'terminal_clear', 'whoami', 'attention_request', 'attention_inbox', 'attention_wait',
+    'attention_ack', 'attention_resolve', 'fleet_overview', 'machines_list', 'sessions_list', 'archive_list', 'messages_broadcast',
+    'sessions_wait', 'fleet_batch', 'chats_search_fleet', 'unknown_tool', 'invalid_tool']);
+const safeCodes = new Set(['security_setup_required', 'storage_unavailable', 'upgrade_required', 'approval_required', 'endpoint_revoked',
+    'invalid_envelope', 'authentication_failed', 'wrong_context', 'expired', 'replayed', 'epoch_changed', 'permission_denied',
+    'capacity_exceeded', 'audit_unavailable', 'outcome_unknown', 'bridge_offline', 'invalid_cursor', 'key_unavailable',
+    'unknown_session', 'unknown_attention', 'attention_storage_error', 'cancelled', 'attention_not_ready', 'timeout', 'connection_error',
+    'bridge_error', 'response_too_large', 'internal_error', 'interrupted']);
+const safeOperation = /^[a-z][a-z0-9_]{0,63}$/;
+const eventSchema = z.object({ version: z.literal(1), id: z.string().uuid(), actionId: boundedId, parentActionId: boundedId.nullable(),
+    ownerId: z.string().min(1).max(200), source: z.literal('bridge'), bridgeId: boundedId, clientId: boundedId.nullable(),
+    grantId: boundedId.nullable(), endpointId: boundedId.nullable(), tool: z.string().max(64), operation: z.string().max(64).nullable(),
+    sessionId: boundedId.nullable(), startedAt: z.string().datetime(), finishedAt: z.string().datetime().nullable(),
+    status: z.enum(['started', 'succeeded', 'rejected', 'failed', 'unknown']), errorCode: z.string().max(64).nullable(), mutating: z.boolean() }).strict();
+const stateSchema = z.object({ version: z.literal(1), ownerId: z.string(), bridgeId: z.string(), epoch: z.string().uuid(),
+    sequence: z.number().int().nonnegative(), prunedThrough: z.number().int().nonnegative(), pruning: z.number().int().nonnegative().optional(), truncated: z.boolean(),
+    entries: z.array(z.object({ sequence: z.number().int().positive(), admissionId: boundedId, event: eventSchema }).strict()).max(10000) }).strict();
+const cursorSchema = z.object({ v: z.literal(1), ownerId: z.string(), bridgeId: z.string(), epoch: z.string().uuid(),
+    snapshot: z.number().int().nonnegative(), before: z.number().int().positive(), pruning: z.number().int().nonnegative().default(0) }).strict();
+/** Durable received-operation evidence. Only fixed, bounded metadata is ever serialized. */
+export class BridgeAuditStore {
+    ownerId;
+    bridgeId;
+    snapshot;
+    now;
+    maxEvents;
+    ready;
+    constructor(dataDir, ownerId, bridgeId, options = {}) {
+        this.ownerId = ownerId;
+        this.bridgeId = bridgeId;
+        this.now = options.now ?? Date.now;
+        this.maxEvents = options.maxEvents ?? 10000;
+        if (!Number.isInteger(this.maxEvents) || this.maxEvents < 1 || this.maxEvents > 10000)
+            throw new BridgeSecurityError('capacity_exceeded');
+        this.snapshot = new AtomicSnapshot(join(dataDir, 'security', 'activity.json'), stateSchema, () => ({
+            version: 1, ownerId, bridgeId, epoch: randomUUID(), sequence: 0, prunedThrough: 0, pruning: 0, truncated: false, entries: [],
+        }));
+    }
+    check(state) {
+        if (state.ownerId !== this.ownerId || state.bridgeId !== this.bridgeId)
+            throw new BridgeSecurityError('wrong_context');
+        state.pruning ??= 0;
+    }
+    prune(state, reserve = 0) {
+        const cutoff = this.now() - 30 * DAY;
+        const retained = state.entries.filter(entry => entry.event.status === 'started' || Date.parse(entry.event.startedAt) >= cutoff);
+        const removed = state.entries.filter(entry => entry.event.status !== 'started' && Date.parse(entry.event.startedAt) < cutoff);
+        while (retained.length + reserve > this.maxEvents) {
+            const finished = retained.findIndex(entry => entry.event.status !== 'started');
+            if (finished < 0)
+                throw new BridgeSecurityError('audit_unavailable');
+            removed.push(...retained.splice(finished, 1));
+        }
+        if (removed.length) {
+            state.prunedThrough = Math.max(state.prunedThrough, ...removed.map(entry => entry.sequence));
+            state.pruning = (state.pruning ?? 0) + 1;
+            state.truncated = true;
+        }
+        state.entries = retained;
+    }
+    async initialize() {
+        if (!this.ready)
+            this.ready = this.snapshot.transact(state => {
+                this.check(state);
+                for (const entry of state.entries)
+                    if (entry.event.status === 'started') {
+                        entry.event.status = 'unknown';
+                        entry.event.finishedAt = new Date(this.now()).toISOString();
+                        entry.event.errorCode = 'interrupted';
+                    }
+                this.prune(state);
+            }).catch(() => { throw new BridgeSecurityError('audit_unavailable'); });
+        await this.ready;
+    }
+    async admit(input) {
+        await this.initialize();
+        const timestamp = new Date(this.now()).toISOString();
+        let event;
+        try {
+            boundedId.parse(input.admissionId);
+            event = eventSchema.parse({ version: 1, id: randomUUID(), actionId: input.actionId, parentActionId: input.parentActionId,
+                ownerId: this.ownerId, source: 'bridge', bridgeId: this.bridgeId, clientId: input.clientId, grantId: input.grantId,
+                endpointId: input.endpointId, tool: knownTools.has(input.tool) ? input.tool : 'invalid_tool',
+                operation: input.operation !== null && safeOperation.test(input.operation) ? input.operation : null,
+                sessionId: input.sessionId, startedAt: timestamp, finishedAt: null, status: 'started', errorCode: null, mutating: input.mutating });
+        }
+        catch {
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+        try {
+            return await this.snapshot.transact(state => {
+                this.check(state);
+                this.prune(state);
+                const previous = state.entries.find(entry => entry.admissionId === input.admissionId);
+                if (previous) {
+                    const prior = previous.event;
+                    if (prior.actionId !== event.actionId || prior.endpointId !== event.endpointId || prior.operation !== event.operation
+                        || prior.tool !== event.tool || prior.sessionId !== event.sessionId || prior.mutating !== event.mutating
+                        || prior.grantId !== event.grantId || prior.clientId !== event.clientId || prior.parentActionId !== event.parentActionId) {
+                        throw new BridgeSecurityError('replayed');
+                    }
+                    return { event: prior, isNew: false };
+                }
+                this.prune(state, 1);
+                state.entries.push({ admissionId: input.admissionId, sequence: ++state.sequence, event });
+                return { event, isNew: true };
+            });
+        }
+        catch (error) {
+            if (error instanceof BridgeSecurityError && error.code === 'replayed')
+                throw error;
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+    }
+    async finish(id, status, errorCode = null) {
+        await this.initialize();
+        try {
+            return await this.snapshot.transact(state => {
+                this.check(state);
+                const entry = state.entries.find(item => item.event.id === id);
+                if (!entry)
+                    throw new BridgeSecurityError('audit_unavailable');
+                if (entry.event.status !== 'started')
+                    return entry.event;
+                entry.event.status = status;
+                entry.event.finishedAt = new Date(this.now()).toISOString();
+                entry.event.errorCode = errorCode === null ? null : safeCodes.has(errorCode) ? errorCode : 'internal_error';
+                return entry.event;
+            });
+        }
+        catch {
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+    }
+    async list(query = {}) {
+        await this.initialize();
+        if (query.bridgeId !== undefined && query.bridgeId !== this.bridgeId)
+            throw new BridgeSecurityError('wrong_context');
+        const limit = query.limit ?? 50;
+        if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+            throw new BridgeSecurityError('invalid_cursor');
+        let incoming;
+        if (query.cursor !== undefined) {
+            try {
+                if (query.cursor.length > 2000 || !/^[A-Za-z0-9_-]+$/.test(query.cursor))
+                    throw new Error('Invalid cursor');
+                incoming = cursorSchema.parse(JSON.parse(Buffer.from(query.cursor, 'base64url').toString('utf8')));
+                if (incoming.ownerId !== this.ownerId || incoming.bridgeId !== this.bridgeId || incoming.before > incoming.snapshot + 1)
+                    throw new Error('Wrong cursor context');
+            }
+            catch {
+                throw new BridgeSecurityError('invalid_cursor');
+            }
+        }
+        try {
+            return await this.snapshot.transact(state => {
+                this.check(state);
+                this.prune(state);
+                const reset = !!incoming && (incoming.epoch !== state.epoch || incoming.snapshot > state.sequence || incoming.pruning !== state.pruning);
+                const snapshot = incoming && !reset ? incoming.snapshot : state.sequence;
+                const before = incoming && !reset ? incoming.before : snapshot + 1;
+                const eligible = state.entries.filter(entry => entry.sequence <= snapshot && entry.sequence < before).reverse();
+                const page = eligible.slice(0, limit);
+                const nextCursor = eligible.length > page.length && page.length > 0 ? Buffer.from(JSON.stringify({ v: 1,
+                    ownerId: this.ownerId, bridgeId: this.bridgeId, epoch: state.epoch, snapshot, before: page.at(-1).sequence, pruning: state.pruning })).toString('base64url') : null;
+                return { events: page.map(entry => entry.event), nextCursor, retentionDays: 30, maxEvents: 10000,
+                    oldestAvailableAt: state.entries[0]?.event.startedAt ?? null, truncated: state.truncated, reset };
+            });
+        }
+        catch {
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+    }
+    async close() { await this.ready; await this.snapshot.close(); }
+}
+//# sourceMappingURL=audit.js.map

package/dist/security/bridge/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/security/bridge/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB;IACpI,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe;IACvH,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB;IACzH,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,oBAAoB;IAC9H,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB;IACtI,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB;IACzH,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB;IAClH,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,WAAW,EAAE,qBAAqB,EAAE,SAAS,EAAE,kBAAkB;IACpI,cAAc,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,QAAQ,EAAE;IACpI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;IACrH,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnI,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/G,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzJ,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACvH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACnK,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEpJ,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAClH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAQhJ,4FAA4F;AAC5F,MAAM,OAAO,gBAAgB;IAKW;IAA0B;IAJ/C,QAAQ,CAAwB;IAChC,GAAG,CAAe;IAClB,SAAS,CAAS;IAC3B,KAAK,CAAiB;IAC9B,YAAY,OAAe,EAAW,OAAe,EAAW,QAAgB,EAAE,UAAwB,EAAE;QAAtE,YAAO,GAAP,OAAO,CAAQ;QAAW,aAAQ,GAAR,QAAQ,CAAQ;QAC9E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC1I,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;SAC7H,CAAC,CAAC,CAAC;IACN,CAAC;IACO,KAAK,CAAC,KAAY;QACxB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;IACtB,CAAC;IACO,KAAK,CAAC,KAAY,EAAE,OAAO,GAAG,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC;QAChI,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC;QAC9H,OAAO,QAAQ,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAC/E,IAAI,QAAQ,GAAG,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7F,KAAK,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACzC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC3D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO;oBAAE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBACxE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;wBAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;wBAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,aAAa,CAAC;oBACrI,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,KAAqB;QAC/B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,KAAkC,CAAC;QACvC,IAAI,CAAC;YACH,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;gBACtH,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;gBAClH,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;gBAC5F,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;gBACnG,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxI,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAAC,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;gBACtF,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;oBAC7B,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;2BAChH,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;2BACrG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;wBAC3H,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;oBAC5C,CAAC;oBACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBACxC,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,KAAK,CAAC;YACnF,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAA+C,EAAE,YAA2B,IAAI;QACvG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBAC/D,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;gBACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;gBAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzF,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC5G,OAAO,KAAK,CAAC,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAA2B,EAAE;QACtC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC1G,IAAI,QAAkD,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC5G,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnG,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACnK,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;gBACzI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzE,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;gBAChH,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBACrG,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvK,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK;oBAC9F,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YACtG,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAChF"}

package/dist/security/bridge/direct.d.ts

@@ -0,0 +1,22 @@
+import type { DirectMessage } from '../../direct-transport/contract.js';
+import type { InboundTransportContext } from '../protocol.js';
+import { BridgeSecurityService } from './security.js';
+/** Serial crypto at the peer boundary; application frames never escape as plaintext. */
+export declare class EncryptedPeerChannel {
+    private readonly security;
+    private readonly route;
+    private readonly wireSend;
+    private readonly deliver;
+    private readonly authorized;
+    private readonly teardown;
+    private inbound;
+    private outbound;
+    private endpointId;
+    private closed;
+    private readonly stopRevocation;
+    constructor(security: BridgeSecurityService, route: InboundTransportContext, wireSend: (json: string) => void, deliver: (frame: DirectMessage) => void, authorized: () => void, teardown: () => void);
+    receive(json: string): Promise<void>;
+    send(frame: DirectMessage): void;
+    drain(): Promise<void>;
+    close(): void;
+}

package/dist/security/bridge/direct.js

@@ -0,0 +1,72 @@
+import { parseSecureEnvelope } from '../crypto.js';
+import { applicationJson } from './security.js';
+/** Serial crypto at the peer boundary; application frames never escape as plaintext. */
+export class EncryptedPeerChannel {
+    security;
+    route;
+    wireSend;
+    deliver;
+    authorized;
+    teardown;
+    inbound = Promise.resolve();
+    outbound = Promise.resolve();
+    endpointId = null;
+    closed = false;
+    stopRevocation;
+    constructor(security, route, wireSend, deliver, authorized, teardown) {
+        this.security = security;
+        this.route = route;
+        this.wireSend = wireSend;
+        this.deliver = deliver;
+        this.authorized = authorized;
+        this.teardown = teardown;
+        this.stopRevocation = security.onRevoked(id => { if (id === this.endpointId)
+            this.teardown(); });
+    }
+    receive(json) {
+        this.inbound = this.inbound.then(async () => {
+            if (this.closed)
+                return;
+            const packet = parseSecureEnvelope(JSON.parse(json));
+            if (packet.purpose === 'hello') {
+                if (this.endpointId && this.endpointId !== packet.senderId)
+                    throw new Error('Wrong peer');
+                const response = await this.security.handleHandshake(packet, this.route);
+                // A pending MCP hello is harmless but cannot open an application data channel.
+                await this.security.policy.principal(packet.senderId);
+                this.endpointId = packet.senderId;
+                this.wireSend(JSON.stringify(response));
+                this.authorized();
+                return;
+            }
+            if (!this.endpointId || packet.senderId !== this.endpointId)
+                throw new Error('Unpaired peer');
+            const verified = await this.security.acceptApplication(packet, this.route);
+            if (verified.application.route.kind !== 'terminal')
+                throw new Error('Invalid direct application route');
+            await this.security.revalidate(verified.principal);
+            this.deliver(verified.application.data);
+            await this.security.complete(verified, 'succeeded');
+            await this.outbound;
+        }).catch(() => { this.teardown(); });
+        return this.inbound;
+    }
+    send(frame) {
+        this.outbound = this.outbound.then(async () => {
+            if (this.closed || !this.endpointId)
+                return;
+            const envelope = await this.security.sealTo(this.endpointId, { type: 'application', route: { kind: 'terminal',
+                    sessionId: 'sessionId' in frame ? frame.sessionId : '', frameType: frame.kind, pairId: this.route.pairId },
+                data: applicationJson(frame), mcp: null }, this.route);
+            if (!this.closed) {
+                try {
+                    this.wireSend(JSON.stringify(envelope));
+                }
+                catch { /* Native send failure drops only this frame; keepalive detects dead peers. */ }
+            }
+        }).catch(() => { this.teardown(); });
+    }
+    async drain() { await this.inbound; await this.outbound; }
+    close() { this.closed = true; this.stopRevocation(); }
+}
+//# sourceMappingURL=direct.js.map

package/dist/security/bridge/direct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct.js","sourceRoot":"","sources":["../../../src/security/bridge/direct.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAyB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,wFAAwF;AACxF,MAAM,OAAO,oBAAoB;IAMF;IAAkD;IAC5D;IAAmD;IACnD;IAAyC;IAPpD,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,QAAQ,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,UAAU,GAAkB,IAAI,CAAC;IACjC,MAAM,GAAG,KAAK,CAAC;IACN,cAAc,CAAa;IAC5C,YAA6B,QAA+B,EAAmB,KAA8B,EAC1F,QAAgC,EAAmB,OAAuC,EAC1F,UAAsB,EAAmB,QAAoB;QAFnD,aAAQ,GAAR,QAAQ,CAAuB;QAAmB,UAAK,GAAL,KAAK,CAAyB;QAC1F,aAAQ,GAAR,QAAQ,CAAwB;QAAmB,YAAO,GAAP,OAAO,CAAgC;QAC1F,eAAU,GAAV,UAAU,CAAY;QAAmB,aAAQ,GAAR,QAAQ,CAAY;QAC9E,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,IAAY;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzE,+EAA+E;gBAC/E,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACtD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAgC,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,KAAoB;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU;oBAC3G,SAAS,EAAE,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAC1G,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC;oBAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,8EAA8E,CAAC,CAAC;YAC3I,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,KAAK,KAAW,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;CAC7D"}

package/dist/security/bridge/errors.d.ts

@@ -0,0 +1,7 @@
+import type { SecurityErrorCode, SecurityFailure } from '../protocol.js';
+/** Messages are deliberately fixed: underlying storage/crypto exceptions never cross this boundary. */
+export declare class BridgeSecurityError extends Error implements SecurityFailure {
+    readonly code: SecurityErrorCode;
+    readonly retryable: boolean;
+    constructor(code: SecurityErrorCode);
+}

package/dist/security/bridge/errors.js

@@ -0,0 +1,12 @@
+/** Messages are deliberately fixed: underlying storage/crypto exceptions never cross this boundary. */
+export class BridgeSecurityError extends Error {
+    code;
+    retryable;
+    constructor(code) {
+        super(`Bridge security: ${code}`);
+        this.code = code;
+        this.name = 'BridgeSecurityError';
+        this.retryable = code === 'storage_unavailable' || code === 'audit_unavailable';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/security/bridge/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/security/bridge/errors.ts"],"names":[],"mappings":"AAEA,uGAAuG;AACvG,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEvB;IADZ,SAAS,CAAU;IAC5B,YAAqB,IAAuB;QAC1C,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QADf,SAAI,GAAJ,IAAI,CAAmB;QAE1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,mBAAmB,CAAC;IAClF,CAAC;CACF"}

package/dist/security/bridge/execute.d.ts

@@ -0,0 +1,3 @@
+import type { ApplicationJson, EnrollmentPacket, InboundTransportContext, SecureEnvelope, VerifiedApplication } from '../protocol.js';
+import { BridgeSecurityService } from './security.js';
+export declare function executeSecurePacket(security: BridgeSecurityService, packet: SecureEnvelope | EnrollmentPacket, route: InboundTransportContext, dispatch: (message: VerifiedApplication) => Promise<ApplicationJson>, admission?: (accept: () => Promise<VerifiedApplication>) => Promise<VerifiedApplication>): Promise<SecureEnvelope>;

package/dist/security/bridge/execute.js

@@ -0,0 +1,37 @@
+import { BridgeSecurityError } from './errors.js';
+export async function executeSecurePacket(security, packet, route, dispatch, admission) {
+    if (packet.type === 'ftown_enrollment' || packet.purpose !== 'application')
+        return security.handleHandshake(packet, route);
+    let verified;
+    let dispatchStarted = false;
+    try {
+        verified = await (admission ? admission(() => security.acceptApplication(packet, route)) : security.acceptApplication(packet, route));
+        const activation = verified.application.route.kind === 'command' && verified.application.route.command === 'security_activate_mcp';
+        if (!activation)
+            await security.revalidate(verified.principal);
+        const selfRevocation = await security.revokeSelfWithReceipt(verified, route);
+        if (selfRevocation)
+            return selfRevocation;
+        dispatchStarted = true;
+        const data = await dispatch(verified);
+        const result = data && typeof data === 'object' && !Array.isArray(data) ? data : null;
+        const response = result?.response && typeof result.response === 'object' && !Array.isArray(result.response) ? result.response : null;
+        const body = result?.body && typeof result.body === 'object' && !Array.isArray(result.body) ? result.body : null;
+        const failedHttp = typeof result?.status === 'number' && result.status >= 400;
+        const unknown = body?.outcomeUnknown === true;
+        await security.complete(verified, unknown ? 'unknown' : failedHttp || response?.success === false ? 'rejected' : 'succeeded', failedHttp ? typeof body?.code === 'string' ? body.code : 'bridge_error' : response?.success === false ? 'bridge_error' : null);
+        return security.sealTo(packet.senderId, { type: 'application', route: { kind: 'response', requestId: packet.messageId }, data, mcp: null }, route);
+    }
+    catch (error) {
+        // Never authenticate an error on behalf of an unauthenticated/tampered packet.
+        if (!verified && (!(error instanceof BridgeSecurityError)
+            || !['permission_denied', 'epoch_changed', 'expired', 'replayed', 'capacity_exceeded', 'audit_unavailable'].includes(error.code)))
+            throw error;
+        const code = error instanceof BridgeSecurityError ? error.code : dispatchStarted ? 'outcome_unknown' : 'permission_denied';
+        if (verified)
+            await security.complete(verified, dispatchStarted ? 'unknown' : 'rejected', code).catch(() => undefined);
+        return security.sealTo(packet.senderId, { type: 'application', route: { kind: 'response', requestId: packet.messageId },
+            data: { status: dispatchStarted ? 500 : 403, body: { error: code, code, outcomeUnknown: dispatchStarted } }, mcp: null }, route);
+    }
+}
+//# sourceMappingURL=execute.js.map

package/dist/security/bridge/execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../../src/security/bridge/execute.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAA+B,EAAE,MAAyC,EAClH,KAA8B,EAAE,QAAoE,EACpG,SAAwF;IACxF,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa;QAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3H,IAAI,QAAyC,CAAC;IAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACtI,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,uBAAuB,CAAC;QACnI,IAAI,CAAC,UAAU;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7E,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACrI,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACjH,MAAM,UAAU,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;QAC9C,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAC1H,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClI,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACrJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;eACpD,CAAC,CAAC,mBAAmB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,KAAK,CAAC;QACjJ,MAAM,IAAI,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAC3H,IAAI,QAAQ;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvH,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;YACrH,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACrI,CAAC;AACH,CAAC"}

package/dist/security/bridge/identity.d.ts

@@ -0,0 +1,5 @@
+import type { EndpointIdentity, EndpointKind } from '../protocol.js';
+/** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
+export declare function loadOrCreateIdentity(dataDir: string, ownerId: string, kind: 'bridge' | 'local-cli'): Promise<EndpointIdentity>;
+export declare function isLocalIdentityKind(kind: EndpointKind): kind is 'bridge' | 'local-cli';
+export declare function loadLocalIdentity(dataDir: string, ownerId: string): Promise<EndpointIdentity>;

package/dist/security/bridge/identity.js

@@ -0,0 +1,42 @@
+import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import { generateEndpoint, importEndpoint } from '../crypto.js';
+import { endpointSchema } from './metadata.js';
+import { AtomicSnapshot } from './snapshot.js';
+import { BridgeSecurityError } from './errors.js';
+const recordSchema = z.object({ version: z.literal(1), endpoint: endpointSchema, privateKey: z.object({
+        kty: z.literal('EC'), crv: z.literal('P-256'), x: z.string(), y: z.string(), d: z.string(),
+        key_ops: z.array(z.string()).optional(), ext: z.boolean().optional(),
+    }).strict() }).strict();
+/** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
+export async function loadOrCreateIdentity(dataDir, ownerId, kind) {
+    const generated = await generateEndpoint(ownerId, kind, true);
+    const jwk = await crypto.subtle.exportKey('jwk', generated.keyPair.privateKey);
+    const initial = recordSchema.parse({ version: 1, endpoint: generated.endpoint, privateKey: jwk });
+    const store = new AtomicSnapshot(join(dataDir, 'security', `${kind}-identity.json`), recordSchema, () => initial);
+    const saved = await store.transact(state => {
+        if (state.endpoint.ownerId !== ownerId || state.endpoint.kind !== kind)
+            throw new BridgeSecurityError('wrong_context');
+        return state;
+    });
+    try {
+        return await importEndpoint(saved.endpoint, saved.privateKey, false);
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+}
+export function isLocalIdentityKind(kind) { return kind === 'bridge' || kind === 'local-cli'; }
+export async function loadLocalIdentity(dataDir, ownerId) {
+    try {
+        const saved = recordSchema.parse(JSON.parse(await readFile(join(dataDir, 'security', 'local-cli-identity.json'), 'utf8')));
+        if (saved.endpoint.ownerId !== ownerId || saved.endpoint.kind !== 'local-cli')
+            throw new Error('Wrong local key');
+        return await importEndpoint(saved.endpoint, saved.privateKey, false);
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/security/bridge/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/security/bridge/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAExB,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,IAA4B;IACvG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAkB,IAAoC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;AAE7I,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAe;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3H,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClH,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC"}

package/dist/security/bridge/local-client.d.ts

@@ -0,0 +1,4 @@
+import type { BridgePointer } from '../../wire-types.js';
+import type { ApplicationJson, SecureApplication } from '../protocol.js';
+/** OS-local clients pin bridge metadata from the owner-only pointer, never remote discovery. */
+export declare function localApplication(pointer: BridgePointer, application: SecureApplication, signal?: AbortSignal, fetchFn?: typeof fetch): Promise<ApplicationJson>;

package/dist/security/bridge/local-client.js

@@ -0,0 +1,43 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { open, parseSecureEnvelope, seal } from '../crypto.js';
+import { loadLocalIdentity } from './identity.js';
+import { BridgeSecurityError } from './errors.js';
+/** OS-local clients pin bridge metadata from the owner-only pointer, never remote discovery. */
+export async function localApplication(pointer, application, signal, fetchFn = fetch) {
+    if (!pointer.dataDir || !pointer.ownerId || !pointer.endpoint || !pointer.bridgeId)
+        throw new BridgeSecurityError('upgrade_required');
+    const bridge = pointer.endpoint;
+    if (bridge.kind !== 'bridge' || bridge.ownerId !== pointer.ownerId)
+        throw new BridgeSecurityError('wrong_context');
+    const identity = await loadLocalIdentity(pointer.dataDir, pointer.ownerId);
+    const channel = `local-http:${pointer.bridgeId}`;
+    const requestId = application.route.kind === 'command' || application.route.kind === 'http' || application.route.kind === 'response'
+        ? application.route.requestId : randomUUID();
+    const post = async (purpose, body, epoch, messageId) => {
+        const createdAt = Date.now();
+        const packet = await seal(identity, bridge, { type: 'ftown_encrypted', version: 1, senderId: identity.endpoint.id,
+            recipientId: bridge.id, ownerId: pointer.ownerId, bridgeId: pointer.bridgeId, channel, purpose, messageId,
+            createdAt, expiresAt: createdAt + 120000, receiverEpoch: epoch }, new TextEncoder().encode(JSON.stringify(body)));
+        const response = await fetchFn(`http://127.0.0.1:${pointer.port}/api/security/envelope`, { method: 'POST',
+            headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(packet), redirect: 'error',
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(65000)]) : AbortSignal.timeout(65000) });
+        if (!response.ok)
+            throw new BridgeSecurityError('bridge_offline');
+        const envelope = parseSecureEnvelope(await response.json());
+        if (envelope.messageId !== messageId)
+            throw new BridgeSecurityError('wrong_context');
+        const bytes = await open(identity, bridge, envelope, { ownerId: pointer.ownerId, bridgeId: pointer.bridgeId, channel,
+            recipientId: identity.endpoint.id, purpose: purpose === 'hello' ? 'welcome' : 'application' });
+        if (envelope.expiresAt <= Date.now() || envelope.createdAt > Date.now() + 30000)
+            throw new BridgeSecurityError('expired');
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    };
+    const challenge = randomUUID();
+    const hello = z.object({ type: z.literal('welcome'), challenge: z.literal(challenge), receiverEpoch: z.string().min(1).max(128) }).strict()
+        .parse(await post('hello', { type: 'hello', challenge }, null, randomUUID()));
+    const result = z.object({ type: z.literal('application'), route: z.object({ kind: z.literal('response'), requestId: z.literal(requestId) }).strict(),
+        data: z.unknown(), mcp: z.null() }).strict().parse(await post('application', application, hello.receiverEpoch, requestId));
+    return result.data;
+}
+//# sourceMappingURL=local-client.js.map

package/dist/security/bridge/local-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-client.js","sourceRoot":"","sources":["../../../src/security/bridge/local-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAsB,EAAE,WAA8B,EAAE,MAAoB,EACjH,UAAwB,KAAK;IAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IACtI,MAAM,MAAM,GAAmB,OAAO,CAAC,QAAQ,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACnH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;QAClI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgC,EAAE,IAAa,EAAE,KAAoB,EAAE,SAAiB,EAAE,EAAE;QAC9G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAC/G,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;YAC3G,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,wBAAwB,EAAE,EAAE,MAAM,EAAE,MAAM;YACvG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO;YAChG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAS,EAAE,OAAO;YACpH,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QACjG,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,CAAC;IACxF,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;SACxI,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAClJ,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7H,OAAO,MAAM,CAAC,IAAuB,CAAC;AACxC,CAAC"}