ftown 0.19.52 → 0.19.53

package/dist/security/bridge/direct.d.ts

@@ -0,0 +1,22 @@
+import type { DirectMessage } from '../../direct-transport/contract.js';
+import type { InboundTransportContext } from '../protocol.js';
+import { BridgeSecurityService } from './security.js';
+/** Serial crypto at the peer boundary; application frames never escape as plaintext. */
+export declare class EncryptedPeerChannel {
+    private readonly security;
+    private readonly route;
+    private readonly wireSend;
+    private readonly deliver;
+    private readonly authorized;
+    private readonly teardown;
+    private inbound;
+    private outbound;
+    private endpointId;
+    private closed;
+    private readonly stopRevocation;
+    constructor(security: BridgeSecurityService, route: InboundTransportContext, wireSend: (json: string) => void, deliver: (frame: DirectMessage) => void, authorized: () => void, teardown: () => void);
+    receive(json: string): Promise<void>;
+    send(frame: DirectMessage): void;
+    drain(): Promise<void>;
+    close(): void;
+}

package/dist/security/bridge/direct.js

@@ -0,0 +1,72 @@
+import { parseSecureEnvelope } from '../crypto.js';
+import { applicationJson } from './security.js';
+/** Serial crypto at the peer boundary; application frames never escape as plaintext. */
+export class EncryptedPeerChannel {
+    security;
+    route;
+    wireSend;
+    deliver;
+    authorized;
+    teardown;
+    inbound = Promise.resolve();
+    outbound = Promise.resolve();
+    endpointId = null;
+    closed = false;
+    stopRevocation;
+    constructor(security, route, wireSend, deliver, authorized, teardown) {
+        this.security = security;
+        this.route = route;
+        this.wireSend = wireSend;
+        this.deliver = deliver;
+        this.authorized = authorized;
+        this.teardown = teardown;
+        this.stopRevocation = security.onRevoked(id => { if (id === this.endpointId)
+            this.teardown(); });
+    }
+    receive(json) {
+        this.inbound = this.inbound.then(async () => {
+            if (this.closed)
+                return;
+            const packet = parseSecureEnvelope(JSON.parse(json));
+            if (packet.purpose === 'hello') {
+                if (this.endpointId && this.endpointId !== packet.senderId)
+                    throw new Error('Wrong peer');
+                const response = await this.security.handleHandshake(packet, this.route);
+                // A pending MCP hello is harmless but cannot open an application data channel.
+                await this.security.policy.principal(packet.senderId);
+                this.endpointId = packet.senderId;
+                this.wireSend(JSON.stringify(response));
+                this.authorized();
+                return;
+            }
+            if (!this.endpointId || packet.senderId !== this.endpointId)
+                throw new Error('Unpaired peer');
+            const verified = await this.security.acceptApplication(packet, this.route);
+            if (verified.application.route.kind !== 'terminal')
+                throw new Error('Invalid direct application route');
+            await this.security.revalidate(verified.principal);
+            this.deliver(verified.application.data);
+            await this.security.complete(verified, 'succeeded');
+            await this.outbound;
+        }).catch(() => { this.teardown(); });
+        return this.inbound;
+    }
+    send(frame) {
+        this.outbound = this.outbound.then(async () => {
+            if (this.closed || !this.endpointId)
+                return;
+            const envelope = await this.security.sealTo(this.endpointId, { type: 'application', route: { kind: 'terminal',
+                    sessionId: 'sessionId' in frame ? frame.sessionId : '', frameType: frame.kind, pairId: this.route.pairId },
+                data: applicationJson(frame), mcp: null }, this.route);
+            if (!this.closed) {
+                try {
+                    this.wireSend(JSON.stringify(envelope));
+                }
+                catch { /* Native send failure drops only this frame; keepalive detects dead peers. */ }
+            }
+        }).catch(() => { this.teardown(); });
+    }
+    async drain() { await this.inbound; await this.outbound; }
+    close() { this.closed = true; this.stopRevocation(); }
+}
+//# sourceMappingURL=direct.js.map

package/dist/security/bridge/direct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct.js","sourceRoot":"","sources":["../../../src/security/bridge/direct.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAyB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,wFAAwF;AACxF,MAAM,OAAO,oBAAoB;IAMF;IAAkD;IAC5D;IAAmD;IACnD;IAAyC;IAPpD,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,QAAQ,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,UAAU,GAAkB,IAAI,CAAC;IACjC,MAAM,GAAG,KAAK,CAAC;IACN,cAAc,CAAa;IAC5C,YAA6B,QAA+B,EAAmB,KAA8B,EAC1F,QAAgC,EAAmB,OAAuC,EAC1F,UAAsB,EAAmB,QAAoB;QAFnD,aAAQ,GAAR,QAAQ,CAAuB;QAAmB,UAAK,GAAL,KAAK,CAAyB;QAC1F,aAAQ,GAAR,QAAQ,CAAwB;QAAmB,YAAO,GAAP,OAAO,CAAgC;QAC1F,eAAU,GAAV,UAAU,CAAY;QAAmB,aAAQ,GAAR,QAAQ,CAAY;QAC9E,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,IAAY;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzE,+EAA+E;gBAC/E,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACtD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAgC,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,KAAoB;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU;oBAC3G,SAAS,EAAE,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAC1G,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC;oBAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,8EAA8E,CAAC,CAAC;YAC3I,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,KAAK,KAAW,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;CAC7D"}

package/dist/security/bridge/errors.d.ts

@@ -0,0 +1,7 @@
+import type { SecurityErrorCode, SecurityFailure } from '../protocol.js';
+/** Messages are deliberately fixed: underlying storage/crypto exceptions never cross this boundary. */
+export declare class BridgeSecurityError extends Error implements SecurityFailure {
+    readonly code: SecurityErrorCode;
+    readonly retryable: boolean;
+    constructor(code: SecurityErrorCode);
+}

package/dist/security/bridge/errors.js

@@ -0,0 +1,12 @@
+/** Messages are deliberately fixed: underlying storage/crypto exceptions never cross this boundary. */
+export class BridgeSecurityError extends Error {
+    code;
+    retryable;
+    constructor(code) {
+        super(`Bridge security: ${code}`);
+        this.code = code;
+        this.name = 'BridgeSecurityError';
+        this.retryable = code === 'storage_unavailable' || code === 'audit_unavailable';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/security/bridge/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/security/bridge/errors.ts"],"names":[],"mappings":"AAEA,uGAAuG;AACvG,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEvB;IADZ,SAAS,CAAU;IAC5B,YAAqB,IAAuB;QAC1C,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QADf,SAAI,GAAJ,IAAI,CAAmB;QAE1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,mBAAmB,CAAC;IAClF,CAAC;CACF"}

package/dist/security/bridge/execute.d.ts

@@ -0,0 +1,3 @@
+import type { ApplicationJson, EnrollmentPacket, InboundTransportContext, SecureEnvelope, VerifiedApplication } from '../protocol.js';
+import { BridgeSecurityService } from './security.js';
+export declare function executeSecurePacket(security: BridgeSecurityService, packet: SecureEnvelope | EnrollmentPacket, route: InboundTransportContext, dispatch: (message: VerifiedApplication) => Promise<ApplicationJson>, admission?: (accept: () => Promise<VerifiedApplication>) => Promise<VerifiedApplication>): Promise<SecureEnvelope>;

package/dist/security/bridge/execute.js

@@ -0,0 +1,37 @@
+import { BridgeSecurityError } from './errors.js';
+export async function executeSecurePacket(security, packet, route, dispatch, admission) {
+    if (packet.type === 'ftown_enrollment' || packet.purpose !== 'application')
+        return security.handleHandshake(packet, route);
+    let verified;
+    let dispatchStarted = false;
+    try {
+        verified = await (admission ? admission(() => security.acceptApplication(packet, route)) : security.acceptApplication(packet, route));
+        const activation = verified.application.route.kind === 'command' && verified.application.route.command === 'security_activate_mcp';
+        if (!activation)
+            await security.revalidate(verified.principal);
+        const selfRevocation = await security.revokeSelfWithReceipt(verified, route);
+        if (selfRevocation)
+            return selfRevocation;
+        dispatchStarted = true;
+        const data = await dispatch(verified);
+        const result = data && typeof data === 'object' && !Array.isArray(data) ? data : null;
+        const response = result?.response && typeof result.response === 'object' && !Array.isArray(result.response) ? result.response : null;
+        const body = result?.body && typeof result.body === 'object' && !Array.isArray(result.body) ? result.body : null;
+        const failedHttp = typeof result?.status === 'number' && result.status >= 400;
+        const unknown = body?.outcomeUnknown === true;
+        await security.complete(verified, unknown ? 'unknown' : failedHttp || response?.success === false ? 'rejected' : 'succeeded', failedHttp ? typeof body?.code === 'string' ? body.code : 'bridge_error' : response?.success === false ? 'bridge_error' : null);
+        return security.sealTo(packet.senderId, { type: 'application', route: { kind: 'response', requestId: packet.messageId }, data, mcp: null }, route);
+    }
+    catch (error) {
+        // Never authenticate an error on behalf of an unauthenticated/tampered packet.
+        if (!verified && (!(error instanceof BridgeSecurityError)
+            || !['permission_denied', 'epoch_changed', 'expired', 'replayed', 'capacity_exceeded', 'audit_unavailable'].includes(error.code)))
+            throw error;
+        const code = error instanceof BridgeSecurityError ? error.code : dispatchStarted ? 'outcome_unknown' : 'permission_denied';
+        if (verified)
+            await security.complete(verified, dispatchStarted ? 'unknown' : 'rejected', code).catch(() => undefined);
+        return security.sealTo(packet.senderId, { type: 'application', route: { kind: 'response', requestId: packet.messageId },
+            data: { status: dispatchStarted ? 500 : 403, body: { error: code, code, outcomeUnknown: dispatchStarted } }, mcp: null }, route);
+    }
+}
+//# sourceMappingURL=execute.js.map

package/dist/security/bridge/execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../../src/security/bridge/execute.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAA+B,EAAE,MAAyC,EAClH,KAA8B,EAAE,QAAoE,EACpG,SAAwF;IACxF,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa;QAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3H,IAAI,QAAyC,CAAC;IAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACtI,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,uBAAuB,CAAC;QACnI,IAAI,CAAC,UAAU;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7E,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACrI,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACjH,MAAM,UAAU,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;QAC9C,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAC1H,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClI,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACrJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;eACpD,CAAC,CAAC,mBAAmB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,KAAK,CAAC;QACjJ,MAAM,IAAI,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAC3H,IAAI,QAAQ;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvH,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;YACrH,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACrI,CAAC;AACH,CAAC"}

package/dist/security/bridge/identity.d.ts

@@ -0,0 +1,5 @@
+import type { EndpointIdentity, EndpointKind } from '../protocol.js';
+/** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
+export declare function loadOrCreateIdentity(dataDir: string, ownerId: string, kind: 'bridge' | 'local-cli'): Promise<EndpointIdentity>;
+export declare function isLocalIdentityKind(kind: EndpointKind): kind is 'bridge' | 'local-cli';
+export declare function loadLocalIdentity(dataDir: string, ownerId: string): Promise<EndpointIdentity>;

package/dist/security/bridge/identity.js

@@ -0,0 +1,42 @@
+import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import { generateEndpoint, importEndpoint } from '../crypto.js';
+import { endpointSchema } from './metadata.js';
+import { AtomicSnapshot } from './snapshot.js';
+import { BridgeSecurityError } from './errors.js';
+const recordSchema = z.object({ version: z.literal(1), endpoint: endpointSchema, privateKey: z.object({
+        kty: z.literal('EC'), crv: z.literal('P-256'), x: z.string(), y: z.string(), d: z.string(),
+        key_ops: z.array(z.string()).optional(), ext: z.boolean().optional(),
+    }).strict() }).strict();
+/** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
+export async function loadOrCreateIdentity(dataDir, ownerId, kind) {
+    const generated = await generateEndpoint(ownerId, kind, true);
+    const jwk = await crypto.subtle.exportKey('jwk', generated.keyPair.privateKey);
+    const initial = recordSchema.parse({ version: 1, endpoint: generated.endpoint, privateKey: jwk });
+    const store = new AtomicSnapshot(join(dataDir, 'security', `${kind}-identity.json`), recordSchema, () => initial);
+    const saved = await store.transact(state => {
+        if (state.endpoint.ownerId !== ownerId || state.endpoint.kind !== kind)
+            throw new BridgeSecurityError('wrong_context');
+        return state;
+    });
+    try {
+        return await importEndpoint(saved.endpoint, saved.privateKey, false);
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+}
+export function isLocalIdentityKind(kind) { return kind === 'bridge' || kind === 'local-cli'; }
+export async function loadLocalIdentity(dataDir, ownerId) {
+    try {
+        const saved = recordSchema.parse(JSON.parse(await readFile(join(dataDir, 'security', 'local-cli-identity.json'), 'utf8')));
+        if (saved.endpoint.ownerId !== ownerId || saved.endpoint.kind !== 'local-cli')
+            throw new Error('Wrong local key');
+        return await importEndpoint(saved.endpoint, saved.privateKey, false);
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/security/bridge/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/security/bridge/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAExB,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,IAA4B;IACvG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAkB,IAAoC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;AAE7I,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAe;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3H,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClH,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC"}

package/dist/security/bridge/local-client.d.ts

@@ -0,0 +1,4 @@
+import type { BridgePointer } from '../../wire-types.js';
+import type { ApplicationJson, SecureApplication } from '../protocol.js';
+/** OS-local clients pin bridge metadata from the owner-only pointer, never remote discovery. */
+export declare function localApplication(pointer: BridgePointer, application: SecureApplication, signal?: AbortSignal, fetchFn?: typeof fetch): Promise<ApplicationJson>;

package/dist/security/bridge/local-client.js

@@ -0,0 +1,43 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { open, parseSecureEnvelope, seal } from '../crypto.js';
+import { loadLocalIdentity } from './identity.js';
+import { BridgeSecurityError } from './errors.js';
+/** OS-local clients pin bridge metadata from the owner-only pointer, never remote discovery. */
+export async function localApplication(pointer, application, signal, fetchFn = fetch) {
+    if (!pointer.dataDir || !pointer.ownerId || !pointer.endpoint || !pointer.bridgeId)
+        throw new BridgeSecurityError('upgrade_required');
+    const bridge = pointer.endpoint;
+    if (bridge.kind !== 'bridge' || bridge.ownerId !== pointer.ownerId)
+        throw new BridgeSecurityError('wrong_context');
+    const identity = await loadLocalIdentity(pointer.dataDir, pointer.ownerId);
+    const channel = `local-http:${pointer.bridgeId}`;
+    const requestId = application.route.kind === 'command' || application.route.kind === 'http' || application.route.kind === 'response'
+        ? application.route.requestId : randomUUID();
+    const post = async (purpose, body, epoch, messageId) => {
+        const createdAt = Date.now();
+        const packet = await seal(identity, bridge, { type: 'ftown_encrypted', version: 1, senderId: identity.endpoint.id,
+            recipientId: bridge.id, ownerId: pointer.ownerId, bridgeId: pointer.bridgeId, channel, purpose, messageId,
+            createdAt, expiresAt: createdAt + 120000, receiverEpoch: epoch }, new TextEncoder().encode(JSON.stringify(body)));
+        const response = await fetchFn(`http://127.0.0.1:${pointer.port}/api/security/envelope`, { method: 'POST',
+            headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(packet), redirect: 'error',
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(65000)]) : AbortSignal.timeout(65000) });
+        if (!response.ok)
+            throw new BridgeSecurityError('bridge_offline');
+        const envelope = parseSecureEnvelope(await response.json());
+        if (envelope.messageId !== messageId)
+            throw new BridgeSecurityError('wrong_context');
+        const bytes = await open(identity, bridge, envelope, { ownerId: pointer.ownerId, bridgeId: pointer.bridgeId, channel,
+            recipientId: identity.endpoint.id, purpose: purpose === 'hello' ? 'welcome' : 'application' });
+        if (envelope.expiresAt <= Date.now() || envelope.createdAt > Date.now() + 30000)
+            throw new BridgeSecurityError('expired');
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    };
+    const challenge = randomUUID();
+    const hello = z.object({ type: z.literal('welcome'), challenge: z.literal(challenge), receiverEpoch: z.string().min(1).max(128) }).strict()
+        .parse(await post('hello', { type: 'hello', challenge }, null, randomUUID()));
+    const result = z.object({ type: z.literal('application'), route: z.object({ kind: z.literal('response'), requestId: z.literal(requestId) }).strict(),
+        data: z.unknown(), mcp: z.null() }).strict().parse(await post('application', application, hello.receiverEpoch, requestId));
+    return result.data;
+}
+//# sourceMappingURL=local-client.js.map

package/dist/security/bridge/local-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-client.js","sourceRoot":"","sources":["../../../src/security/bridge/local-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAsB,EAAE,WAA8B,EAAE,MAAoB,EACjH,UAAwB,KAAK;IAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IACtI,MAAM,MAAM,GAAmB,OAAO,CAAC,QAAQ,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACnH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;QAClI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgC,EAAE,IAAa,EAAE,KAAoB,EAAE,SAAiB,EAAE,EAAE;QAC9G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAC/G,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;YAC3G,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,wBAAwB,EAAE,EAAE,MAAM,EAAE,MAAM;YACvG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO;YAChG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAS,EAAE,OAAO;YACpH,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QACjG,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,CAAC;IACxF,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;SACxI,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAClJ,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7H,OAAO,MAAM,CAAC,IAAuB,CAAC;AACxC,CAAC"}

package/dist/security/bridge/metadata.d.ts

@@ -0,0 +1,99 @@
+import { z } from 'zod';
+export declare const boundedId: z.ZodString;
+export declare const endpointSchema: z.ZodEffects<z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    id: z.ZodString;
+    ownerId: z.ZodString;
+    kind: z.ZodEnum<["bridge", "browser", "mcp", "local-cli"]>;
+    publicKey: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}>, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}, {
+    id: string;
+    version: 1;
+    ownerId: string;
+    kind: "bridge" | "browser" | "mcp" | "local-cli";
+    publicKey: string;
+}>;
+export declare const permissionSchema: z.ZodEnum<["read", "control", "admin"]>;
+export declare const approvedSchema: z.ZodObject<{
+    endpoint: z.ZodEffects<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        id: z.ZodString;
+        ownerId: z.ZodString;
+        kind: z.ZodEnum<["bridge", "browser", "mcp", "local-cli"]>;
+        publicKey: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }>, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }>;
+    label: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<["read", "control", "admin"]>, "many">;
+    approvedAt: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    expiresAt: string | null;
+    endpoint: {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    };
+    label: string;
+    permissions: ("read" | "control" | "admin")[];
+    approvedAt: string;
+    grantId: string | null;
+}, {
+    expiresAt: string | null;
+    endpoint: {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    };
+    label: string;
+    permissions: ("read" | "control" | "admin")[];
+    approvedAt: string;
+    grantId: string | null;
+}>;
+export declare function displayLabel(label: string): string;

package/dist/security/bridge/metadata.js

@@ -0,0 +1,23 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+export const boundedId = z.string().regex(/^[A-Za-z0-9_-]{1,200}$/);
+export const endpointSchema = z.object({
+    version: z.literal(1), id: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    ownerId: z.string().min(1).max(200), kind: z.enum(['bridge', 'browser', 'mcp', 'local-cli']),
+    publicKey: z.string().regex(/^[A-Za-z0-9_-]{87}$/),
+}).strict().superRefine((endpoint, context) => {
+    const raw = Buffer.from(endpoint.publicKey, 'base64url');
+    if (raw.length !== 65 || raw[0] !== 4 || raw.toString('base64url') !== endpoint.publicKey
+        || createHash('sha256').update(raw).digest('base64url') !== endpoint.id) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'Invalid endpoint fingerprint' });
+    }
+});
+export const permissionSchema = z.enum(['read', 'control', 'admin']);
+export const approvedSchema = z.object({
+    endpoint: endpointSchema, label: z.string().max(100), permissions: z.array(permissionSchema).max(3),
+    approvedAt: z.string().datetime(), grantId: boundedId.nullable(), expiresAt: z.string().datetime().nullable(),
+}).strict();
+export function displayLabel(label) {
+    return label.replace(/[\u0000-\u001f\u007f-\u009f]/g, '').trim().slice(0, 100);
+}
+//# sourceMappingURL=metadata.js.map

package/dist/security/bridge/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/security/bridge/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACnD,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,SAAS;WACpF,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9G,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjF,CAAC"}

package/dist/security/bridge/native-wake.d.ts

@@ -0,0 +1,16 @@
+import type { Session } from '../../types.js';
+/** Deliberate trusted-local-provider IPC: no application route, message body, consumption or prompt execution. */
+export declare function nativeWake(input: unknown, dependencies: {
+    getSession(id: string): Promise<Session | null>;
+    register(session: Session, registration: {
+        adapter: 'claude-mod';
+        nativeSessionId: string;
+    }): void;
+    unread(id: string): Promise<{
+        id: string;
+    }[]>;
+}): Promise<{
+    messages: {
+        id: string;
+    }[];
+}>;

package/dist/security/bridge/native-wake.js

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+import { BridgeSecurityError } from './errors.js';
+const payloadSchema = z.object({ hook_event_name: z.literal('FtownNativeWake'), ftown_session_id: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/),
+    session_id: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/), adapter: z.literal('claude-mod'), registerWake: z.boolean().optional() }).strict();
+/** Deliberate trusted-local-provider IPC: no application route, message body, consumption or prompt execution. */
+export async function nativeWake(input, dependencies) {
+    const payload = payloadSchema.parse(input);
+    const session = await dependencies.getSession(payload.ftown_session_id);
+    if (!session || session.claudeSessionId !== payload.session_id)
+        throw new BridgeSecurityError('wrong_context');
+    if (payload.registerWake !== false)
+        dependencies.register(session, { adapter: 'claude-mod', nativeSessionId: payload.session_id });
+    return { messages: (await dependencies.unread(session.id)).slice(0, 500).map(message => ({ id: message.id })) };
+}
+//# sourceMappingURL=native-wake.js.map

package/dist/security/bridge/native-wake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-wake.js","sourceRoot":"","sources":["../../../src/security/bridge/native-wake.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC1I,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAE7I,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAc,EAAE,YAIhD;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK;QAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnI,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AAClH,CAAC"}

package/dist/security/bridge/permissions.d.ts

@@ -0,0 +1,11 @@
+import type { ApplicationJson, EndpointPermission } from '../protocol.js';
+export interface OperationPermission {
+    permission: EndpointPermission;
+    mutating: boolean;
+    operation: string;
+    sessionId: string | null;
+}
+/** Deliberately semantic: GET inbox consumes mail unless explicitly non-consuming. */
+export declare function classifyHttp(method: string, path: string): OperationPermission;
+export declare function classifyCommand(command: string, payload?: ApplicationJson): OperationPermission;
+export declare function classifyTerminal(frameType: string): OperationPermission;

package/dist/security/bridge/permissions.js

@@ -0,0 +1,97 @@
+import { BridgeSecurityError } from './errors.js';
+const session = /^[A-Za-z0-9_-]+$/;
+const readCommands = new Set(['list_sessions', 'get_history', 'get_session_usage', 'get_sessions_usage', 'get_session_attention']);
+const controlCommands = new Set(['create_session', 'stop_session', 'retry_session', 'send_message', 'rename_session', 'remove_session',
+    'bridge_exec', 'clear_terminal', 'update_session_parent', 'resolve_session_attention']);
+const adminCommands = new Set(['security_devices', 'security_invite', 'security_revoke', 'security_approve_mcp', 'security_activity']);
+const result = (permission, operation, sessionId = null) => ({ permission, mutating: permission === 'control' || ['security_invite', 'security_revoke', 'security_approve_mcp'].includes(operation), operation, sessionId });
+const deny = () => { throw new BridgeSecurityError('permission_denied'); };
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+/** Deliberately semantic: GET inbox consumes mail unless explicitly non-consuming. */
+export function classifyHttp(method, path) {
+    if (path.length > 16_384 || !path.startsWith('/api/') || path.includes('#') || path.includes('\\') || path.split('?')[0].includes('%'))
+        return deny();
+    const url = new URL(path, 'http://bridge.invalid');
+    if (url.origin !== 'http://bridge.invalid' || url.pathname.split('/').some(part => part === '.' || part === '..')
+        || path.split('?')[0] !== url.pathname)
+        return deny();
+    if (url.pathname === '/api/sessions') {
+        if (method === 'GET')
+            return result('read', 'sessions_list');
+        if (method === 'POST')
+            return result('control', 'sessions_create');
+        return deny();
+    }
+    if (method === 'GET' && url.pathname === '/api/archive')
+        return result('read', 'archive_list');
+    if (method === 'GET' && url.pathname === '/api/inbox/resolve')
+        return result('read', 'inbox_resolve');
+    if (method === 'GET' && url.pathname === '/api/browser/events')
+        return result('read', 'local_events');
+    if (url.pathname === '/api/loops' || /^\/api\/loops\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)?$/.test(url.pathname)) {
+        if (!['GET', 'POST', 'PATCH', 'DELETE'].includes(method))
+            return deny();
+        return { permission: method === 'GET' ? 'read' : 'control', mutating: false, operation: 'automation_removed', sessionId: null };
+    }
+    const match = /^\/api\/sessions\/([A-Za-z0-9_-]+)(?:\/(screen|grep|keys|message|inbox|resize|usage|running|revive|stop|retry|attention)(?:\/(ack|resolve))?)?$/.exec(url.pathname);
+    if (!match)
+        return deny();
+    const [, id, suffix, attentionAction] = match;
+    if (attentionAction && suffix !== 'attention')
+        return deny();
+    if (!suffix) {
+        if (method === 'GET')
+            return result('read', 'sessions_get', id);
+        if (method === 'PATCH')
+            return result('control', 'sessions_update', id);
+        if (method === 'DELETE')
+            return result('control', 'sessions_remove', id);
+        return deny();
+    }
+    if (suffix === 'inbox' && method === 'GET') {
+        // Native wake registration mutates the delivery target even when peek=1.
+        const peek = url.searchParams.getAll('peek');
+        const readOnly = peek.length === 1 && peek[0] === '1'
+            && !url.searchParams.has('adapter') && !url.searchParams.has('nativeSessionId');
+        return result(readOnly ? 'read' : 'control', readOnly ? 'messages_peek' : 'messages_read', id);
+    }
+    if (method === 'GET' && ['screen', 'usage', 'running', 'attention'].includes(suffix) && !attentionAction)
+        return result('read', `${suffix}_get`, id);
+    if (method === 'POST' && suffix === 'grep' && !attentionAction)
+        return result('read', 'history_search', id);
+    if (method === 'POST' && ['keys', 'message', 'inbox', 'resize', 'revive', 'stop', 'retry', 'attention'].includes(suffix)) {
+        return result('control', attentionAction ? `attention_${attentionAction}` : `${suffix}_send`, id);
+    }
+    if (method === 'DELETE' && suffix === 'screen')
+        return result('control', 'screen_clear', id);
+    return deny();
+}
+export function classifyCommand(command, payload) {
+    const body = object(payload);
+    const sessionId = typeof body?.sessionId === 'string' && session.test(body.sessionId) ? body.sessionId : null;
+    if (command === 'mcp_request') {
+        const request = object(body?.request);
+        if (typeof request?.method !== 'string' || typeof request.path !== 'string')
+            return deny();
+        return classifyHttp(request.method, request.path);
+    }
+    if (readCommands.has(command))
+        return result('read', command, sessionId);
+    if (controlCommands.has(command))
+        return result('control', command, sessionId);
+    if (adminCommands.has(command))
+        return result('admin', command, sessionId);
+    if (command === 'terminal_watch' || command === 'terminal_unwatch' || command === 'webrtc_offer'
+        || command === 'webrtc_answer' || command === 'webrtc_ice' || command === 'webrtc_close')
+        return result('read', command, sessionId);
+    // Activation has a separate exact-pending-grant check; it is never granted by a generic permission.
+    return deny();
+}
+export function classifyTerminal(frameType) {
+    if (['attach', 'detach', 'init', 'ping', 'pong', 'hello'].includes(frameType))
+        return result('read', `terminal_${frameType}`);
+    if (frameType === 'input' || frameType === 'resize')
+        return result('control', `terminal_${frameType}`);
+    return deny();
+}
+//# sourceMappingURL=permissions.js.map

package/dist/security/bridge/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/security/bridge/permissions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACnI,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB;IACpI,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,CAAC,CAAC;AAC1F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACvI,MAAM,MAAM,GAAG,CAAC,UAA8B,EAAE,SAAiB,EAAE,YAA2B,IAAI,EAAuB,EAAE,CACzH,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;AACnK,MAAM,IAAI,GAAG,GAAU,EAAE,GAAG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,MAAM,MAAM,GAAG,CAAC,KAAkC,EAAkD,EAAE,CACpG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAE3F,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACtJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,uBAAuB,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;WAC5G,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,EAAE,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACnE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC/F,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtG,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtG,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9G,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClI,CAAC;IACD,MAAM,KAAK,GAAG,iJAAiJ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnL,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;IAC9C,IAAI,eAAe,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3C,yEAAyE;QACzE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;eAChD,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,EAAE,CAAC,CAAC;IACrJ,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC5G,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzH,OAAO,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,aAAa,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAAyB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAC;QAC3F,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,cAAc;WAC3F,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACtI,oGAAoG;IACpG,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IAC9H,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IACvG,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}