ftown 0.19.52 → 0.19.53

package/dist/mcp/test-support.js

@@ -0,0 +1,120 @@
+/** Isolated test adapters. Production gateway always uses PostgreSQL + provisioned wrapping key. */
+import { randomBytes, randomUUID } from 'node:crypto';
+import jwt from 'jsonwebtoken';
+import { generateEndpoint, seal } from '../security/crypto.js';
+import { validateSecurityEvent } from './security-events.js';
+import { BridgeSecurityService, applicationJson } from '../security/bridge/security.js';
+import { LOCAL_RECOVERY_AUTHORITY } from '../security/bridge/policy.js';
+export const TEST_OWNER_A = '349f8d2e-38e4-4d59-888d-687dcfa19e39';
+export const TEST_OWNER_B = '619f68a6-77c1-49f6-ae2d-c5fa169d284b';
+export class TestIdentityStore {
+    records = new Map();
+    bridges = new Map();
+    async bridge(ownerId, bridgeId) {
+        const key = `${ownerId}:${bridgeId}`;
+        const existing = this.bridges.get(key);
+        if (existing)
+            return existing;
+        const identity = await generateEndpoint(ownerId, 'bridge');
+        this.bridges.set(key, identity);
+        return identity;
+    }
+    async ensurePendingIdentity(requestId, ownerId, permissions) {
+        let record = this.records.get(requestId);
+        if (!record) {
+            record = { ownerId, requestId, grantId: randomBytes(32).toString('base64url'), identity: await generateEndpoint(ownerId, 'mcp'),
+                bridges: [], permissions, pendingExpiresAt: new Date(Date.now() + 300_000).toISOString(), activeExpiresAt: new Date(Date.now() + 2_592_000_000).toISOString(), state: 'pending' };
+            this.records.set(requestId, record);
+        }
+        if (record.ownerId !== ownerId || record.state !== 'pending')
+            throw new Error('test identity rejected');
+        return { requestId, grantId: record.grantId, endpoint: record.identity.endpoint, expiresAt: record.pendingExpiresAt, activeExpiresAt: record.activeExpiresAt, permissions: record.permissions };
+    }
+    async loadByRequest(ownerId, requestId) {
+        const record = this.records.get(requestId);
+        if (!record || record.ownerId !== ownerId)
+            throw new Error('test identity rejected');
+        return record;
+    }
+    async loadGrantIdentity(ownerId, grantId) {
+        const record = [...this.records.values()].find(value => value.grantId === grantId && value.ownerId === ownerId);
+        if (!record || !['approved', 'active'].includes(record.state))
+            throw new Error('test identity rejected');
+        return record;
+    }
+    async approve(ownerId, requestId, bridges) {
+        const record = await this.loadByRequest(ownerId, requestId);
+        if (record.state !== 'pending')
+            throw new Error('test identity rejected');
+        record.bridges = bridges;
+        record.state = 'approved';
+        return record;
+    }
+    async markActive(ownerId, requestId) { (await this.loadByRequest(ownerId, requestId)).state = 'active'; }
+    async revoke(ownerId, requestId) { (await this.loadByRequest(ownerId, requestId)).state = 'revoked'; }
+}
+export class TestAuditStore {
+    events = [];
+    unavailable = false;
+    async admit(event) { if (this.unavailable)
+        throw new Error('test storage failure'); this.events.push(validateSecurityEvent(structuredClone(event))); }
+    async finish(event, outcome) {
+        if (this.unavailable)
+            throw new Error('test storage failure');
+        const index = this.events.findIndex(row => row.id === event.id);
+        if (index < 0)
+            throw new Error('missing test admission');
+        this.events[index] = validateSecurityEvent({ ...event, ...outcome, finishedAt: new Date().toISOString() });
+    }
+}
+export async function testRequestContext(bridgeIds = ['a']) {
+    const keys = new TestIdentityStore();
+    const pending = await keys.ensurePendingIdentity(randomBytes(32).toString('base64url'), TEST_OWNER_A, ['read', 'control']);
+    const bridges = [];
+    for (const bridgeId of bridgeIds)
+        bridges.push({ bridgeId, endpoint: (await keys.bridge(TEST_OWNER_A, bridgeId)).endpoint, permissions: ['read', 'control'] });
+    const grant = await keys.approve(TEST_OWNER_A, pending.requestId, bridges);
+    await keys.markActive(TEST_OWNER_A, pending.requestId);
+    return { grant, action: { actionId: randomUUID(), parentActionId: null, clientId: 'fixture-client', grantId: grant.grantId, tool: 'sessions_get', operation: null } };
+}
+export async function attachTestSecurity(api, dataDir, bridgeId) {
+    const identity = await generateEndpoint(TEST_OWNER_A, 'bridge');
+    const security = new BridgeSecurityService(identity, bridgeId, dataDir, { relayUserId: 'owner@example.test' });
+    const browser = await generateEndpoint(TEST_OWNER_A, 'browser');
+    const invitation = await security.policy.createInvitation(LOCAL_RECOVERY_AUTHORITY, { label: 'Test admin' });
+    await security.policy.consumeInvitation({ type: 'enroll', candidate: browser.endpoint, invitationId: invitation.invitationId, invitationSecret: invitation.secret, label: 'Test admin' });
+    const keys = new TestIdentityStore();
+    const details = await keys.ensurePendingIdentity(randomBytes(32).toString('base64url'), TEST_OWNER_A, ['read', 'control']);
+    await security.approveMcp(await security.policy.principal(browser.endpoint.id), { requestId: details.requestId, grantId: details.grantId, endpoint: details.endpoint, permissions: details.permissions, expiresAt: details.expiresAt, activeExpiresAt: details.activeExpiresAt });
+    const grant = await keys.approve(TEST_OWNER_A, details.requestId, [{ bridgeId, endpoint: identity.endpoint, permissions: ['read', 'control'] }]);
+    await keys.markActive(TEST_OWNER_A, details.requestId);
+    const context = { grant, action: { actionId: randomUUID(), parentActionId: null, clientId: 'fixture-client', grantId: grant.grantId, tool: 'sessions_get', operation: null } };
+    api.setSecurity(security, { protocolVersion: 1, ownerId: TEST_OWNER_A, bridgeId, endpoint: identity.endpoint, relayUserId: 'owner@example.test' }, async (message) => {
+        if (message.application.route.kind !== 'command' || message.application.route.command !== 'security_activate_mcp')
+            throw new Error('unsupported test command');
+        return applicationJson({ type: 'command_response', response: { requestId: message.application.route.requestId, success: true, data: await security.activateMcp(message.principal, grant.grantId) } });
+    });
+    return { security, context };
+}
+export async function approvalAssertion(provider, keys, requestId, ownerId, machines, secret, approve) {
+    const options = { subject: ownerId, issuer: provider.options.loginUrl, audience: provider.options.publicUrl, expiresIn: 60 };
+    const details = await provider.consentDetails(jwt.sign({ request: requestId, purpose: 'inspect' }, secret, options));
+    const approvals = [];
+    for (const machine of machines) {
+        if (approve) {
+            approvals.push(await approve(details.security, machine));
+            continue;
+        }
+        const bridge = await keys.bridge(ownerId, machine);
+        const receipt = await seal(bridge, details.security.endpoint, {
+            type: 'ftown_encrypted', version: 1, senderId: bridge.endpoint.id, recipientId: details.security.endpoint.id,
+            ownerId, bridgeId: machine, channel: `mcp-approval:${machine}:${requestId}`, purpose: 'mcp-approval', messageId: randomUUID(),
+            createdAt: Date.now(), expiresAt: Date.now() + 120_000, receiverEpoch: null,
+        }, new TextEncoder().encode(JSON.stringify({ type: 'mcp-approval', approvalId: randomUUID(), requestId, ownerId,
+            grantId: details.security.grantId, candidateEndpointId: details.security.endpoint.id, bridgeId: machine, bridge: bridge.endpoint,
+            permissions: details.security.permissions, expiresAt: details.security.expiresAt, activeExpiresAt: details.security.activeExpiresAt })));
+        approvals.push({ bridgeId: machine, bridge: bridge.endpoint, receipt });
+    }
+    return jwt.sign({ request: requestId, purpose: 'approve', machines, approvals }, secret, options);
+}
+//# sourceMappingURL=test-support.js.map

package/dist/mcp/test-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-support.js","sourceRoot":"","sources":["../../src/mcp/test-support.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAI/D,OAAO,EAAE,qBAAqB,EAAwB,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,MAAM,CAAC,MAAM,YAAY,GAAG,sCAAsC,CAAC;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,sCAAsC,CAAC;AACnE,MAAM,OAAO,iBAAiB;IACnB,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC9C,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACvD,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC;QAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAAC,OAAO,QAAQ,CAAC;IAC/G,CAAC;IACD,KAAK,CAAC,qBAAqB,CAAC,SAAiB,EAAE,OAAe,EAAE,WAAmC;QACjG,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;gBAC7H,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACpL,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACxG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAClM,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,SAAiB;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IAClJ,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,OAAe;QACtD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAChH,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IAC1H,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAyB;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAAC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACvI,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QAAC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC;QAAC,OAAO,MAAM,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,SAAiB,IAAmB,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,SAAiB,IAAmB,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC;CACtI;AACD,MAAM,OAAO,cAAc;IAChB,MAAM,GAAoB,EAAE,CAAC;IACtC,WAAW,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,KAAK,CAAC,KAAoB,IAAmB,IAAI,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpL,KAAK,CAAC,MAAM,CAAC,KAAoB,EAAE,OAAwB;QACzD,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7G,CAAC;CACF;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAsB,CAAC,GAAG,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/J,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;AACxK,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAmB,EAAE,OAAe,EAAE,QAAgB;IAC7F,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7G,MAAM,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1L,MAAM,IAAI,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3H,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAClR,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACjJ,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,OAAO,GAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;IAClM,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACjK,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,uBAAuB;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC/J,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACxM,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA4B,EAAE,IAAuB,EAAE,SAAiB,EAAE,OAAe,EACzF,QAAkB,EAAE,MAAc,EAAE,OAAuF;IAE3H,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC7H,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrH,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,EAAE,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;YAC5D,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAC5G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,OAAO,IAAI,SAAS,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE;YAC7H,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,IAAI;SAC5E,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO;YAC7G,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ;YAChI,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3I,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACpG,CAAC"}

package/dist/mcp-cli.js

@@ -5,6 +5,8 @@ import { FleetRelay } from "./mcp/relay.js";
 import { createGateway, gatewayConfigSchema } from "./mcp/http.js";
 import { FtownOAuthProvider } from "./mcp/oauth.js";
 import { PostgresOAuthStore } from "./mcp/oauth-store.js";
+import { McpKeyStore } from './mcp/mcp-key-store.js';
+import { SecurityEventStore } from './mcp/security-events.js';
 async function main() {
     const args = process.argv.slice(2);
     if (args.length === 1 && args[0] === "--proxy") {
@@ -26,7 +28,7 @@ async function main() {
         return;
     }
     if (args[0] === "--help") {
-        console.log("Usage: ftown-mcp --config /absolute/path/gateway.json\nHTTPS Streamable HTTP MCP gateway (TLS terminated by Fly/reverse proxy).\nRequires DATABASE_URL and FTOWN_MCP_APPROVAL_SECRET. No MCP stdio mode.");
+        console.log("Usage: ftown-mcp --config /absolute/path/gateway.json\nHTTPS Streamable HTTP MCP gateway (TLS terminated by Fly/reverse proxy).\nRequires DATABASE_URL, FTOWN_MCP_APPROVAL_SECRET and separately provisioned FTOWN_MCP_KEY_ENCRYPTION_SECRET / FTOWN_MCP_KEY_ENCRYPTION_KEY_ID. No MCP stdio mode.");
         return;
     }
     if (args.length && !(args.length === 2 && args[0] === "--config"))
@@ -41,45 +43,63 @@ async function main() {
     const secret = process.env.FTOWN_MCP_APPROVAL_SECRET;
     if (!secret || secret.length < 32 || !process.env.DATABASE_URL)
         throw new Error("Database and approval secret are required");
+    const wrapping = process.env.FTOWN_MCP_KEY_ENCRYPTION_SECRET;
+    const keyId = process.env.FTOWN_MCP_KEY_ENCRYPTION_KEY_ID;
+    if (!wrapping || !/^[A-Za-z0-9_-]{43}$/.test(wrapping) || !keyId || !/^[A-Za-z0-9_-]{1,64}$/.test(keyId))
+        throw new Error('Provision MCP key encryption secret and key ID before startup');
+    const wrappingKey = Uint8Array.from(Buffer.from(wrapping, 'base64url'));
+    if (wrappingKey.length !== 32 || Buffer.from(wrappingKey).toString('base64url') !== wrapping)
+        throw new Error('Invalid MCP key encryption configuration');
     const store = new PostgresOAuthStore(process.env.DATABASE_URL);
-    // Fail startup if the migration or database is unavailable.
-    await store.pool.query("SELECT 1 FROM mcp_oauth_records LIMIT 1");
-    const provider = new FtownOAuthProvider(store, {
-        ...config,
-        approvalSecret: secret,
-    });
-    const port = Number(process.env.PORT ?? 8080);
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
-        throw new Error("Invalid PORT");
-    let relay;
-    if (config.fleet.machines.some((m) => m.transport === "relay")) {
-        const url = process.env.CENTRIFUGO_URL, key = process.env.CENTRIFUGO_TOKEN_SECRET;
-        if (!url || new URL(url).protocol !== "wss:" || !key || key.length < 32)
-            throw new Error("Secure relay config is required");
-        relay = new FleetRelay(url, key);
-    }
-    const server = createGateway(config, provider, relay).listen(port, process.env.HOST ?? "127.0.0.1", () => console.error(`ftown-mcp: listening behind HTTPS ingress on port ${port}`));
-    server.requestTimeout = 65000;
-    server.headersTimeout = 10000;
-    let closing = false;
-    for (const signal of ["SIGINT", "SIGTERM"])
-        process.on(signal, () => {
-            if (closing)
-                return;
-            closing = true;
-            server.close(() => {
-                relay?.close();
-                void store.pool.end();
+    const keys = new McpKeyStore(store.pool, { keyId, key: wrappingKey });
+    const audit = new SecurityEventStore(store.pool);
+    try {
+        // Fail startup if the migration or database is unavailable.
+        await store.pool.query("SELECT 1 FROM mcp_oauth_records LIMIT 1");
+        await keys.checkSchema();
+        await audit.start();
+        const provider = new FtownOAuthProvider(store, {
+            ...config,
+            approvalSecret: secret,
+        }, keys);
+        const port = Number(process.env.PORT ?? 8080);
+        if (!Number.isInteger(port) || port < 1 || port > 65535)
+            throw new Error("Invalid PORT");
+        let relay;
+        if (config.fleet.machines.some((m) => m.transport === "relay")) {
+            const url = process.env.CENTRIFUGO_URL, key = process.env.CENTRIFUGO_TOKEN_SECRET;
+            if (!url || new URL(url).protocol !== "wss:" || !key || key.length < 32)
+                throw new Error("Secure relay config is required");
+            relay = new FleetRelay(url, key);
+        }
+        const server = createGateway(config, provider, relay, audit).listen(port, process.env.HOST ?? "127.0.0.1", () => console.error(`ftown-mcp: listening behind HTTPS ingress on port ${port}`));
+        server.requestTimeout = 65000;
+        server.headersTimeout = 10000;
+        let closing = false;
+        for (const signal of ["SIGINT", "SIGTERM"])
+            process.on(signal, () => {
+                if (closing)
+                    return;
+                closing = true;
+                server.close(() => {
+                    relay?.close();
+                    void audit.close().finally(() => store.pool.end());
+                });
+                setTimeout(() => {
+                    server.closeAllConnections();
+                    relay?.close();
+                    void audit.close().finally(() => store.pool.end());
+                }, 30000).unref();
             });
-            setTimeout(() => {
-                server.closeAllConnections();
-                relay?.close();
-                void store.pool.end();
-            }, 30000).unref();
-        });
+    }
+    catch (error) {
+        await audit.close().catch(() => { });
+        await store.pool.end();
+        throw error;
+    }
 }
 main().catch(() => {
-    console.error("ftown-mcp: startup failed; check gateway config, database migration and approval secret");
+    console.error("ftown-mcp: startup failed; check gateway config, database migration and separately provisioned secrets");
     process.exitCode = 1;
 });
 //# sourceMappingURL=mcp-cli.js.map

package/dist/mcp-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-cli.js","sourceRoot":"","sources":["../src/mcp-cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/C,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI;oBACxC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,MAAM,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;aACjE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,0MAA0M,CAC3M,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI;QACd,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;QAC5D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/D,4DAA4D;IAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE;QAC7C,GAAG,MAAM;QACT,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QACrD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,IAAI,KAA6B,CAAC;IAClC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EACpC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;YACrE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAC1D,IAAI,EACJ,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,WAAW,EAC/B,GAAG,EAAE,CACH,OAAO,CAAC,KAAK,CACX,qDAAqD,IAAI,EAAE,CAC5D,CACJ,CAAC;IACF,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAC9B,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU;QACjD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,KAAK,EAAE,CAAC;gBACf,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,KAAK,EAAE,KAAK,EAAE,CAAC;gBACf,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;AACP,CAAC;AACD,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;IAChB,OAAO,CAAC,KAAK,CACX,yFAAyF,CAC1F,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"mcp-cli.js","sourceRoot":"","sources":["../src/mcp-cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/C,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI;oBACxC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,MAAM,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;aACjE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,oSAAoS,CACrS,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI;QACd,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;QAC5D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC3L,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACxE,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1J,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC;QACL,4DAA4D;QAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE;YAC7C,GAAG,MAAM;YACT,cAAc,EAAE,MAAM;SACvB,EAAE,IAAI,CAAC,CAAC;QACT,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;YACrD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,IAAI,KAA6B,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EACpC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAC5C,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,CACjE,IAAI,EACJ,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,WAAW,EAC/B,GAAG,EAAE,CACH,OAAO,CAAC,KAAK,CACX,qDAAqD,IAAI,EAAE,CAC5D,CACJ,CAAC;QACF,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU;YACjD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBAChB,KAAK,EAAE,KAAK,EAAE,CAAC;oBACf,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;gBACH,UAAU,CAAC,GAAG,EAAE;oBACd,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,KAAK,EAAE,KAAK,EAAE,CAAC;oBACf,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACrD,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AACD,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;IAChB,OAAO,CAAC,KAAK,CACX,wGAAwG,CACzG,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/pairing-client.d.ts

@@ -33,6 +33,7 @@ export interface RunPairingOptions {
     log?: (msg: string) => void;
 }
 export interface PairingResult {
+    ownerId: string;
     token: string;
     refreshToken: string;
     centrifugoUrl: string;

package/dist/pairing-client.js

@@ -41,14 +41,14 @@ export async function runPairing(opts) {
         const poll = await postJson(fetchImpl, `${apiUrl}/api/auth/bridge/pair/poll`, {
             deviceCode,
             localPort,
-            localNonce,
         });
         switch (poll.status) {
             case 'approved': {
-                if (!poll.token || !poll.refreshToken || !poll.centrifugoUrl || !poll.userId) {
+                if (!poll.ownerId || !poll.token || !poll.refreshToken || !poll.centrifugoUrl || !poll.userId) {
                     throw new Error('Pairing approved but token bundle was incomplete');
                 }
                 return {
+                    ownerId: poll.ownerId,
                     token: poll.token,
                     refreshToken: poll.refreshToken,
                     centrifugoUrl: poll.centrifugoUrl,

package/dist/pairing-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"pairing-client.js","sourceRoot":"","sources":["../src/pairing-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyDH,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,UAAU,EACV,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,SAAS,EACrB,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAC9C,GAAG,IAAI,CAAC;IAET,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAoB,SAAS,EAAE,GAAG,MAAM,6BAA6B,EAAE;QACjG,QAAQ;QACR,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IAEH,8DAA8D;IAC9D,GAAG,CACD,gDAAgD;QAC9C,OAAO,KAAK,CAAC,eAAe,IAAI;QAChC,aAAa,KAAK,CAAC,QAAQ,IAAI;QAC/B,uBAAuB,CAC1B,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;IAEhD,4EAA4E;IAC5E,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAE5B,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,SAAS,EAAE,GAAG,MAAM,4BAA4B,EAAE;YAC9F,UAAU;YACV,SAAS;YACT,UAAU;SACX,CAAC,CAAC;QAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;YACJ,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,WAAW;gBACd,sEAAsE;gBACtE,MAAM,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBAChC,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpC,KAAK,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,KAAK,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,KAAK,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE;gBACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAE,IAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,SAAuB,EAAE,GAAW,EAAE,IAAa;IAC5E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC"}
+{"version":3,"file":"pairing-client.js","sourceRoot":"","sources":["../src/pairing-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA2DH,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,UAAU,EACV,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,SAAS,EACrB,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAC9C,GAAG,IAAI,CAAC;IAET,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAoB,SAAS,EAAE,GAAG,MAAM,6BAA6B,EAAE;QACjG,QAAQ;QACR,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IAEH,8DAA8D;IAC9D,GAAG,CACD,gDAAgD;QAC9C,OAAO,KAAK,CAAC,eAAe,IAAI;QAChC,aAAa,KAAK,CAAC,QAAQ,IAAI;QAC/B,uBAAuB,CAC1B,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;IAEhD,4EAA4E;IAC5E,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAE5B,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,SAAS,EAAE,GAAG,MAAM,4BAA4B,EAAE;YAC9F,UAAU;YACV,SAAS;SACV,CAAC,CAAC;QAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC9F,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;YACJ,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,WAAW;gBACd,sEAAsE;gBACtE,MAAM,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBAChC,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpC,KAAK,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,KAAK,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,KAAK,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE;gBACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAE,IAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,SAAuB,EAAE,GAAW,EAAE,IAAa;IAC5E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC"}

package/dist/push-notifier.js

@@ -94,7 +94,9 @@ export class BridgePushNotifier {
                             continue;
                         const response = await this.deps.fetch(`${this.options.apiUrl.replace(/\/$/, '')}/api/push/events`, {
                             method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-                            body: JSON.stringify({ ...item.notice, bridgeId: this.options.bridgeId, sessionId: item.sessionId, sessionName: session.name }),
+                            body: JSON.stringify({ kind: item.notice.kind, eventKey: item.notice.eventKey, occurredAt: item.notice.occurredAt,
+                                title: 'FTown attention', message: 'Open FTown to view details.', bridgeId: this.options.bridgeId,
+                                sessionId: item.sessionId, sessionName: 'FTown' }),
                             signal: controller.signal,
                         });
                         transient = response.status === 408 || response.status === 429 || response.status >= 500;

package/dist/push-notifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"push-notifier.js","sourceRoot":"","sources":["../src/push-notifier.ts"],"names":[],"mappings":"AAcA,MAAM,QAAQ,GAAiB,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG;IAChF,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACnE,qFAAqF;AACrF,MAAM,OAAO,kBAAkB;IAMT;IAA4C;IALxD,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACnC,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,KAAK,CAAiC;IACtC,QAAQ,CAAkD;IAClE,YAAoB,OAAkC,EAAU,OAAqB,QAAQ;QAAzE,YAAO,GAAP,OAAO,CAA2B;QAAU,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IACjG,MAAM,CAAC,SAAiB,EAAE,MAAkB;QAC1C,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO;QAChE,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG;YAAE,OAAO;QAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5I,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IACD,UAAU,CAAC,SAAiB;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAC1E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IACD,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC;IACO,IAAI;QACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;oBAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO;wBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,OAAO;gBAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACzG,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAChH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC3H,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;gBAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;gBACtF,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC9D,IAAI,CAAC,OAAO,EAAE;wBAAE,SAAS;oBACzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBACtJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC5C,IAAI,CAAC,OAAO,EAAE;wBAAE,SAAS;oBACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;oBACzC,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC/G,IAAI,CAAC;wBACH,IAAI,CAAC,OAAO,EAAE;4BAAE,SAAS;wBACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE;4BAClG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;4BACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;4BAC/H,MAAM,EAAE,UAAU,CAAC,MAAM;yBAC1B,CAAC,CAAC;wBACH,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;oBAC3F,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI;4BAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,CAAC;gBAC7B,IAAI,CAAC,OAAO,EAAE;oBAAE,SAAS;gBACzB,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACxF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5G,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC9C,CAAC;QACH,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QAAC,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"push-notifier.js","sourceRoot":"","sources":["../src/push-notifier.ts"],"names":[],"mappings":"AAcA,MAAM,QAAQ,GAAiB,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG;IAChF,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACnE,qFAAqF;AACrF,MAAM,OAAO,kBAAkB;IAMT;IAA4C;IALxD,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACnC,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,KAAK,CAAiC;IACtC,QAAQ,CAAkD;IAClE,YAAoB,OAAkC,EAAU,OAAqB,QAAQ;QAAzE,YAAO,GAAP,OAAO,CAA2B;QAAU,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IACjG,MAAM,CAAC,SAAiB,EAAE,MAAkB;QAC1C,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO;QAChE,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG;YAAE,OAAO;QAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5I,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IACD,UAAU,CAAC,SAAiB;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAC1E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IACD,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC;IACO,IAAI;QACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;oBAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO;wBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,OAAO;gBAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACzG,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAChH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC3H,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;gBAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;gBACtF,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC9D,IAAI,CAAC,OAAO,EAAE;wBAAE,SAAS;oBACzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBACtJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC5C,IAAI,CAAC,OAAO,EAAE;wBAAE,SAAS;oBACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;oBACzC,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC/G,IAAI,CAAC;wBACH,IAAI,CAAC,OAAO,EAAE;4BAAE,SAAS;wBACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE;4BAClG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;4BACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gCAC/G,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gCACjG,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;4BACpD,MAAM,EAAE,UAAU,CAAC,MAAM;yBAC1B,CAAC,CAAC;wBACH,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;oBAC3F,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI;4BAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,CAAC;gBAC7B,IAAI,CAAC,OAAO,EAAE;oBAAE,SAAS;gBACzB,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACxF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5G,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC9C,CAAC;QACH,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/security/bridge/audit.d.ts

@@ -0,0 +1,37 @@
+import type { SecurityEvent, SecurityEventStatus, SecurityPage, SecurityPageQuery } from '../protocol.js';
+export interface AuditAdmission {
+    admissionId: string;
+    actionId: string;
+    parentActionId: string | null;
+    clientId: string | null;
+    grantId: string | null;
+    endpointId: string | null;
+    tool: string;
+    operation: string | null;
+    sessionId: string | null;
+    mutating: boolean;
+}
+export interface AuditOptions {
+    now?: () => number;
+    maxEvents?: number;
+}
+/** Durable received-operation evidence. Only fixed, bounded metadata is ever serialized. */
+export declare class BridgeAuditStore {
+    readonly ownerId: string;
+    readonly bridgeId: string;
+    private readonly snapshot;
+    private readonly now;
+    private readonly maxEvents;
+    private ready?;
+    constructor(dataDir: string, ownerId: string, bridgeId: string, options?: AuditOptions);
+    private check;
+    private prune;
+    initialize(): Promise<void>;
+    admit(input: AuditAdmission): Promise<{
+        event: SecurityEvent;
+        isNew: boolean;
+    }>;
+    finish(id: string, status: Exclude<SecurityEventStatus, 'started'>, errorCode?: string | null): Promise<SecurityEvent>;
+    list(query?: SecurityPageQuery): Promise<SecurityPage>;
+    close(): Promise<void>;
+}

package/dist/security/bridge/audit.js

@@ -0,0 +1,185 @@
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { BridgeSecurityError } from './errors.js';
+import { boundedId } from './metadata.js';
+import { AtomicSnapshot } from './snapshot.js';
+const DAY = 86_400_000;
+const knownTools = new Set(['sessions_create', 'sessions_get', 'sessions_update', 'sessions_stop', 'sessions_retry', 'sessions_remove',
+    'sessions_revive', 'sessions_usage', 'sessions_running', 'chats_read', 'chats_search', 'messages_send', 'messages_read',
+    'terminal_input', 'terminal_resize', 'terminal_clear', 'whoami', 'attention_request', 'attention_inbox', 'attention_wait',
+    'attention_ack', 'attention_resolve', 'fleet_overview', 'machines_list', 'sessions_list', 'archive_list', 'messages_broadcast',
+    'sessions_wait', 'fleet_batch', 'chats_search_fleet', 'unknown_tool', 'invalid_tool']);
+const safeCodes = new Set(['security_setup_required', 'storage_unavailable', 'upgrade_required', 'approval_required', 'endpoint_revoked',
+    'invalid_envelope', 'authentication_failed', 'wrong_context', 'expired', 'replayed', 'epoch_changed', 'permission_denied',
+    'capacity_exceeded', 'audit_unavailable', 'outcome_unknown', 'bridge_offline', 'invalid_cursor', 'key_unavailable',
+    'unknown_session', 'unknown_attention', 'attention_storage_error', 'cancelled', 'attention_not_ready', 'timeout', 'connection_error',
+    'bridge_error', 'response_too_large', 'internal_error', 'interrupted']);
+const safeOperation = /^[a-z][a-z0-9_]{0,63}$/;
+const eventSchema = z.object({ version: z.literal(1), id: z.string().uuid(), actionId: boundedId, parentActionId: boundedId.nullable(),
+    ownerId: z.string().min(1).max(200), source: z.literal('bridge'), bridgeId: boundedId, clientId: boundedId.nullable(),
+    grantId: boundedId.nullable(), endpointId: boundedId.nullable(), tool: z.string().max(64), operation: z.string().max(64).nullable(),
+    sessionId: boundedId.nullable(), startedAt: z.string().datetime(), finishedAt: z.string().datetime().nullable(),
+    status: z.enum(['started', 'succeeded', 'rejected', 'failed', 'unknown']), errorCode: z.string().max(64).nullable(), mutating: z.boolean() }).strict();
+const stateSchema = z.object({ version: z.literal(1), ownerId: z.string(), bridgeId: z.string(), epoch: z.string().uuid(),
+    sequence: z.number().int().nonnegative(), prunedThrough: z.number().int().nonnegative(), pruning: z.number().int().nonnegative().optional(), truncated: z.boolean(),
+    entries: z.array(z.object({ sequence: z.number().int().positive(), admissionId: boundedId, event: eventSchema }).strict()).max(10000) }).strict();
+const cursorSchema = z.object({ v: z.literal(1), ownerId: z.string(), bridgeId: z.string(), epoch: z.string().uuid(),
+    snapshot: z.number().int().nonnegative(), before: z.number().int().positive(), pruning: z.number().int().nonnegative().default(0) }).strict();
+/** Durable received-operation evidence. Only fixed, bounded metadata is ever serialized. */
+export class BridgeAuditStore {
+    ownerId;
+    bridgeId;
+    snapshot;
+    now;
+    maxEvents;
+    ready;
+    constructor(dataDir, ownerId, bridgeId, options = {}) {
+        this.ownerId = ownerId;
+        this.bridgeId = bridgeId;
+        this.now = options.now ?? Date.now;
+        this.maxEvents = options.maxEvents ?? 10000;
+        if (!Number.isInteger(this.maxEvents) || this.maxEvents < 1 || this.maxEvents > 10000)
+            throw new BridgeSecurityError('capacity_exceeded');
+        this.snapshot = new AtomicSnapshot(join(dataDir, 'security', 'activity.json'), stateSchema, () => ({
+            version: 1, ownerId, bridgeId, epoch: randomUUID(), sequence: 0, prunedThrough: 0, pruning: 0, truncated: false, entries: [],
+        }));
+    }
+    check(state) {
+        if (state.ownerId !== this.ownerId || state.bridgeId !== this.bridgeId)
+            throw new BridgeSecurityError('wrong_context');
+        state.pruning ??= 0;
+    }
+    prune(state, reserve = 0) {
+        const cutoff = this.now() - 30 * DAY;
+        const retained = state.entries.filter(entry => entry.event.status === 'started' || Date.parse(entry.event.startedAt) >= cutoff);
+        const removed = state.entries.filter(entry => entry.event.status !== 'started' && Date.parse(entry.event.startedAt) < cutoff);
+        while (retained.length + reserve > this.maxEvents) {
+            const finished = retained.findIndex(entry => entry.event.status !== 'started');
+            if (finished < 0)
+                throw new BridgeSecurityError('audit_unavailable');
+            removed.push(...retained.splice(finished, 1));
+        }
+        if (removed.length) {
+            state.prunedThrough = Math.max(state.prunedThrough, ...removed.map(entry => entry.sequence));
+            state.pruning = (state.pruning ?? 0) + 1;
+            state.truncated = true;
+        }
+        state.entries = retained;
+    }
+    async initialize() {
+        if (!this.ready)
+            this.ready = this.snapshot.transact(state => {
+                this.check(state);
+                for (const entry of state.entries)
+                    if (entry.event.status === 'started') {
+                        entry.event.status = 'unknown';
+                        entry.event.finishedAt = new Date(this.now()).toISOString();
+                        entry.event.errorCode = 'interrupted';
+                    }
+                this.prune(state);
+            }).catch(() => { throw new BridgeSecurityError('audit_unavailable'); });
+        await this.ready;
+    }
+    async admit(input) {
+        await this.initialize();
+        const timestamp = new Date(this.now()).toISOString();
+        let event;
+        try {
+            boundedId.parse(input.admissionId);
+            event = eventSchema.parse({ version: 1, id: randomUUID(), actionId: input.actionId, parentActionId: input.parentActionId,
+                ownerId: this.ownerId, source: 'bridge', bridgeId: this.bridgeId, clientId: input.clientId, grantId: input.grantId,
+                endpointId: input.endpointId, tool: knownTools.has(input.tool) ? input.tool : 'invalid_tool',
+                operation: input.operation !== null && safeOperation.test(input.operation) ? input.operation : null,
+                sessionId: input.sessionId, startedAt: timestamp, finishedAt: null, status: 'started', errorCode: null, mutating: input.mutating });
+        }
+        catch {
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+        try {
+            return await this.snapshot.transact(state => {
+                this.check(state);
+                this.prune(state);
+                const previous = state.entries.find(entry => entry.admissionId === input.admissionId);
+                if (previous) {
+                    const prior = previous.event;
+                    if (prior.actionId !== event.actionId || prior.endpointId !== event.endpointId || prior.operation !== event.operation
+                        || prior.tool !== event.tool || prior.sessionId !== event.sessionId || prior.mutating !== event.mutating
+                        || prior.grantId !== event.grantId || prior.clientId !== event.clientId || prior.parentActionId !== event.parentActionId) {
+                        throw new BridgeSecurityError('replayed');
+                    }
+                    return { event: prior, isNew: false };
+                }
+                this.prune(state, 1);
+                state.entries.push({ admissionId: input.admissionId, sequence: ++state.sequence, event });
+                return { event, isNew: true };
+            });
+        }
+        catch (error) {
+            if (error instanceof BridgeSecurityError && error.code === 'replayed')
+                throw error;
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+    }
+    async finish(id, status, errorCode = null) {
+        await this.initialize();
+        try {
+            return await this.snapshot.transact(state => {
+                this.check(state);
+                const entry = state.entries.find(item => item.event.id === id);
+                if (!entry)
+                    throw new BridgeSecurityError('audit_unavailable');
+                if (entry.event.status !== 'started')
+                    return entry.event;
+                entry.event.status = status;
+                entry.event.finishedAt = new Date(this.now()).toISOString();
+                entry.event.errorCode = errorCode === null ? null : safeCodes.has(errorCode) ? errorCode : 'internal_error';
+                return entry.event;
+            });
+        }
+        catch {
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+    }
+    async list(query = {}) {
+        await this.initialize();
+        if (query.bridgeId !== undefined && query.bridgeId !== this.bridgeId)
+            throw new BridgeSecurityError('wrong_context');
+        const limit = query.limit ?? 50;
+        if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+            throw new BridgeSecurityError('invalid_cursor');
+        let incoming;
+        if (query.cursor !== undefined) {
+            try {
+                if (query.cursor.length > 2000 || !/^[A-Za-z0-9_-]+$/.test(query.cursor))
+                    throw new Error('Invalid cursor');
+                incoming = cursorSchema.parse(JSON.parse(Buffer.from(query.cursor, 'base64url').toString('utf8')));
+                if (incoming.ownerId !== this.ownerId || incoming.bridgeId !== this.bridgeId || incoming.before > incoming.snapshot + 1)
+                    throw new Error('Wrong cursor context');
+            }
+            catch {
+                throw new BridgeSecurityError('invalid_cursor');
+            }
+        }
+        try {
+            return await this.snapshot.transact(state => {
+                this.check(state);
+                this.prune(state);
+                const reset = !!incoming && (incoming.epoch !== state.epoch || incoming.snapshot > state.sequence || incoming.pruning !== state.pruning);
+                const snapshot = incoming && !reset ? incoming.snapshot : state.sequence;
+                const before = incoming && !reset ? incoming.before : snapshot + 1;
+                const eligible = state.entries.filter(entry => entry.sequence <= snapshot && entry.sequence < before).reverse();
+                const page = eligible.slice(0, limit);
+                const nextCursor = eligible.length > page.length && page.length > 0 ? Buffer.from(JSON.stringify({ v: 1,
+                    ownerId: this.ownerId, bridgeId: this.bridgeId, epoch: state.epoch, snapshot, before: page.at(-1).sequence, pruning: state.pruning })).toString('base64url') : null;
+                return { events: page.map(entry => entry.event), nextCursor, retentionDays: 30, maxEvents: 10000,
+                    oldestAvailableAt: state.entries[0]?.event.startedAt ?? null, truncated: state.truncated, reset };
+            });
+        }
+        catch {
+            throw new BridgeSecurityError('audit_unavailable');
+        }
+    }
+    async close() { await this.ready; await this.snapshot.close(); }
+}
+//# sourceMappingURL=audit.js.map

package/dist/security/bridge/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/security/bridge/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB;IACpI,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe;IACvH,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB;IACzH,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,oBAAoB;IAC9H,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB;IACtI,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB;IACzH,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB;IAClH,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,WAAW,EAAE,qBAAqB,EAAE,SAAS,EAAE,kBAAkB;IACpI,cAAc,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,QAAQ,EAAE;IACpI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;IACrH,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnI,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/G,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzJ,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACvH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACnK,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEpJ,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAClH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAQhJ,4FAA4F;AAC5F,MAAM,OAAO,gBAAgB;IAKW;IAA0B;IAJ/C,QAAQ,CAAwB;IAChC,GAAG,CAAe;IAClB,SAAS,CAAS;IAC3B,KAAK,CAAiB;IAC9B,YAAY,OAAe,EAAW,OAAe,EAAW,QAAgB,EAAE,UAAwB,EAAE;QAAtE,YAAO,GAAP,OAAO,CAAQ;QAAW,aAAQ,GAAR,QAAQ,CAAQ;QAC9E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC1I,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;SAC7H,CAAC,CAAC,CAAC;IACN,CAAC;IACO,KAAK,CAAC,KAAY;QACxB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;IACtB,CAAC;IACO,KAAK,CAAC,KAAY,EAAE,OAAO,GAAG,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC;QAChI,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC;QAC9H,OAAO,QAAQ,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAC/E,IAAI,QAAQ,GAAG,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7F,KAAK,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACzC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC3D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO;oBAAE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBACxE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;wBAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;wBAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,aAAa,CAAC;oBACrI,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,KAAqB;QAC/B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,KAAkC,CAAC;QACvC,IAAI,CAAC;YACH,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;gBACtH,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;gBAClH,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;gBAC5F,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;gBACnG,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxI,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAAC,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;gBACtF,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;oBAC7B,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;2BAChH,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;2BACrG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;wBAC3H,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;oBAC5C,CAAC;oBACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBACxC,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,KAAK,CAAC;YACnF,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAA+C,EAAE,YAA2B,IAAI;QACvG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBAC/D,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;gBACzD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;gBAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzF,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC5G,OAAO,KAAK,CAAC,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAA2B,EAAE;QACtC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC1G,IAAI,QAAkD,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC5G,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnG,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACnK,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;gBACzI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzE,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;gBAChH,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBACrG,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvK,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK;oBAC9F,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YACtG,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAChF"}