ftown 0.19.52 → 0.19.53

package/dist/security/bridge/security.js

@@ -0,0 +1,298 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { open, seal, parseSecureEnvelope } from '../crypto.js';
+import { BridgePolicyStore } from './policy.js';
+import { BridgeAuditStore } from './audit.js';
+import { BridgeSecurityError } from './errors.js';
+import { classifyCommand, classifyHttp, classifyTerminal } from './permissions.js';
+import { endpointSchema } from './metadata.js';
+const token = z.string().regex(/^[A-Za-z0-9_-]{1,200}$/);
+const actionSchema = z.object({ actionId: token, parentActionId: token.nullable(), clientId: token, grantId: token,
+    tool: z.string().max(200), operation: z.string().max(200).nullable() }).strict();
+const routeSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('command'), requestId: token, command: z.string().min(1).max(100), sessionId: token.nullable() }).strict(),
+    z.object({ kind: z.literal('http'), requestId: token, method: z.enum(['GET', 'POST', 'PATCH', 'PUT', 'DELETE']), path: z.string().max(16384) }).strict(),
+    z.object({ kind: z.literal('terminal'), sessionId: z.string().max(200), frameType: z.string().max(50), pairId: token.nullable() }).strict(),
+    z.object({ kind: z.literal('response'), requestId: token }).strict(), z.object({ kind: z.literal('publication') }).strict(),
+]);
+const object = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new BridgeSecurityError('invalid_envelope');
+    return value;
+};
+export const applicationJson = (value) => JSON.parse(JSON.stringify(value));
+export class BridgeSecurityService {
+    identity;
+    bridgeId;
+    options;
+    endpoint;
+    receiverEpoch = randomUUID();
+    policy;
+    audit;
+    now;
+    replay = new Map();
+    revoked = new Set();
+    admissions = new Map();
+    verified = new WeakSet();
+    closed = false;
+    constructor(identity, bridgeId, dataDir, options) {
+        this.identity = identity;
+        this.bridgeId = bridgeId;
+        this.options = options;
+        this.endpoint = identity.endpoint;
+        this.now = options.now ?? Date.now;
+        this.policy = new BridgePolicyStore(dataDir, bridgeId, this.endpoint, options);
+        this.audit = new BridgeAuditStore(dataDir, this.endpoint.ownerId, bridgeId, options);
+    }
+    context(route) {
+        if (this.closed || route.bridgeId !== this.bridgeId)
+            throw new BridgeSecurityError('wrong_context');
+        const expected = route.transport === 'local-http' ? `local-http:${this.bridgeId}`
+            : route.transport === 'local-events' ? `local-events:${this.bridgeId}`
+                : route.transport === 'cloud' ? route.channel
+                    : `direct:${route.transport}:${this.bridgeId}:${route.pairId}`;
+        if (expected !== route.channel || ((route.transport === 'webrtc' || route.transport === 'loopback-ws') && !route.pairId)) {
+            throw new BridgeSecurityError('wrong_context');
+        }
+    }
+    freshness(envelope, executable) {
+        const now = this.now();
+        if (envelope.createdAt > now + 30000 || envelope.expiresAt <= now || envelope.expiresAt - envelope.createdAt > 120000) {
+            throw new BridgeSecurityError('expired');
+        }
+        if (executable && envelope.receiverEpoch !== this.receiverEpoch)
+            throw new BridgeSecurityError('epoch_changed');
+    }
+    claim(envelope) {
+        const now = this.now();
+        for (const [id, expires] of this.replay)
+            if (expires <= now)
+                this.replay.delete(id);
+        const id = `${envelope.senderId}:${envelope.messageId}`;
+        if (this.replay.has(id))
+            throw new BridgeSecurityError('replayed');
+        if (this.replay.size >= 10000)
+            throw new BridgeSecurityError('capacity_exceeded');
+        this.replay.set(id, envelope.expiresAt);
+    }
+    async decode(sender, envelope, route) {
+        this.context(route);
+        const bytes = await open(this.identity, sender, envelope, { ownerId: this.endpoint.ownerId, bridgeId: this.bridgeId,
+            channel: route.channel, recipientId: this.endpoint.id, purpose: envelope.purpose });
+        try {
+            return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        }
+        catch {
+            throw new BridgeSecurityError('invalid_envelope');
+        }
+    }
+    async reply(recipient, purpose, data, route, messageId = randomUUID()) {
+        this.context(route);
+        return seal(this.identity, recipient, { type: 'ftown_encrypted', version: 1, senderId: this.endpoint.id, recipientId: recipient.id,
+            ownerId: this.endpoint.ownerId, bridgeId: this.bridgeId, channel: route.channel, purpose, messageId,
+            createdAt: this.now(), expiresAt: this.now() + 120000, receiverEpoch: null }, new TextEncoder().encode(JSON.stringify(data)));
+    }
+    async handleHandshake(packet, route) {
+        this.context(route);
+        if (packet.type === 'ftown_enrollment') {
+            const wrapper = z.object({ type: z.literal('ftown_enrollment'), version: z.literal(1), candidate: endpointSchema, envelope: z.unknown() }).strict().parse(packet);
+            const envelope = parseSecureEnvelope(wrapper.envelope);
+            if (envelope.purpose !== 'enroll')
+                throw new BridgeSecurityError('wrong_context');
+            this.freshness(envelope, false);
+            const message = z.object({ type: z.literal('enroll'), candidate: endpointSchema, invitationId: z.string().uuid(),
+                invitationSecret: z.string().regex(/^[A-Za-z0-9_-]{43}$/), label: z.string().max(200) }).strict().parse(await this.decode(wrapper.candidate, envelope, route));
+            if (JSON.stringify(message.candidate) !== JSON.stringify(wrapper.candidate))
+                throw new BridgeSecurityError('wrong_context');
+            const approved = await this.policy.consumeInvitation(message);
+            return this.reply(approved.endpoint, 'enrolled', { type: 'enrolled', invitationId: message.invitationId, approved, receiverEpoch: this.receiverEpoch }, route, envelope.messageId);
+        }
+        const envelope = parseSecureEnvelope(packet);
+        if (envelope.purpose !== 'hello')
+            throw new BridgeSecurityError('wrong_context');
+        this.freshness(envelope, false);
+        const principal = await this.policy.principal(envelope.senderId, true);
+        const hello = z.object({ type: z.literal('hello'), challenge: token }).strict().parse(await this.decode(principal.endpoint, envelope, route));
+        return this.reply(principal.endpoint, 'welcome', { type: 'welcome', challenge: hello.challenge, receiverEpoch: this.receiverEpoch }, route, envelope.messageId);
+    }
+    parseApplication(value) {
+        const parsed = z.object({ type: z.literal('application'), route: routeSchema, data: z.unknown(), mcp: actionSchema.nullable() }).strict().parse(value);
+        return { ...parsed, data: applicationJson(parsed.data) };
+    }
+    requirement(application, transport) {
+        const route = application.route;
+        if ((transport.transport === 'webrtc' || transport.transport === 'loopback-ws') && route.kind !== 'terminal') {
+            throw new BridgeSecurityError('wrong_context');
+        }
+        if (route.kind === 'command') {
+            const data = object(application.data);
+            if (['terminal_watch', 'terminal_unwatch', 'webrtc_offer', 'webrtc_answer', 'webrtc_ice', 'webrtc_close'].includes(route.command)) {
+                if (data.type !== route.command || (data.bridgeId !== undefined && data.bridgeId !== this.bridgeId)
+                    || (typeof data.sessionId === 'string' ? data.sessionId : null) !== route.sessionId)
+                    throw new BridgeSecurityError('wrong_context');
+                return classifyCommand(route.command, data);
+            }
+            const payload = object(data.payload ?? null);
+            if (data.type !== route.command || data.requestId !== route.requestId || payload.bridgeId !== this.bridgeId
+                || (typeof payload.sessionId === 'string' ? payload.sessionId : null) !== route.sessionId)
+                throw new BridgeSecurityError('wrong_context');
+            return classifyCommand(route.command, payload);
+        }
+        if (route.kind === 'http') {
+            const data = object(application.data);
+            if (Object.keys(data).some(key => key !== 'body' && key !== 'timeoutMs' && key !== 'callerSessionId')
+                || (data.timeoutMs !== undefined && (typeof data.timeoutMs !== 'number' || !Number.isInteger(data.timeoutMs) || data.timeoutMs < 1 || data.timeoutMs > 60000)))
+                throw new BridgeSecurityError('invalid_envelope');
+            return classifyHttp(route.method, route.path);
+        }
+        if (route.kind === 'terminal') {
+            const data = object(application.data);
+            if (route.pairId !== transport.pairId || data.kind !== route.frameType
+                || (typeof data.sessionId === 'string' ? data.sessionId : '') !== route.sessionId)
+                throw new BridgeSecurityError('wrong_context');
+            if (route.sessionId && !/^[A-Za-z0-9_-]+$/.test(route.sessionId))
+                throw new BridgeSecurityError('invalid_envelope');
+            return classifyTerminal(route.frameType);
+        }
+        throw new BridgeSecurityError('permission_denied');
+    }
+    async admission(envelope, principal, app, operation) {
+        if (principal.endpoint.kind !== 'mcp') {
+            if (app.mcp !== null)
+                throw new BridgeSecurityError('permission_denied');
+            return;
+        }
+        const context = app.mcp;
+        if (!context || context.grantId !== principal.grantId)
+            throw new BridgeSecurityError('wrong_context');
+        const admitted = await this.audit.admit({ admissionId: envelope.messageId, ...context, endpointId: principal.endpoint.id,
+            operation: operation.operation, sessionId: operation.sessionId, mutating: operation.mutating });
+        if (!admitted.isNew)
+            throw new BridgeSecurityError('replayed');
+        this.admissions.set(`${envelope.senderId}:${envelope.messageId}`, admitted.event.id);
+    }
+    async acceptApplication(packet, route) {
+        const envelope = parseSecureEnvelope(packet);
+        if (envelope.purpose !== 'application')
+            throw new BridgeSecurityError('wrong_context');
+        const principal = await this.policy.principal(envelope.senderId, true);
+        const app = this.parseApplication(await this.decode(principal.endpoint, envelope, route));
+        if (app.route.kind === 'http') {
+            const data = object(app.data);
+            if (data.callerSessionId !== undefined && (principal.endpoint.kind !== 'local-cli'
+                || typeof data.callerSessionId !== 'string' || !/^[A-Za-z0-9_-]{1,200}$/.test(data.callerSessionId)))
+                throw new BridgeSecurityError('permission_denied');
+        }
+        this.freshness(envelope, true);
+        this.claim(envelope);
+        // Pending identities can do precisely this one bound operation; never generic application work.
+        if (app.route.kind === 'command' && app.route.command === 'security_activate_mcp') {
+            const data = object(app.data);
+            const payload = object(data.payload ?? null);
+            if (data.type !== app.route.command || data.requestId !== app.route.requestId || payload.bridgeId !== this.bridgeId
+                || payload.grantId !== principal.grantId || principal.endpoint.kind !== 'mcp')
+                throw new BridgeSecurityError('permission_denied');
+            const message = { principal, envelope, application: app };
+            this.verified.add(message);
+            return message;
+        }
+        let operation;
+        try {
+            operation = this.requirement(app, route);
+        }
+        catch (error) {
+            if (principal.endpoint.kind === 'mcp' && app.mcp) {
+                await this.admission(envelope, principal, app, { permission: 'control', mutating: true, operation: 'invalid_operation', sessionId: null });
+                await this.complete({ principal, envelope, application: app }, 'rejected', 'permission_denied');
+            }
+            throw error;
+        }
+        await this.admission(envelope, principal, app, operation);
+        try {
+            await this.policy.revalidate(principal, operation.permission);
+        }
+        catch (error) {
+            await this.complete({ principal, envelope, application: app }, 'rejected', 'permission_denied');
+            throw error;
+        }
+        const message = { principal, envelope, application: app };
+        this.verified.add(message);
+        return message;
+    }
+    async revalidate(principal) { await this.policy.revalidate(principal); }
+    /** One non-content receipt, prepared while authorized and released only after durable self-removal. */
+    async revokeSelfWithReceipt(message, route) {
+        const application = message.application;
+        if (application.route.kind !== 'command' || application.route.command !== 'security_revoke')
+            return null;
+        const data = object(application.data);
+        const payload = object(data.payload ?? null);
+        if (payload.endpointId !== message.principal.endpoint.id)
+            return null;
+        if (!this.verified.has(message) || message.envelope.senderId !== message.principal.endpoint.id
+            || message.envelope.channel !== route.channel || message.envelope.bridgeId !== route.bridgeId
+            || message.envelope.messageId !== application.route.requestId || payload.bridgeId !== this.bridgeId) {
+            throw new BridgeSecurityError('wrong_context');
+        }
+        await this.policy.revalidate(message.principal, 'admin');
+        const receipt = await this.reply(message.principal.endpoint, 'application', { type: 'application',
+            route: { kind: 'response', requestId: application.route.requestId }, mcp: null,
+            data: { type: 'command_response', response: { requestId: application.route.requestId, success: true,
+                    data: { endpointId: message.principal.endpoint.id, revoked: true } } } }, route, application.route.requestId);
+        // No sealed value leaves this method before both persistence steps have succeeded.
+        await this.revokeEndpoint(message.principal, message.principal.endpoint.id);
+        await this.complete(message, 'succeeded');
+        this.verified.delete(message);
+        return receipt;
+    }
+    async complete(message, status, errorCode = null) {
+        const key = `${message.envelope.senderId}:${message.envelope.messageId}`;
+        const admission = this.admissions.get(key);
+        if (!admission)
+            return;
+        try {
+            await this.audit.finish(admission, status, errorCode);
+            this.admissions.delete(key);
+        }
+        catch {
+            throw new BridgeSecurityError('outcome_unknown');
+        }
+    }
+    async sealTo(recipientId, application, route) {
+        const principal = await this.policy.principal(recipientId);
+        const envelope = await this.reply(principal.endpoint, 'application', application, route, application.route.kind === 'response' ? application.route.requestId : randomUUID());
+        await this.policy.revalidate(principal);
+        return envelope;
+    }
+    async sealPublication(channel, application) {
+        const recipients = await this.policy.recipients();
+        const packets = [];
+        for (const recipient of recipients) {
+            try {
+                packets.push(await this.sealTo(recipient.endpoint.id, application, { transport: 'cloud', channel, bridgeId: this.bridgeId, pairId: null }));
+            }
+            catch (error) {
+                if (!(error instanceof BridgeSecurityError) || !['endpoint_revoked', 'approval_required', 'expired'].includes(error.code))
+                    throw error;
+            }
+        }
+        return packets;
+    }
+    createInvitation(actor, options) { return this.policy.createInvitation(actor, options); }
+    listDevices(actor) { return this.policy.list(actor); }
+    async approveMcp(actor, approval) {
+        const receipt = await this.policy.approveMcp(actor, approval);
+        const envelope = await this.reply(approval.endpoint, 'mcp-approval', receipt, { transport: 'cloud', channel: `mcp-approval:${this.bridgeId}:${approval.requestId}`,
+            bridgeId: this.bridgeId, pairId: null });
+        return { bridgeId: this.bridgeId, bridge: this.endpoint, receipt: envelope };
+    }
+    activateMcp(actor, grantId) { return this.policy.activateMcp(actor, grantId); }
+    async revokeEndpoint(actor, endpointId) {
+        await this.policy.revoke(actor, endpointId);
+        for (const listener of this.revoked)
+            listener(endpointId);
+    }
+    onRevoked(listener) { this.revoked.add(listener); return () => this.revoked.delete(listener); }
+    async close() { this.closed = true; this.revoked.clear(); this.replay.clear(); await this.audit.close(); await this.policy.close(); }
+}
+//# sourceMappingURL=security.js.map

package/dist/security/bridge/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/security/bridge/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAI/D,OAAO,EAAE,iBAAiB,EAAsB,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAA4B,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAChH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACnF,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACrI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACxJ,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3I,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CAC5H,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAmC,EAAE;IACzE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IACnH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AACF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAoB,CAAC;AAGzH,MAAM,OAAO,qBAAqB;IAWX;IAAqC;IAA4C;IAV7F,QAAQ,CAAC;IACT,aAAa,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,CAAoB;IAC1B,KAAK,CAAmB;IAChB,GAAG,CAAe;IAClB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClD,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,QAAQ,GAAG,IAAI,OAAO,EAAuB,CAAC;IACvD,MAAM,GAAG,KAAK,CAAC;IACvB,YAAqB,QAA0B,EAAW,QAAgB,EAAE,OAAe,EAAW,OAA8B;QAA/G,aAAQ,GAAR,QAAQ,CAAkB;QAAW,aAAQ,GAAR,QAAQ,CAAQ;QAA4B,YAAO,GAAP,OAAO,CAAuB;QAClI,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAAC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC;IACO,OAAO,CAAC,KAA8B;QAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACpG,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE;YAC/E,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE;gBACtE,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;oBAC7C,CAAC,CAAC,UAAU,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjE,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACzH,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACO,SAAS,CAAC,QAAwB,EAAE,UAAmB;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG,GAAG,KAAK,IAAI,QAAQ,CAAC,SAAS,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;YACtH,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,UAAU,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAClH,CAAC;IACO,KAAK,CAAC,QAAwB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,OAAO,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IACO,KAAK,CAAC,MAAM,CAAC,MAAoC,EAAE,QAAwB,EAAE,KAA8B;QACjH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACjH,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,CAAC;QACnF,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QAAC,CAAC;IAC9D,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,SAAuC,EAAE,OAAkC,EAAE,IAAa,EAC5G,KAA8B,EAAE,YAAoB,UAAU,EAAE;QAChE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE;YAChI,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS;YACnG,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,MAAyC,EAAE,KAA8B;QAC7F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClK,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;gBAC9G,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACjK,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC5H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrL,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9I,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClK,CAAC;IACO,gBAAgB,CAAC,KAAc;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvJ,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3D,CAAC;IACO,WAAW,CAAC,WAA8B,EAAE,SAAkC;QACpF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7G,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC;uBAC9F,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,SAAS;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACtI,OAAO,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;mBACtG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC5I,OAAO,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,iBAAiB,CAAC;mBAChG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACpN,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS;mBACjE,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACpI,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACpH,OAAO,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC;IACO,KAAK,CAAC,SAAS,CAAC,QAAwB,EAAE,SAA4B,EAAE,GAAsB,EAAE,SAA8B;QACpI,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAA4B,GAAG,CAAC,GAAG,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE;YACtH,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,MAAsB,EAAE,KAA8B;QAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,OAAO,KAAK,aAAa;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;mBAC7E,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC7J,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,gGAAgG;QAChG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;YAClF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;YAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;mBAC9G,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACpI,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,OAAO,CAAC;QAC7C,CAAC;QACD,IAAI,SAA8B,CAAC;QACnC,IAAI,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QACjD,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACjD,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3I,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QACtE,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC/H,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,OAAO,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,SAA4B,IAAmB,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1G,uGAAuG;IACvG,KAAK,CAAC,qBAAqB,CAAC,OAA4B,EAAE,KAA8B;QACtF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;eACzF,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;eAC1F,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtG,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,aAAa;YAC/F,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI;YAC9E,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI;oBACjG,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClH,mFAAmF;QACnF,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,OAA4B,EAAE,MAAuD,EAAE,YAA2B,IAAI;QACnI,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAC3F,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,WAA8B,EAAE,KAA8B;QAC9F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EACrF,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,WAA8B;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAClD,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACpJ,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QAC3J,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,gBAAgB,CAAC,KAAiD,EAAE,OAA0B,IAA+B,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnL,WAAW,CAAC,KAAwB,IAAiC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtG,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,QAAqB;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE;YAChK,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/E,CAAC;IACD,WAAW,CAAC,KAAwB,EAAE,OAAe,IAAqD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3J,KAAK,CAAC,cAAc,CAAC,KAAwB,EAAE,UAAkB;QAC/D,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IACD,SAAS,CAAC,QAAsC,IAAgB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzI,KAAK,CAAC,KAAK,KAAoB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACrJ"}

package/dist/security/bridge/snapshot.d.ts

@@ -0,0 +1,14 @@
+import type { z } from 'zod';
+/** One process owns each instance directory. Never publish in-memory state before durable replacement. */
+export declare class AtomicSnapshot<T> {
+    private readonly file;
+    private readonly schema;
+    private readonly initial;
+    private tail;
+    constructor(file: string, schema: z.ZodType<T>, initial: () => T);
+    private load;
+    private save;
+    transact<R>(update: (state: T) => R | Promise<R>): Promise<R>;
+    read<R>(select: (state: T) => R): Promise<R>;
+    close(): Promise<void>;
+}

package/dist/security/bridge/snapshot.js

@@ -0,0 +1,77 @@
+import { mkdir, open, rename, rm } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { BridgeSecurityError } from './errors.js';
+/** One process owns each instance directory. Never publish in-memory state before durable replacement. */
+export class AtomicSnapshot {
+    file;
+    schema;
+    initial;
+    tail = Promise.resolve();
+    constructor(file, schema, initial) {
+        this.file = file;
+        this.schema = schema;
+        this.initial = initial;
+    }
+    async load() {
+        let handle;
+        try {
+            handle = await open(this.file, 'r');
+            if ((await handle.stat()).size > 64 * 1024 * 1024)
+                throw new Error('Oversize snapshot');
+            return this.schema.parse(JSON.parse(await handle.readFile('utf8')));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return this.initial();
+            throw new BridgeSecurityError('storage_unavailable');
+        }
+        finally {
+            await handle?.close();
+        }
+    }
+    async save(value) {
+        const directory = dirname(this.file);
+        const temporary = `${this.file}.${randomUUID()}.tmp`;
+        try {
+            await mkdir(directory, { recursive: true, mode: 0o700 });
+            const handle = await open(temporary, 'wx', 0o600);
+            try {
+                await handle.writeFile(JSON.stringify(this.schema.parse(value)));
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await rename(temporary, this.file);
+            const parent = await open(directory, 'r');
+            try {
+                await parent.sync();
+            }
+            finally {
+                await parent.close();
+            }
+        }
+        catch {
+            await rm(temporary, { force: true }).catch(() => undefined);
+            throw new BridgeSecurityError('storage_unavailable');
+        }
+    }
+    transact(update) {
+        const run = this.tail.then(async () => {
+            const state = await this.load();
+            const result = await update(state);
+            await this.save(state);
+            return structuredClone(result);
+        });
+        this.tail = run.catch(() => undefined);
+        return run;
+    }
+    read(select) {
+        const run = this.tail.then(async () => structuredClone(select(await this.load())));
+        this.tail = run.catch(() => undefined);
+        return run;
+    }
+    async close() { await this.tail; }
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/security/bridge/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../../src/security/bridge/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,0GAA0G;AAC1G,MAAM,OAAO,cAAc;IAEI;IAA+B;IAAuC;IAD3F,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,YAA6B,IAAY,EAAmB,MAAoB,EAAmB,OAAgB;QAAtF,SAAI,GAAJ,IAAI,CAAQ;QAAmB,WAAM,GAAN,MAAM,CAAc;QAAmB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IAE/G,KAAK,CAAC,IAAI;QAChB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAQ;QACzB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;oBACtF,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACjC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,QAAQ,CAAI,MAAoC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAI,MAAuB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;CAClD"}

package/dist/security/crypto.d.ts

@@ -0,0 +1,17 @@
+import type { EndpointIdentity, EndpointKind, EndpointPublic, EnvelopeHeader, OpenContext, SecureEnvelope, SecurePublication, SecurityErrorCode, SecurityFailure } from './protocol.js';
+/** Wire limits apply to serialized UTF-8, including headers and base64 expansion. */
+export declare const MAX_ENVELOPE_BYTES = 450000;
+/** A safe, stable error: underlying crypto/input details never cross this boundary. */
+export declare class SecurityError extends Error implements SecurityFailure {
+    readonly code: SecurityErrorCode;
+    readonly retryable: boolean;
+    constructor(code: SecurityErrorCode, message: string, retryable?: boolean);
+}
+export declare function parseSecureEnvelope(value: unknown): SecureEnvelope;
+export declare function parseSecurePublication(value: unknown): SecurePublication;
+export declare function exportPublicKey(key: CryptoKey): Promise<string>;
+export declare function importPublicKey(raw: string): Promise<CryptoKey>;
+export declare function generateEndpoint(ownerId: string, kind: EndpointKind, extractable?: boolean): Promise<EndpointIdentity>;
+export declare function importEndpoint(endpoint: EndpointPublic, privateKey: JsonWebKey, extractable?: boolean): Promise<EndpointIdentity>;
+export declare function seal(identity: EndpointIdentity, recipient: EndpointPublic, input: EnvelopeHeader, plaintext: Uint8Array): Promise<SecureEnvelope>;
+export declare function open(identity: EndpointIdentity, sender: EndpointPublic, value: SecureEnvelope, expected: OpenContext): Promise<Uint8Array>;