ftown 0.19.51 → 0.19.53

package/dist/security/bridge/metadata.d.ts

@@ -0,0 +1,99 @@
+import { z } from 'zod';
+export declare const boundedId: z.ZodString;
+export declare const endpointSchema: z.ZodEffects<z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    id: z.ZodString;
+    ownerId: z.ZodString;
+    kind: z.ZodEnum<["bridge", "browser", "mcp", "local-cli"]>;
+    publicKey: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}>, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}>;
+export declare const permissionSchema: z.ZodEnum<["read", "control", "admin"]>;
+export declare const approvedSchema: z.ZodObject<{
+    endpoint: z.ZodEffects<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        id: z.ZodString;
+        ownerId: z.ZodString;
+        kind: z.ZodEnum<["bridge", "browser", "mcp", "local-cli"]>;
+        publicKey: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }>, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }>;
+    label: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<["read", "control", "admin"]>, "many">;
+    approvedAt: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    expiresAt: string | null;
+    endpoint: {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    };
+    label: string;
+    permissions: ("read" | "control" | "admin")[];
+    approvedAt: string;
+    grantId: string | null;
+}, {
+    expiresAt: string | null;
+    endpoint: {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    };
+    label: string;
+    permissions: ("read" | "control" | "admin")[];
+    approvedAt: string;
+    grantId: string | null;
+}>;
+export declare function displayLabel(label: string): string;

package/dist/security/bridge/metadata.js

@@ -0,0 +1,23 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+export const boundedId = z.string().regex(/^[A-Za-z0-9_-]{1,200}$/);
+export const endpointSchema = z.object({
+    version: z.literal(1), id: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    ownerId: z.string().min(1).max(200), kind: z.enum(['bridge', 'browser', 'mcp', 'local-cli']),
+    publicKey: z.string().regex(/^[A-Za-z0-9_-]{87}$/),
+}).strict().superRefine((endpoint, context) => {
+    const raw = Buffer.from(endpoint.publicKey, 'base64url');
+    if (raw.length !== 65 || raw[0] !== 4 || raw.toString('base64url') !== endpoint.publicKey
+        || createHash('sha256').update(raw).digest('base64url') !== endpoint.id) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'Invalid endpoint fingerprint' });
+    }
+});
+export const permissionSchema = z.enum(['read', 'control', 'admin']);
+export const approvedSchema = z.object({
+    endpoint: endpointSchema, label: z.string().max(100), permissions: z.array(permissionSchema).max(3),
+    approvedAt: z.string().datetime(), grantId: boundedId.nullable(), expiresAt: z.string().datetime().nullable(),
+}).strict();
+export function displayLabel(label) {
+    return label.replace(/[\u0000-\u001f\u007f-\u009f]/g, '').trim().slice(0, 100);
+}
+//# sourceMappingURL=metadata.js.map

package/dist/security/bridge/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/security/bridge/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACnD,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,SAAS;WACpF,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9G,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjF,CAAC"}

package/dist/security/bridge/native-wake.d.ts

@@ -0,0 +1,16 @@
+import type { Session } from '../../types.js';
+/** Deliberate trusted-local-provider IPC: no application route, message body, consumption or prompt execution. */
+export declare function nativeWake(input: unknown, dependencies: {
+    getSession(id: string): Promise<Session | null>;
+    register(session: Session, registration: {
+        adapter: 'claude-mod';
+        nativeSessionId: string;
+    }): void;
+    unread(id: string): Promise<{
+        id: string;
+    }[]>;
+}): Promise<{
+    messages: {
+        id: string;
+    }[];
+}>;

package/dist/security/bridge/native-wake.js

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+import { BridgeSecurityError } from './errors.js';
+const payloadSchema = z.object({ hook_event_name: z.literal('FtownNativeWake'), ftown_session_id: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/),
+    session_id: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/), adapter: z.literal('claude-mod'), registerWake: z.boolean().optional() }).strict();
+/** Deliberate trusted-local-provider IPC: no application route, message body, consumption or prompt execution. */
+export async function nativeWake(input, dependencies) {
+    const payload = payloadSchema.parse(input);
+    const session = await dependencies.getSession(payload.ftown_session_id);
+    if (!session || session.claudeSessionId !== payload.session_id)
+        throw new BridgeSecurityError('wrong_context');
+    if (payload.registerWake !== false)
+        dependencies.register(session, { adapter: 'claude-mod', nativeSessionId: payload.session_id });
+    return { messages: (await dependencies.unread(session.id)).slice(0, 500).map(message => ({ id: message.id })) };
+}
+//# sourceMappingURL=native-wake.js.map

package/dist/security/bridge/native-wake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-wake.js","sourceRoot":"","sources":["../../../src/security/bridge/native-wake.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC1I,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAE7I,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAc,EAAE,YAIhD;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK;QAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnI,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AAClH,CAAC"}

package/dist/security/bridge/permissions.d.ts

@@ -0,0 +1,11 @@
+import type { ApplicationJson, EndpointPermission } from '../protocol.js';
+export interface OperationPermission {
+    permission: EndpointPermission;
+    mutating: boolean;
+    operation: string;
+    sessionId: string | null;
+}
+/** Deliberately semantic: GET inbox consumes mail unless explicitly non-consuming. */
+export declare function classifyHttp(method: string, path: string): OperationPermission;
+export declare function classifyCommand(command: string, payload?: ApplicationJson): OperationPermission;
+export declare function classifyTerminal(frameType: string): OperationPermission;

package/dist/security/bridge/permissions.js

@@ -0,0 +1,97 @@
+import { BridgeSecurityError } from './errors.js';
+const session = /^[A-Za-z0-9_-]+$/;
+const readCommands = new Set(['list_sessions', 'get_history', 'get_session_usage', 'get_sessions_usage', 'get_session_attention']);
+const controlCommands = new Set(['create_session', 'stop_session', 'retry_session', 'send_message', 'rename_session', 'remove_session',
+    'bridge_exec', 'clear_terminal', 'update_session_parent', 'resolve_session_attention']);
+const adminCommands = new Set(['security_devices', 'security_invite', 'security_revoke', 'security_approve_mcp', 'security_activity']);
+const result = (permission, operation, sessionId = null) => ({ permission, mutating: permission === 'control' || ['security_invite', 'security_revoke', 'security_approve_mcp'].includes(operation), operation, sessionId });
+const deny = () => { throw new BridgeSecurityError('permission_denied'); };
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+/** Deliberately semantic: GET inbox consumes mail unless explicitly non-consuming. */
+export function classifyHttp(method, path) {
+    if (path.length > 16_384 || !path.startsWith('/api/') || path.includes('#') || path.includes('\\') || path.split('?')[0].includes('%'))
+        return deny();
+    const url = new URL(path, 'http://bridge.invalid');
+    if (url.origin !== 'http://bridge.invalid' || url.pathname.split('/').some(part => part === '.' || part === '..')
+        || path.split('?')[0] !== url.pathname)
+        return deny();
+    if (url.pathname === '/api/sessions') {
+        if (method === 'GET')
+            return result('read', 'sessions_list');
+        if (method === 'POST')
+            return result('control', 'sessions_create');
+        return deny();
+    }
+    if (method === 'GET' && url.pathname === '/api/archive')
+        return result('read', 'archive_list');
+    if (method === 'GET' && url.pathname === '/api/inbox/resolve')
+        return result('read', 'inbox_resolve');
+    if (method === 'GET' && url.pathname === '/api/browser/events')
+        return result('read', 'local_events');
+    if (url.pathname === '/api/loops' || /^\/api\/loops\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)?$/.test(url.pathname)) {
+        if (!['GET', 'POST', 'PATCH', 'DELETE'].includes(method))
+            return deny();
+        return { permission: method === 'GET' ? 'read' : 'control', mutating: false, operation: 'automation_removed', sessionId: null };
+    }
+    const match = /^\/api\/sessions\/([A-Za-z0-9_-]+)(?:\/(screen|grep|keys|message|inbox|resize|usage|running|revive|stop|retry|attention)(?:\/(ack|resolve))?)?$/.exec(url.pathname);
+    if (!match)
+        return deny();
+    const [, id, suffix, attentionAction] = match;
+    if (attentionAction && suffix !== 'attention')
+        return deny();
+    if (!suffix) {
+        if (method === 'GET')
+            return result('read', 'sessions_get', id);
+        if (method === 'PATCH')
+            return result('control', 'sessions_update', id);
+        if (method === 'DELETE')
+            return result('control', 'sessions_remove', id);
+        return deny();
+    }
+    if (suffix === 'inbox' && method === 'GET') {
+        // Native wake registration mutates the delivery target even when peek=1.
+        const peek = url.searchParams.getAll('peek');
+        const readOnly = peek.length === 1 && peek[0] === '1'
+            && !url.searchParams.has('adapter') && !url.searchParams.has('nativeSessionId');
+        return result(readOnly ? 'read' : 'control', readOnly ? 'messages_peek' : 'messages_read', id);
+    }
+    if (method === 'GET' && ['screen', 'usage', 'running', 'attention'].includes(suffix) && !attentionAction)
+        return result('read', `${suffix}_get`, id);
+    if (method === 'POST' && suffix === 'grep' && !attentionAction)
+        return result('read', 'history_search', id);
+    if (method === 'POST' && ['keys', 'message', 'inbox', 'resize', 'revive', 'stop', 'retry', 'attention'].includes(suffix)) {
+        return result('control', attentionAction ? `attention_${attentionAction}` : `${suffix}_send`, id);
+    }
+    if (method === 'DELETE' && suffix === 'screen')
+        return result('control', 'screen_clear', id);
+    return deny();
+}
+export function classifyCommand(command, payload) {
+    const body = object(payload);
+    const sessionId = typeof body?.sessionId === 'string' && session.test(body.sessionId) ? body.sessionId : null;
+    if (command === 'mcp_request') {
+        const request = object(body?.request);
+        if (typeof request?.method !== 'string' || typeof request.path !== 'string')
+            return deny();
+        return classifyHttp(request.method, request.path);
+    }
+    if (readCommands.has(command))
+        return result('read', command, sessionId);
+    if (controlCommands.has(command))
+        return result('control', command, sessionId);
+    if (adminCommands.has(command))
+        return result('admin', command, sessionId);
+    if (command === 'terminal_watch' || command === 'terminal_unwatch' || command === 'webrtc_offer'
+        || command === 'webrtc_answer' || command === 'webrtc_ice' || command === 'webrtc_close')
+        return result('read', command, sessionId);
+    // Activation has a separate exact-pending-grant check; it is never granted by a generic permission.
+    return deny();
+}
+export function classifyTerminal(frameType) {
+    if (['attach', 'detach', 'init', 'ping', 'pong', 'hello'].includes(frameType))
+        return result('read', `terminal_${frameType}`);
+    if (frameType === 'input' || frameType === 'resize')
+        return result('control', `terminal_${frameType}`);
+    return deny();
+}
+//# sourceMappingURL=permissions.js.map

package/dist/security/bridge/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/security/bridge/permissions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACnI,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB;IACpI,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,CAAC,CAAC;AAC1F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACvI,MAAM,MAAM,GAAG,CAAC,UAA8B,EAAE,SAAiB,EAAE,YAA2B,IAAI,EAAuB,EAAE,CACzH,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;AACnK,MAAM,IAAI,GAAG,GAAU,EAAE,GAAG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,MAAM,MAAM,GAAG,CAAC,KAAkC,EAAkD,EAAE,CACpG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAE3F,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACtJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,uBAAuB,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;WAC5G,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,EAAE,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACnE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC/F,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtG,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtG,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9G,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClI,CAAC;IACD,MAAM,KAAK,GAAG,iJAAiJ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnL,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;IAC9C,IAAI,eAAe,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3C,yEAAyE;QACzE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;eAChD,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,EAAE,CAAC,CAAC;IACrJ,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC5G,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzH,OAAO,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,aAAa,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAAyB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAC;QAC3F,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,cAAc;WAC3F,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACtI,oGAAoG;IACpG,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IAC9H,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IACvG,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/security/bridge/policy.d.ts

@@ -0,0 +1,35 @@
+import type { ApprovedEndpoint, BridgeInvitation, EndpointPermission, EndpointPublic, EnrollmentMessage, InvitationOptions, LocalRecoveryAuthority, McpApproval, McpApprovalReceipt, VerifiedPrincipal } from '../protocol.js';
+/** Identity comparison matters: request JSON cannot manufacture this recovery capability. */
+export declare const LOCAL_RECOVERY_AUTHORITY: LocalRecoveryAuthority;
+export interface PolicyOptions {
+    now?: () => number;
+    relayUrl?: string;
+    localOrigin?: string;
+}
+/** Bridge-owned authorization. Directory entries and caller-claimed permissions never enter this store. */
+export declare class BridgePolicyStore {
+    readonly bridgeId: string;
+    readonly bridge: EndpointPublic;
+    private readonly options;
+    private readonly snapshot;
+    private readonly now;
+    constructor(dataDir: string, bridgeId: string, bridge: EndpointPublic, options?: PolicyOptions);
+    private check;
+    private active;
+    private principalFrom;
+    private authorize;
+    principal(endpointId: string, allowPendingHello?: boolean): Promise<VerifiedPrincipal>;
+    revalidate(actor: VerifiedPrincipal, permission?: EndpointPermission): Promise<void>;
+    createInvitation(actor: VerifiedPrincipal | LocalRecoveryAuthority, options: InvitationOptions): Promise<BridgeInvitation>;
+    consumeInvitation(message: EnrollmentMessage): Promise<ApprovedEndpoint>;
+    list(actor: VerifiedPrincipal): Promise<ApprovedEndpoint[]>;
+    recipients(): Promise<ApprovedEndpoint[]>;
+    approveMcp(actor: VerifiedPrincipal, approval: McpApproval): Promise<McpApprovalReceipt>;
+    activateMcp(actor: VerifiedPrincipal, grantId: string): Promise<{
+        grantId: string;
+        expiresAt: string;
+    }>;
+    revoke(actor: VerifiedPrincipal, endpointId: string): Promise<void>;
+    provisionLocalEndpoint(endpoint: EndpointPublic): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/security/bridge/policy.js

@@ -0,0 +1,263 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { BridgeSecurityError } from './errors.js';
+import { approvedSchema, boundedId, displayLabel, endpointSchema, permissionSchema } from './metadata.js';
+import { AtomicSnapshot } from './snapshot.js';
+const FIVE_MINUTES = 300_000;
+const THIRTY_DAYS = 30 * 86_400_000;
+const MAX_ENDPOINTS = 1000;
+const digest = (secret) => createHash('sha256').update(secret).digest('hex');
+const invitationSchema = z.object({ id: z.string().uuid(), secretHash: z.string().regex(/^[a-f0-9]{64}$/),
+    label: z.string().max(100), permissions: z.array(permissionSchema).max(3), expiresAt: z.string().datetime(),
+    consumedBy: z.string().nullable() }).strict();
+const pendingSchema = z.object({ approved: approvedSchema, approvalId: z.string().uuid(), requestId: boundedId,
+    expiresAt: z.string().datetime(), activeExpiresAt: z.string().datetime(), active: z.boolean() }).strict();
+const policySchema = z.object({ version: z.literal(1), ownerId: z.string(), bridgeId: z.string(), bridgeEndpointId: z.string(),
+    generation: z.number().int().nonnegative(), devices: z.array(approvedSchema).max(MAX_ENDPOINTS),
+    invitations: z.array(invitationSchema).max(256), mcp: z.array(pendingSchema).max(MAX_ENDPOINTS) }).strict().superRefine((state, context) => {
+    if (new Set(state.devices.map(device => device.endpoint.id)).size !== state.devices.length
+        || new Set(state.mcp.map(item => item.approved.grantId)).size !== state.mcp.length
+        || state.devices.some(device => device.endpoint.ownerId !== state.ownerId
+            || (device.endpoint.kind === 'mcp') !== (device.grantId !== null)
+            || new Set(device.permissions).size !== device.permissions.length)
+        || state.mcp.some(item => !state.devices.some(device => JSON.stringify(device) === JSON.stringify(item.approved)))) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'Invalid policy relationship' });
+    }
+});
+/** Identity comparison matters: request JSON cannot manufacture this recovery capability. */
+export const LOCAL_RECOVERY_AUTHORITY = Object.freeze({ source: 'os-local-recovery' });
+/** Bridge-owned authorization. Directory entries and caller-claimed permissions never enter this store. */
+export class BridgePolicyStore {
+    bridgeId;
+    bridge;
+    options;
+    snapshot;
+    now;
+    constructor(dataDir, bridgeId, bridge, options = {}) {
+        this.bridgeId = bridgeId;
+        this.bridge = bridge;
+        this.options = options;
+        endpointSchema.parse(bridge);
+        if (bridge.kind !== 'bridge')
+            throw new BridgeSecurityError('wrong_context');
+        this.now = options.now ?? Date.now;
+        this.snapshot = new AtomicSnapshot(join(dataDir, 'security', 'policy.json'), policySchema, () => ({
+            version: 1, ownerId: bridge.ownerId, bridgeId, bridgeEndpointId: bridge.id, generation: 0,
+            devices: [], invitations: [], mcp: [],
+        }));
+    }
+    check(state) {
+        if (state.ownerId !== this.bridge.ownerId || state.bridgeId !== this.bridgeId || state.bridgeEndpointId !== this.bridge.id) {
+            throw new BridgeSecurityError('wrong_context');
+        }
+    }
+    active(state, endpointId, pendingAllowed = false) {
+        this.check(state);
+        const record = state.devices.find(device => device.endpoint.id === endpointId);
+        if (!record)
+            throw new BridgeSecurityError('approval_required');
+        const pending = state.mcp.find(item => item.approved.endpoint.id === endpointId);
+        if (pending && !pending.active && (!pendingAllowed || Date.parse(pending.expiresAt) <= this.now())) {
+            throw new BridgeSecurityError(Date.parse(pending.expiresAt) <= this.now() ? 'expired' : 'approval_required');
+        }
+        if (record.expiresAt && Date.parse(record.expiresAt) <= this.now())
+            throw new BridgeSecurityError('expired');
+        return record;
+    }
+    principalFrom(state, record) {
+        const pending = state.mcp.find(item => item.approved.endpoint.id === record.endpoint.id);
+        return { endpoint: record.endpoint, bridgeId: this.bridgeId, permissions: pending && !pending.active ? [] : record.permissions,
+            policyGeneration: state.generation, grantId: record.grantId };
+    }
+    authorize(state, actor, permission) {
+        if (actor.bridgeId !== this.bridgeId || actor.endpoint.ownerId !== this.bridge.ownerId)
+            throw new BridgeSecurityError('wrong_context');
+        if (actor.policyGeneration !== state.generation)
+            throw new BridgeSecurityError('endpoint_revoked');
+        const record = this.active(state, actor.endpoint.id);
+        if (record.endpoint.publicKey !== actor.endpoint.publicKey || !record.permissions.includes(permission)) {
+            throw new BridgeSecurityError('permission_denied');
+        }
+        return record;
+    }
+    async principal(endpointId, allowPendingHello = false) {
+        return this.snapshot.read(state => this.principalFrom(state, this.active(state, endpointId, allowPendingHello)));
+    }
+    async revalidate(actor, permission) {
+        await this.snapshot.read(state => {
+            if (actor.bridgeId !== this.bridgeId || actor.endpoint.ownerId !== this.bridge.ownerId)
+                throw new BridgeSecurityError('wrong_context');
+            if (actor.policyGeneration !== state.generation)
+                throw new BridgeSecurityError('endpoint_revoked');
+            const record = this.active(state, actor.endpoint.id);
+            if (record.endpoint.publicKey !== actor.endpoint.publicKey || record.grantId !== actor.grantId)
+                throw new BridgeSecurityError('wrong_context');
+            if (permission && !record.permissions.includes(permission))
+                throw new BridgeSecurityError('permission_denied');
+        });
+    }
+    async createInvitation(actor, options) {
+        const secret = randomBytes(32).toString('base64url');
+        const invitationId = randomUUID();
+        const expiresAt = new Date(this.now() + FIVE_MINUTES).toISOString();
+        await this.snapshot.transact(state => {
+            this.check(state);
+            if (actor !== LOCAL_RECOVERY_AUTHORITY)
+                this.authorize(state, actor, 'admin');
+            state.invitations = state.invitations.filter(invitation => Date.parse(invitation.expiresAt) > this.now());
+            if (state.invitations.length >= 256)
+                throw new BridgeSecurityError('capacity_exceeded');
+            state.invitations.push({ id: invitationId, secretHash: digest(secret), label: displayLabel(options.label),
+                permissions: ['read', 'control', 'admin'], expiresAt, consumedBy: null });
+        });
+        return { version: 1, invitationId, ownerId: this.bridge.ownerId, bridgeId: this.bridgeId, bridge: this.bridge,
+            secret, expiresAt, relayUrl: this.options.relayUrl ?? null, localOrigin: this.options.localOrigin ?? null };
+    }
+    async consumeInvitation(message) {
+        let candidate;
+        try {
+            candidate = endpointSchema.parse(message.candidate);
+        }
+        catch {
+            throw new BridgeSecurityError('invitation_invalid');
+        }
+        if (candidate.ownerId !== this.bridge.ownerId || candidate.kind !== 'browser'
+            || !/^[A-Za-z0-9_-]{43}$/.test(message.invitationSecret))
+            throw new BridgeSecurityError('invitation_invalid');
+        return this.snapshot.transact(state => {
+            this.check(state);
+            const invitation = state.invitations.find(item => item.id === message.invitationId);
+            if (!invitation || !timingSafeEqual(Buffer.from(invitation.secretHash), Buffer.from(digest(message.invitationSecret)))) {
+                throw new BridgeSecurityError('invitation_invalid');
+            }
+            if (Date.parse(invitation.expiresAt) <= this.now())
+                throw new BridgeSecurityError('invitation_expired');
+            if (invitation.consumedBy) {
+                if (invitation.consumedBy !== candidate.id)
+                    throw new BridgeSecurityError('invitation_consumed');
+                // Lost enrollment acknowledgements may recover only the already approved exact identity.
+                return this.active(state, candidate.id);
+            }
+            if (state.devices.some(device => device.endpoint.id === candidate.id))
+                throw new BridgeSecurityError('invitation_invalid');
+            if (state.devices.length >= MAX_ENDPOINTS)
+                throw new BridgeSecurityError('capacity_exceeded');
+            const approved = { endpoint: candidate, label: displayLabel(message.label) || invitation.label,
+                permissions: [...invitation.permissions], approvedAt: new Date(this.now()).toISOString(), grantId: null, expiresAt: null };
+            invitation.consumedBy = candidate.id;
+            state.devices.push(approved);
+            state.generation++;
+            return approved;
+        });
+    }
+    async list(actor) {
+        return this.snapshot.read(state => { this.authorize(state, actor, 'admin'); return state.devices; });
+    }
+    async recipients() {
+        return this.snapshot.read(state => {
+            this.check(state);
+            return state.devices.filter(device => {
+                try {
+                    return this.active(state, device.endpoint.id).permissions.includes('read');
+                }
+                catch {
+                    return false;
+                }
+            });
+        });
+    }
+    async approveMcp(actor, approval) {
+        let endpoint;
+        try {
+            endpoint = endpointSchema.parse(approval.endpoint);
+            boundedId.parse(approval.requestId);
+            boundedId.parse(approval.grantId);
+        }
+        catch {
+            throw new BridgeSecurityError('wrong_context');
+        }
+        const expires = Date.parse(approval.expiresAt);
+        const activeExpires = Date.parse(approval.activeExpiresAt);
+        if (endpoint.kind !== 'mcp' || endpoint.ownerId !== this.bridge.ownerId
+            || !Number.isFinite(expires) || expires <= this.now() || expires > this.now() + FIVE_MINUTES
+            || !Number.isFinite(activeExpires) || activeExpires <= expires || activeExpires > this.now() + THIRTY_DAYS
+            || !approval.permissions.includes('read') || approval.permissions.some(permission => permission !== 'read' && permission !== 'control')
+            || new Set(approval.permissions).size !== approval.permissions.length)
+            throw new BridgeSecurityError('wrong_context');
+        return this.snapshot.transact(state => {
+            this.authorize(state, actor, 'admin');
+            const expired = new Set(state.mcp.filter(item => Date.parse(item.active ? item.activeExpiresAt : item.expiresAt) <= this.now())
+                .map(item => item.approved.endpoint.id));
+            state.devices = state.devices.filter(device => !expired.has(device.endpoint.id));
+            state.mcp = state.mcp.filter(item => !expired.has(item.approved.endpoint.id));
+            const existing = state.mcp.find(item => item.approved.endpoint.id === endpoint.id || item.approved.grantId === approval.grantId);
+            let pending;
+            if (existing) {
+                if (existing.approved.endpoint.id !== endpoint.id || existing.approved.grantId !== approval.grantId
+                    || existing.requestId !== approval.requestId || existing.expiresAt !== approval.expiresAt
+                    || existing.activeExpiresAt !== approval.activeExpiresAt
+                    || JSON.stringify(existing.approved.permissions) !== JSON.stringify(approval.permissions))
+                    throw new BridgeSecurityError('wrong_context');
+                pending = existing;
+            }
+            else {
+                if (state.devices.some(device => device.endpoint.id === endpoint.id))
+                    throw new BridgeSecurityError('wrong_context');
+                if (state.devices.length >= MAX_ENDPOINTS)
+                    throw new BridgeSecurityError('capacity_exceeded');
+                const approved = { endpoint, label: 'MCP client', permissions: [...approval.permissions],
+                    approvedAt: new Date(this.now()).toISOString(), grantId: approval.grantId, expiresAt: approval.activeExpiresAt };
+                pending = { approved, approvalId: randomUUID(), requestId: approval.requestId, expiresAt: approval.expiresAt,
+                    activeExpiresAt: approval.activeExpiresAt, active: false };
+                state.devices.push(approved);
+                state.mcp.push(pending);
+                state.generation++;
+            }
+            return { type: 'mcp-approval', approvalId: pending.approvalId, requestId: pending.requestId, ownerId: this.bridge.ownerId,
+                grantId: approval.grantId, candidateEndpointId: endpoint.id, bridgeId: this.bridgeId, bridge: this.bridge,
+                permissions: [...approval.permissions], expiresAt: pending.expiresAt, activeExpiresAt: pending.activeExpiresAt };
+        });
+    }
+    async activateMcp(actor, grantId) {
+        return this.snapshot.transact(state => {
+            const record = this.active(state, actor.endpoint.id, true);
+            if (actor.policyGeneration !== state.generation)
+                throw new BridgeSecurityError('endpoint_revoked');
+            const pending = state.mcp.find(item => item.approved.endpoint.id === actor.endpoint.id);
+            if (actor.bridgeId !== this.bridgeId || actor.endpoint.publicKey !== record.endpoint.publicKey || actor.endpoint.kind !== 'mcp'
+                || !pending || record.grantId !== grantId || actor.grantId !== grantId)
+                throw new BridgeSecurityError('permission_denied');
+            if (!pending.active) {
+                pending.active = true;
+                state.generation++;
+            }
+            return { grantId, expiresAt: pending.activeExpiresAt };
+        });
+    }
+    async revoke(actor, endpointId) {
+        await this.snapshot.transact(state => {
+            this.authorize(state, actor, 'admin');
+            state.devices = state.devices.filter(device => device.endpoint.id !== endpointId);
+            state.mcp = state.mcp.filter(item => item.approved.endpoint.id !== endpointId);
+            state.generation++;
+        });
+    }
+    async provisionLocalEndpoint(endpoint) {
+        const candidate = endpointSchema.parse(endpoint);
+        if (candidate.kind !== 'local-cli' || candidate.ownerId !== this.bridge.ownerId)
+            throw new BridgeSecurityError('wrong_context');
+        await this.snapshot.transact(state => {
+            this.check(state);
+            if (state.devices.some(device => device.endpoint.id === candidate.id))
+                return;
+            if (state.devices.length >= MAX_ENDPOINTS)
+                throw new BridgeSecurityError('capacity_exceeded');
+            state.devices.push({ endpoint: candidate, label: 'Local CLI', permissions: ['read', 'control', 'admin'],
+                approvedAt: new Date(this.now()).toISOString(), grantId: null, expiresAt: null });
+            state.generation++;
+        });
+    }
+    async close() { await this.snapshot.close(); }
+}
+//# sourceMappingURL=policy.js.map

package/dist/security/bridge/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/security/bridge/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,UAAU,CAAC;AACpC,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAChD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;IAC5G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5G,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5H,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3I,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;WACrF,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM;WAC/E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eACpE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;eAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;WACjE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACrH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAA2B,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAI/G,2GAA2G;AAC3G,MAAM,OAAO,iBAAiB;IAGU;IAA2B;IAAyC;IAFzF,QAAQ,CAAyB;IACjC,GAAG,CAAe;IACnC,YAAY,OAAe,EAAW,QAAgB,EAAW,MAAsB,EAAmB,UAAyB,EAAE;QAA/F,aAAQ,GAAR,QAAQ,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAgB;QAAmB,YAAO,GAAP,OAAO,CAAoB;QACnI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YAChG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;IACO,KAAK,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3H,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,cAAc,GAAG,KAAK;QACtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACjF,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,aAAa,CAAC,KAAa,EAAE,MAAwB;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW;YAC5H,gBAAgB,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,KAAwB,EAAE,UAA8B;QACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,iBAAiB,GAAG,KAAK;QAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,UAA+B;QACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/I,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAiD,EAAE,OAA0B;QAClG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,KAAK,wBAAwB;gBAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAA0B,EAAE,OAAO,CAAC,CAAC;YACnG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACxF,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YAC3G,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;IAChH,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,OAA0B;QAChD,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAC5D,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;YACpF,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACxG,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE;oBAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;gBACjG,yFAAyF;gBACzF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YAC3H,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK;gBAC9G,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7H,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACnC,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,KAAK,CAAC;gBAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,QAAqB;QAC9D,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACnI,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;eAClE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;eACzF,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;eACvG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,SAAS,CAAC;eACpI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACxH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC5H,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjI,IAAI,OAAgB,CAAC;YACrB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;uBAC9F,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;uBACtF,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;uBACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBAC5I,OAAO,GAAG,QAAQ,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACrH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;oBACxG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACnH,OAAO,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC1G,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC7D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBACvH,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACzG,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACrH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAwB,EAAE,OAAe;QACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;mBAC1H,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC7H,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAwB,EAAE,UAAkB;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAClF,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAC/E,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,QAAwB;QACnD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAChI,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;gBACrG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1G,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAC9D"}