ftown 0.19.53 → 0.19.54

package/dist/security/bridge/identity.d.ts

@@ -1,5 +1,441 @@
+import { z } from 'zod';
 import type { EndpointIdentity, EndpointKind } from '../protocol.js';
+import type { VerifiedAccountTrust } from '../account-protocol.js';
+export declare const identityRecordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    endpoint: z.ZodEffects<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        id: z.ZodString;
+        ownerId: z.ZodString;
+        kind: z.ZodEnum<["bridge", "browser", "mcp", "local-cli"]>;
+        publicKey: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }>, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }, {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    }>;
+    privateKey: z.ZodObject<{
+        kty: z.ZodLiteral<"EC">;
+        crv: z.ZodLiteral<"P-256">;
+        x: z.ZodString;
+        y: z.ZodString;
+        d: z.ZodString;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        kty: "EC";
+        crv: "P-256";
+        x: string;
+        y: string;
+        d: string;
+        key_ops?: string[] | undefined;
+        ext?: boolean | undefined;
+    }, {
+        kty: "EC";
+        crv: "P-256";
+        x: string;
+        y: string;
+        d: string;
+        key_ops?: string[] | undefined;
+        ext?: boolean | undefined;
+    }>;
+    accountBootstrap: z.ZodOptional<z.ZodObject<{
+        history: z.ZodType<import("../account-protocol.js").AccountHistory, z.ZodTypeDef, import("../account-protocol.js").AccountHistory>;
+        checkpoint: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            ownerId: z.ZodString;
+            rootId: z.ZodString;
+            head: z.ZodString;
+            revision: z.ZodNumber;
+            devices: z.ZodArray<z.ZodObject<{
+                endpoint: z.ZodEffects<z.ZodObject<{
+                    version: z.ZodLiteral<1>;
+                    id: z.ZodString;
+                    ownerId: z.ZodString;
+                    kind: z.ZodEnum<["bridge", "browser", "mcp", "local-cli"]>;
+                    publicKey: z.ZodString;
+                }, "strict", z.ZodTypeAny, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }>, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }>;
+                signingPublicKey: z.ZodString;
+                label: z.ZodString;
+                approvedAt: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }, {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }>, "many">;
+            bridges: z.ZodArray<z.ZodObject<{
+                bridgeId: z.ZodString;
+                endpoint: z.ZodEffects<z.ZodObject<{
+                    version: z.ZodLiteral<1>;
+                    id: z.ZodString;
+                    ownerId: z.ZodString;
+                    kind: z.ZodEnum<["bridge", "browser", "mcp", "local-cli"]>;
+                    publicKey: z.ZodString;
+                }, "strict", z.ZodTypeAny, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }>, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }, {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                }>;
+                label: z.ZodString;
+                approvedAt: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }, {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }>, "many">;
+            revokedDeviceIds: z.ZodArray<z.ZodString, "many">;
+            revokedBridgeIds: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            version: 1;
+            ownerId: string;
+            rootId: string;
+            revision: number;
+            head: string;
+            devices: {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }[];
+            bridges: {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }[];
+            revokedDeviceIds: string[];
+            revokedBridgeIds: string[];
+        }, {
+            version: 1;
+            ownerId: string;
+            rootId: string;
+            revision: number;
+            head: string;
+            devices: {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }[];
+            bridges: {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }[];
+            revokedDeviceIds: string[];
+            revokedBridgeIds: string[];
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        history: import("../account-protocol.js").AccountHistory;
+        checkpoint: {
+            version: 1;
+            ownerId: string;
+            rootId: string;
+            revision: number;
+            head: string;
+            devices: {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }[];
+            bridges: {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }[];
+            revokedDeviceIds: string[];
+            revokedBridgeIds: string[];
+        };
+    }, {
+        history: import("../account-protocol.js").AccountHistory;
+        checkpoint: {
+            version: 1;
+            ownerId: string;
+            rootId: string;
+            revision: number;
+            head: string;
+            devices: {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }[];
+            bridges: {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }[];
+            revokedDeviceIds: string[];
+            revokedBridgeIds: string[];
+        };
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    version: 1;
+    endpoint: {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    };
+    privateKey: {
+        kty: "EC";
+        crv: "P-256";
+        x: string;
+        y: string;
+        d: string;
+        key_ops?: string[] | undefined;
+        ext?: boolean | undefined;
+    };
+    accountBootstrap?: {
+        history: import("../account-protocol.js").AccountHistory;
+        checkpoint: {
+            version: 1;
+            ownerId: string;
+            rootId: string;
+            revision: number;
+            head: string;
+            devices: {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }[];
+            bridges: {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }[];
+            revokedDeviceIds: string[];
+            revokedBridgeIds: string[];
+        };
+    } | undefined;
+}, {
+    version: 1;
+    endpoint: {
+        id: string;
+        version: 1;
+        ownerId: string;
+        kind: "bridge" | "browser" | "mcp" | "local-cli";
+        publicKey: string;
+    };
+    privateKey: {
+        kty: "EC";
+        crv: "P-256";
+        x: string;
+        y: string;
+        d: string;
+        key_ops?: string[] | undefined;
+        ext?: boolean | undefined;
+    };
+    accountBootstrap?: {
+        history: import("../account-protocol.js").AccountHistory;
+        checkpoint: {
+            version: 1;
+            ownerId: string;
+            rootId: string;
+            revision: number;
+            head: string;
+            devices: {
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+                signingPublicKey: string;
+            }[];
+            bridges: {
+                bridgeId: string;
+                endpoint: {
+                    id: string;
+                    version: 1;
+                    ownerId: string;
+                    kind: "bridge" | "browser" | "mcp" | "local-cli";
+                    publicKey: string;
+                };
+                label: string;
+                approvedAt: string;
+            }[];
+            revokedDeviceIds: string[];
+            revokedBridgeIds: string[];
+        };
+    } | undefined;
+}>;
 /** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
 export declare function loadOrCreateIdentity(dataDir: string, ownerId: string, kind: 'bridge' | 'local-cli'): Promise<EndpointIdentity>;
 export declare function isLocalIdentityKind(kind: EndpointKind): kind is 'bridge' | 'local-cli';
 export declare function loadLocalIdentity(dataDir: string, ownerId: string): Promise<EndpointIdentity>;
+/** Absence alone permits virgin onboarding; corruption must never generate a new key/root. */
+export declare function readBoundBridgeIdentity(dataDir: string): Promise<{
+    identity: EndpointIdentity;
+    bootstrap?: VerifiedAccountTrust;
+} | null>;

package/dist/security/bridge/identity.js

@@ -5,16 +5,17 @@ import { generateEndpoint, importEndpoint } from '../crypto.js';
 import { endpointSchema } from './metadata.js';
 import { AtomicSnapshot } from './snapshot.js';
 import { BridgeSecurityError } from './errors.js';
-const recordSchema = z.object({ version: z.literal(1), endpoint: endpointSchema, privateKey: z.object({
+import { verifiedAccountSchema } from './account-state.js';
+export const identityRecordSchema = z.object({ version: z.literal(1), endpoint: endpointSchema, privateKey: z.object({
         kty: z.literal('EC'), crv: z.literal('P-256'), x: z.string(), y: z.string(), d: z.string(),
         key_ops: z.array(z.string()).optional(), ext: z.boolean().optional(),
-    }).strict() }).strict();
+    }).strict(), accountBootstrap: verifiedAccountSchema.optional() }).strict();
 /** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
 export async function loadOrCreateIdentity(dataDir, ownerId, kind) {
     const generated = await generateEndpoint(ownerId, kind, true);
     const jwk = await crypto.subtle.exportKey('jwk', generated.keyPair.privateKey);
-    const initial = recordSchema.parse({ version: 1, endpoint: generated.endpoint, privateKey: jwk });
-    const store = new AtomicSnapshot(join(dataDir, 'security', `${kind}-identity.json`), recordSchema, () => initial);
+    const initial = identityRecordSchema.parse({ version: 1, endpoint: generated.endpoint, privateKey: jwk });
+    const store = new AtomicSnapshot(join(dataDir, 'security', `${kind}-identity.json`), identityRecordSchema, () => initial);
     const saved = await store.transact(state => {
         if (state.endpoint.ownerId !== ownerId || state.endpoint.kind !== kind)
             throw new BridgeSecurityError('wrong_context');
@@ -30,7 +31,7 @@ export async function loadOrCreateIdentity(dataDir, ownerId, kind) {
 export function isLocalIdentityKind(kind) { return kind === 'bridge' || kind === 'local-cli'; }
 export async function loadLocalIdentity(dataDir, ownerId) {
     try {
-        const saved = recordSchema.parse(JSON.parse(await readFile(join(dataDir, 'security', 'local-cli-identity.json'), 'utf8')));
+        const saved = identityRecordSchema.parse(JSON.parse(await readFile(join(dataDir, 'security', 'local-cli-identity.json'), 'utf8')));
         if (saved.endpoint.ownerId !== ownerId || saved.endpoint.kind !== 'local-cli')
             throw new Error('Wrong local key');
         return await importEndpoint(saved.endpoint, saved.privateKey, false);
@@ -39,4 +40,25 @@ export async function loadLocalIdentity(dataDir, ownerId) {
         throw new BridgeSecurityError('key_unavailable');
     }
 }
+/** Absence alone permits virgin onboarding; corruption must never generate a new key/root. */
+export async function readBoundBridgeIdentity(dataDir) {
+    let raw;
+    try {
+        raw = await readFile(join(dataDir, 'security', 'bridge-identity.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new BridgeSecurityError('key_unavailable');
+    }
+    try {
+        const record = identityRecordSchema.parse(JSON.parse(raw));
+        if (record.endpoint.kind !== 'bridge')
+            throw new BridgeSecurityError('wrong_context');
+        return { identity: await importEndpoint(record.endpoint, record.privateKey, false), bootstrap: record.accountBootstrap };
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+}
 //# sourceMappingURL=identity.js.map

package/dist/security/bridge/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/security/bridge/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACpG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAExB,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,IAA4B;IACvG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAkB,IAAoC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;AAE7I,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAe;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3H,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClH,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/security/bridge/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnH,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAE5E,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,IAA4B;IACvG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,gBAAgB,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAkB,IAAoC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;AAE7I,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAe;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACnI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClH,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACxF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC3H,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC"}

package/dist/security/bridge/pending-enrollment.d.ts

@@ -0,0 +1,12 @@
+import type { AccountEnrollmentLink, VerifiedAccountTrust } from '../account-protocol.js';
+import type { EndpointIdentity } from '../protocol.js';
+export interface PendingBridgeEnrollment {
+    identity: EndpointIdentity;
+    link: AccountEnrollmentLink;
+}
+export declare function prepareBridgeEnrollment(dataDir: string, bridgeId: string, label: string, now?: number): Promise<PendingBridgeEnrollment>;
+/** URL is constructed from operator configuration, never a service-provided redirect. */
+export declare function savePairingVerificationUrl(dataDir: string, apiUrl: string, userCode: string): Promise<string>;
+export declare function pendingPairingLink(dataDir: string, now?: number): Promise<string>;
+/** Save the normalized SAME private/public key and trusted bootstrap in one durable identity record. */
+export declare function bindPendingBridgeIdentity(dataDir: string, trust: VerifiedAccountTrust): Promise<EndpointIdentity>;

package/dist/security/bridge/pending-enrollment.js

@@ -0,0 +1,113 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { createAccountEnrollment, encodeAccountEnrollmentLink, generateAccountBridgeCandidate, importAccountBridgeCandidate, parseAccountEnrollmentLink, verifyAccountHistory } from '../account-crypto.js';
+import { AtomicSnapshot } from './snapshot.js';
+import { endpointSchema } from './metadata.js';
+import { identityRecordSchema } from './identity.js';
+import { importEndpoint } from '../crypto.js';
+import { BridgeSecurityError } from './errors.js';
+import { accountReadUrl } from './account-client.js';
+const pendingSchema = z.object({ version: z.literal(1), bridgeId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/),
+    endpoint: endpointSchema, privateKey: identityRecordSchema.shape.privateKey,
+    link: z.custom(), verificationUrl: z.string().max(4096).nullable() }).strict();
+const pendingPath = (dataDir) => join(dataDir, 'security', 'account-enrollment.json');
+async function readPending(dataDir) {
+    let raw;
+    try {
+        raw = await readFile(pendingPath(dataDir), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new BridgeSecurityError('account_storage_unavailable');
+    }
+    try {
+        const saved = pendingSchema.parse(JSON.parse(raw));
+        encodeAccountEnrollmentLink(saved.link);
+        return saved;
+    }
+    catch {
+        throw new BridgeSecurityError('account_storage_unavailable');
+    }
+}
+export async function prepareBridgeEnrollment(dataDir, bridgeId, label, now = Date.now()) {
+    const existing = await readPending(dataDir);
+    if (existing && existing.bridgeId !== bridgeId)
+        throw new BridgeSecurityError('wrong_context');
+    const unexpired = existing && typeof existing.link?.request?.expiresAt === 'string' && Date.parse(existing.link.request.expiresAt) > now;
+    let initial = existing;
+    if (!unexpired) {
+        // Expiring a request rotates its challenge/secret, never the pending bridge point.
+        // Approval may already exist remotely even when its response was lost.
+        const identity = existing ? await importAccountBridgeCandidate(existing.endpoint, existing.privateKey, false)
+            : await generateAccountBridgeCandidate(bridgeId, true);
+        initial = pendingSchema.parse({ version: 1, bridgeId, endpoint: identity.endpoint,
+            privateKey: existing?.privateKey ?? await crypto.subtle.exportKey('jwk', identity.keyPair.privateKey),
+            link: await createAccountEnrollment(identity, label.slice(0, 200), null, bridgeId, now), verificationUrl: null });
+    }
+    const store = new AtomicSnapshot(pendingPath(dataDir), pendingSchema, () => initial);
+    const saved = await store.transact(state => {
+        if (!unexpired && existing)
+            Object.assign(state, initial);
+        return state;
+    });
+    const link = await parseAccountEnrollmentLink(saved.link, now);
+    if (link.request.kind !== 'bridge' || link.request.bridgeId !== bridgeId || link.request.candidate.id !== saved.endpoint.id
+        || link.request.candidate.publicKey !== saved.endpoint.publicKey || link.request.candidate.ownerId !== saved.endpoint.ownerId)
+        throw new BridgeSecurityError('account_enrollment_invalid');
+    return { identity: await importAccountBridgeCandidate(saved.endpoint, saved.privateKey, false), link };
+}
+/** URL is constructed from operator configuration, never a service-provided redirect. */
+export async function savePairingVerificationUrl(dataDir, apiUrl, userCode) {
+    accountReadUrl(apiUrl);
+    if (!/^[A-Za-z0-9-]{1,100}$/.test(userCode))
+        throw new BridgeSecurityError('account_enrollment_invalid');
+    const url = new URL('/pair', apiUrl);
+    url.searchParams.set('code', userCode);
+    const existing = await readPending(dataDir);
+    if (!existing)
+        throw new BridgeSecurityError('account_enrollment_invalid');
+    const store = new AtomicSnapshot(pendingPath(dataDir), pendingSchema, () => existing);
+    await store.transact(state => { state.verificationUrl = url.href; });
+    return url.href;
+}
+export async function pendingPairingLink(dataDir, now = Date.now()) {
+    const saved = await readPending(dataDir);
+    if (!saved?.verificationUrl)
+        throw new BridgeSecurityError('account_enrollment_invalid');
+    const link = await parseAccountEnrollmentLink(saved.link, now);
+    const url = new URL(saved.verificationUrl);
+    accountReadUrl(url.origin);
+    if (url.pathname !== '/pair' || url.hash || url.username || url.password || [...url.searchParams.keys()].some(key => key !== 'code')) {
+        throw new BridgeSecurityError('account_enrollment_invalid');
+    }
+    url.hash = `account=${encodeAccountEnrollmentLink(link)}`;
+    return url.href;
+}
+/** Save the normalized SAME private/public key and trusted bootstrap in one durable identity record. */
+export async function bindPendingBridgeIdentity(dataDir, trust) {
+    const pending = await readPending(dataDir);
+    if (!pending)
+        throw new BridgeSecurityError('account_enrollment_invalid');
+    const checkpoint = await verifyAccountHistory(trust.history, trust.checkpoint);
+    const own = checkpoint.bridges.find(item => item.bridgeId === pending.bridgeId);
+    if (!own || own.endpoint.id !== pending.endpoint.id || own.endpoint.publicKey !== pending.endpoint.publicKey)
+        throw new BridgeSecurityError('wrong_context');
+    await importAccountBridgeCandidate(pending.endpoint, pending.privateKey, false);
+    const record = identityRecordSchema.parse({ version: 1, endpoint: own.endpoint, privateKey: pending.privateKey,
+        accountBootstrap: { checkpoint, history: trust.history } });
+    const store = new AtomicSnapshot(join(dataDir, 'security', 'bridge-identity.json'), identityRecordSchema, () => record);
+    const saved = await store.transact(state => {
+        if (state.endpoint.id !== record.endpoint.id || state.endpoint.ownerId !== record.endpoint.ownerId
+            || state.endpoint.publicKey !== record.endpoint.publicKey)
+            throw new BridgeSecurityError('wrong_context');
+        // A pre-existing bound identity is never repinned by repeating bootstrap.
+        if (state.accountBootstrap && state.accountBootstrap.checkpoint.rootId !== checkpoint.rootId)
+            throw new BridgeSecurityError('account_trust_rollback');
+        state.accountBootstrap ??= record.accountBootstrap;
+        return state;
+    });
+    return importEndpoint(saved.endpoint, saved.privateKey, false);
+}
+//# sourceMappingURL=pending-enrollment.js.map

package/dist/security/bridge/pending-enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-enrollment.js","sourceRoot":"","sources":["../../../src/security/bridge/pending-enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,4BAA4B,EACzH,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGjF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC1G,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC,UAAU;IAC3E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAyB,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGxG,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AAE9F,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC3D,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;IAAC,CAAC;AACzE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe,EAAE,QAAgB,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9G,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;IACzI,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,mFAAmF;QACnF,uEAAuE;QACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;YAC3G,CAAC,CAAC,MAAM,8BAA8B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzD,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC/E,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;YACrG,IAAI,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAQ,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,CAAC,SAAS,IAAI,QAAQ;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE;WACtH,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;IAC7L,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AACzG,CAAC;AACD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAe,EAAE,MAAc,EAAE,QAAgB;IAChG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACtF,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,eAAe;QAAE,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3C,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC;QACrI,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;IAC9D,CAAC;IACD,GAAG,CAAC,IAAI,GAAG,WAAW,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1D,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AACD,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,KAA2B;IAC1F,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC7J,MAAM,4BAA4B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC5G,gBAAgB,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IACxH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,OAAO;eAC7F,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC5G,0EAA0E;QAC1E,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QACtJ,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/security/bridge/permissions.js

@@ -3,8 +3,8 @@ const session = /^[A-Za-z0-9_-]+$/;
 const readCommands = new Set(['list_sessions', 'get_history', 'get_session_usage', 'get_sessions_usage', 'get_session_attention']);
 const controlCommands = new Set(['create_session', 'stop_session', 'retry_session', 'send_message', 'rename_session', 'remove_session',
     'bridge_exec', 'clear_terminal', 'update_session_parent', 'resolve_session_attention']);
-const adminCommands = new Set(['security_devices', 'security_invite', 'security_revoke', 'security_approve_mcp', 'security_activity']);
-const result = (permission, operation, sessionId = null) => ({ permission, mutating: permission === 'control' || ['security_invite', 'security_revoke', 'security_approve_mcp'].includes(operation), operation, sessionId });
+const adminCommands = new Set(['security_devices', 'security_invite', 'security_revoke', 'security_approve_mcp', 'security_activity', 'security_account_adopt']);
+const result = (permission, operation, sessionId = null) => ({ permission, mutating: permission === 'control' || ['security_invite', 'security_revoke', 'security_approve_mcp', 'security_account_adopt'].includes(operation), operation, sessionId });
 const deny = () => { throw new BridgeSecurityError('permission_denied'); };
 const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
 /** Deliberately semantic: GET inbox consumes mail unless explicitly non-consuming. */