ftown 0.19.53 → 0.19.54
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bridge-auth.d.ts +3 -0
- package/dist/bridge-auth.js.map +1 -1
- package/dist/command-rpc.js +21 -12
- package/dist/command-rpc.js.map +1 -1
- package/dist/index.js +49 -6
- package/dist/index.js.map +1 -1
- package/dist/pairing-client.d.ts +9 -12
- package/dist/pairing-client.js +34 -7
- package/dist/pairing-client.js.map +1 -1
- package/dist/security/account-crypto.d.ts +33 -0
- package/dist/security/account-crypto.js +649 -0
- package/dist/security/account-crypto.js.map +1 -0
- package/dist/security/account-protocol.d.ts +228 -0
- package/dist/security/account-protocol.js +2 -0
- package/dist/security/account-protocol.js.map +1 -0
- package/dist/security/bridge/account-client.d.ts +7 -0
- package/dist/security/bridge/account-client.js +87 -0
- package/dist/security/bridge/account-client.js.map +1 -0
- package/dist/security/bridge/account-state.d.ts +471 -0
- package/dist/security/bridge/account-state.js +78 -0
- package/dist/security/bridge/account-state.js.map +1 -0
- package/dist/security/bridge/execute.js +2 -1
- package/dist/security/bridge/execute.js.map +1 -1
- package/dist/security/bridge/identity.d.ts +436 -0
- package/dist/security/bridge/identity.js +27 -5
- package/dist/security/bridge/identity.js.map +1 -1
- package/dist/security/bridge/pending-enrollment.d.ts +12 -0
- package/dist/security/bridge/pending-enrollment.js +113 -0
- package/dist/security/bridge/pending-enrollment.js.map +1 -0
- package/dist/security/bridge/permissions.js +2 -2
- package/dist/security/bridge/permissions.js.map +1 -1
- package/dist/security/bridge/policy.d.ts +20 -0
- package/dist/security/bridge/policy.js +159 -7
- package/dist/security/bridge/policy.js.map +1 -1
- package/dist/security/bridge/security.d.ts +11 -0
- package/dist/security/bridge/security.js +93 -3
- package/dist/security/bridge/security.js.map +1 -1
- package/dist/security/bridge/snapshot.d.ts +1 -1
- package/dist/security/bridge/snapshot.js.map +1 -1
- package/dist/security/protocol.d.ts +12 -1
- package/dist/security-cli.js +7 -0
- package/dist/security-cli.js.map +1 -1
- package/dist/types.d.ts +1 -1
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/security/bridge/permissions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACnI,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB;IACpI,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,CAAC,CAAC;AAC1F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/security/bridge/permissions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACnI,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB;IACpI,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,2BAA2B,CAAC,CAAC,CAAC;AAC1F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAC;AACjK,MAAM,MAAM,GAAG,CAAC,UAA8B,EAAE,SAAiB,EAAE,YAA2B,IAAI,EAAuB,EAAE,CACzH,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;AAC7L,MAAM,IAAI,GAAG,GAAU,EAAE,GAAG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,MAAM,MAAM,GAAG,CAAC,KAAkC,EAAkD,EAAE,CACpG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAE3F,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACtJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,uBAAuB,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;WAC5G,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,EAAE,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACnE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC/F,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtG,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtG,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9G,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClI,CAAC;IACD,MAAM,KAAK,GAAG,iJAAiJ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnL,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;IAC9C,IAAI,eAAe,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3C,yEAAyE;QACzE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;eAChD,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,EAAE,CAAC,CAAC;IACrJ,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC5G,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzH,OAAO,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,aAAa,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAAyB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAC;QAC3F,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,cAAc;WAC3F,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACtI,oGAAoG;IACpG,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IAC9H,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IACvG,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}
|
|
@@ -1,8 +1,11 @@
|
|
|
1
1
|
import type { ApprovedEndpoint, BridgeInvitation, EndpointPermission, EndpointPublic, EnrollmentMessage, InvitationOptions, LocalRecoveryAuthority, McpApproval, McpApprovalReceipt, VerifiedPrincipal } from '../protocol.js';
|
|
2
|
+
import type { AccountHead, AccountHistory, StoredAccountTrust, VerifiedAccountTrust } from '../account-protocol.js';
|
|
3
|
+
import type { SecurityErrorCode } from '../protocol.js';
|
|
2
4
|
/** Identity comparison matters: request JSON cannot manufacture this recovery capability. */
|
|
3
5
|
export declare const LOCAL_RECOVERY_AUTHORITY: LocalRecoveryAuthority;
|
|
4
6
|
export interface PolicyOptions {
|
|
5
7
|
now?: () => number;
|
|
8
|
+
monotonicNow?: () => number;
|
|
6
9
|
relayUrl?: string;
|
|
7
10
|
localOrigin?: string;
|
|
8
11
|
}
|
|
@@ -13,6 +16,7 @@ export declare class BridgePolicyStore {
|
|
|
13
16
|
private readonly options;
|
|
14
17
|
private readonly snapshot;
|
|
15
18
|
private readonly now;
|
|
19
|
+
private readonly connectivity;
|
|
16
20
|
constructor(dataDir: string, bridgeId: string, bridge: EndpointPublic, options?: PolicyOptions);
|
|
17
21
|
private check;
|
|
18
22
|
private active;
|
|
@@ -31,5 +35,21 @@ export declare class BridgePolicyStore {
|
|
|
31
35
|
}>;
|
|
32
36
|
revoke(actor: VerifiedPrincipal, endpointId: string): Promise<void>;
|
|
33
37
|
provisionLocalEndpoint(endpoint: EndpointPublic): Promise<void>;
|
|
38
|
+
accountTrust(): Promise<StoredAccountTrust | null>;
|
|
39
|
+
accountEndpointIds(): Promise<string[]>;
|
|
40
|
+
blockAccount(code: SecurityErrorCode): void;
|
|
41
|
+
accountAvailable(): Promise<boolean>;
|
|
42
|
+
/** Trusted startup bootstrap only; no remote endpoint can call this entry point. */
|
|
43
|
+
pinBootstrap(trust: VerifiedAccountTrust): Promise<void>;
|
|
44
|
+
private requireOwnBridge;
|
|
45
|
+
private projectAccount;
|
|
46
|
+
/** Only an authenticated API read reaches here; browser-supplied timestamps never do. */
|
|
47
|
+
applyAccountRead(history: AccountHistory, adoption?: {
|
|
48
|
+
actor: VerifiedPrincipal;
|
|
49
|
+
head: AccountHead;
|
|
50
|
+
}): Promise<{
|
|
51
|
+
head: AccountHead;
|
|
52
|
+
revoked: string[];
|
|
53
|
+
}>;
|
|
34
54
|
close(): Promise<void>;
|
|
35
55
|
}
|
|
@@ -4,18 +4,23 @@ import { z } from 'zod';
|
|
|
4
4
|
import { BridgeSecurityError } from './errors.js';
|
|
5
5
|
import { approvedSchema, boundedId, displayLabel, endpointSchema, permissionSchema } from './metadata.js';
|
|
6
6
|
import { AtomicSnapshot } from './snapshot.js';
|
|
7
|
+
import { verifyAccountHistory } from '../account-crypto.js';
|
|
8
|
+
import { AccountConnectivity, storedAccountSchema } from './account-state.js';
|
|
7
9
|
const FIVE_MINUTES = 300_000;
|
|
8
10
|
const THIRTY_DAYS = 30 * 86_400_000;
|
|
9
11
|
const MAX_ENDPOINTS = 1000;
|
|
10
12
|
const digest = (secret) => createHash('sha256').update(secret).digest('hex');
|
|
11
13
|
const invitationSchema = z.object({ id: z.string().uuid(), secretHash: z.string().regex(/^[a-f0-9]{64}$/),
|
|
12
14
|
label: z.string().max(100), permissions: z.array(permissionSchema).max(3), expiresAt: z.string().datetime(),
|
|
13
|
-
consumedBy: z.string().nullable() }).strict();
|
|
15
|
+
consumedBy: z.string().nullable(), provenance: z.enum(['legacy', 'local-recovery']).default('legacy') }).strict();
|
|
14
16
|
const pendingSchema = z.object({ approved: approvedSchema, approvalId: z.string().uuid(), requestId: boundedId,
|
|
15
17
|
expiresAt: z.string().datetime(), activeExpiresAt: z.string().datetime(), active: z.boolean() }).strict();
|
|
16
18
|
const policySchema = z.object({ version: z.literal(1), ownerId: z.string(), bridgeId: z.string(), bridgeEndpointId: z.string(),
|
|
17
19
|
generation: z.number().int().nonnegative(), devices: z.array(approvedSchema).max(MAX_ENDPOINTS),
|
|
18
|
-
invitations: z.array(invitationSchema).max(256), mcp: z.array(pendingSchema).max(MAX_ENDPOINTS)
|
|
20
|
+
invitations: z.array(invitationSchema).max(256), mcp: z.array(pendingSchema).max(MAX_ENDPOINTS),
|
|
21
|
+
account: storedAccountSchema.nullable().default(null),
|
|
22
|
+
provenance: z.record(z.enum(['legacy', 'local-recovery', 'account', 'local-cli', 'mcp'])).default({}),
|
|
23
|
+
}).strict().superRefine((state, context) => {
|
|
19
24
|
if (new Set(state.devices.map(device => device.endpoint.id)).size !== state.devices.length
|
|
20
25
|
|| new Set(state.mcp.map(item => item.approved.grantId)).size !== state.mcp.length
|
|
21
26
|
|| state.devices.some(device => device.endpoint.ownerId !== state.ownerId
|
|
@@ -34,6 +39,7 @@ export class BridgePolicyStore {
|
|
|
34
39
|
options;
|
|
35
40
|
snapshot;
|
|
36
41
|
now;
|
|
42
|
+
connectivity;
|
|
37
43
|
constructor(dataDir, bridgeId, bridge, options = {}) {
|
|
38
44
|
this.bridgeId = bridgeId;
|
|
39
45
|
this.bridge = bridge;
|
|
@@ -42,9 +48,10 @@ export class BridgePolicyStore {
|
|
|
42
48
|
if (bridge.kind !== 'bridge')
|
|
43
49
|
throw new BridgeSecurityError('wrong_context');
|
|
44
50
|
this.now = options.now ?? Date.now;
|
|
51
|
+
this.connectivity = new AccountConnectivity(this.now, options.monotonicNow ?? (() => performance.now()));
|
|
45
52
|
this.snapshot = new AtomicSnapshot(join(dataDir, 'security', 'policy.json'), policySchema, () => ({
|
|
46
53
|
version: 1, ownerId: bridge.ownerId, bridgeId, bridgeEndpointId: bridge.id, generation: 0,
|
|
47
|
-
devices: [], invitations: [], mcp: [],
|
|
54
|
+
devices: [], invitations: [], mcp: [], account: null, provenance: {},
|
|
48
55
|
}));
|
|
49
56
|
}
|
|
50
57
|
check(state) {
|
|
@@ -54,6 +61,16 @@ export class BridgePolicyStore {
|
|
|
54
61
|
}
|
|
55
62
|
active(state, endpointId, pendingAllowed = false) {
|
|
56
63
|
this.check(state);
|
|
64
|
+
const account = state.account;
|
|
65
|
+
const member = account?.checkpoint.devices.find(item => item.endpoint.id === endpointId);
|
|
66
|
+
if (member) {
|
|
67
|
+
this.connectivity.check(account);
|
|
68
|
+
const own = account.checkpoint.bridges.find(item => item.bridgeId === this.bridgeId);
|
|
69
|
+
if (!own || own.endpoint.id !== this.bridge.id || own.endpoint.publicKey !== this.bridge.publicKey)
|
|
70
|
+
throw new BridgeSecurityError('account_bridge_revoked');
|
|
71
|
+
}
|
|
72
|
+
else if (account?.checkpoint.revokedDeviceIds.includes(endpointId))
|
|
73
|
+
throw new BridgeSecurityError('account_device_revoked');
|
|
57
74
|
const record = state.devices.find(device => device.endpoint.id === endpointId);
|
|
58
75
|
if (!record)
|
|
59
76
|
throw new BridgeSecurityError('approval_required');
|
|
@@ -103,13 +120,16 @@ export class BridgePolicyStore {
|
|
|
103
120
|
const expiresAt = new Date(this.now() + FIVE_MINUTES).toISOString();
|
|
104
121
|
await this.snapshot.transact(state => {
|
|
105
122
|
this.check(state);
|
|
106
|
-
if (actor !== LOCAL_RECOVERY_AUTHORITY)
|
|
123
|
+
if (actor !== LOCAL_RECOVERY_AUTHORITY) {
|
|
107
124
|
this.authorize(state, actor, 'admin');
|
|
125
|
+
if (state.account && actor.endpoint.kind !== 'local-cli')
|
|
126
|
+
throw new BridgeSecurityError('account_approval_required');
|
|
127
|
+
}
|
|
108
128
|
state.invitations = state.invitations.filter(invitation => Date.parse(invitation.expiresAt) > this.now());
|
|
109
129
|
if (state.invitations.length >= 256)
|
|
110
130
|
throw new BridgeSecurityError('capacity_exceeded');
|
|
111
131
|
state.invitations.push({ id: invitationId, secretHash: digest(secret), label: displayLabel(options.label),
|
|
112
|
-
permissions: ['read', 'control', 'admin'], expiresAt, consumedBy: null });
|
|
132
|
+
permissions: ['read', 'control', 'admin'], expiresAt, consumedBy: null, provenance: state.account ? 'local-recovery' : 'legacy' });
|
|
113
133
|
});
|
|
114
134
|
return { version: 1, invitationId, ownerId: this.bridge.ownerId, bridgeId: this.bridgeId, bridge: this.bridge,
|
|
115
135
|
secret, expiresAt, relayUrl: this.options.relayUrl ?? null, localOrigin: this.options.localOrigin ?? null };
|
|
@@ -133,6 +153,12 @@ export class BridgePolicyStore {
|
|
|
133
153
|
}
|
|
134
154
|
if (Date.parse(invitation.expiresAt) <= this.now())
|
|
135
155
|
throw new BridgeSecurityError('invitation_expired');
|
|
156
|
+
if (state.account && invitation.provenance !== 'local-recovery')
|
|
157
|
+
throw new BridgeSecurityError('invitation_invalid');
|
|
158
|
+
// Independent recovery must never shadow an account membership or revive its tombstone.
|
|
159
|
+
if (state.account && (state.account.checkpoint.devices.some(item => item.endpoint.id === candidate.id)
|
|
160
|
+
|| state.account.checkpoint.revokedDeviceIds.includes(candidate.id)))
|
|
161
|
+
throw new BridgeSecurityError('account_approval_required');
|
|
136
162
|
if (invitation.consumedBy) {
|
|
137
163
|
if (invitation.consumedBy !== candidate.id)
|
|
138
164
|
throw new BridgeSecurityError('invitation_consumed');
|
|
@@ -147,12 +173,23 @@ export class BridgePolicyStore {
|
|
|
147
173
|
permissions: [...invitation.permissions], approvedAt: new Date(this.now()).toISOString(), grantId: null, expiresAt: null };
|
|
148
174
|
invitation.consumedBy = candidate.id;
|
|
149
175
|
state.devices.push(approved);
|
|
176
|
+
state.provenance[candidate.id] = invitation.provenance;
|
|
150
177
|
state.generation++;
|
|
151
178
|
return approved;
|
|
152
179
|
});
|
|
153
180
|
}
|
|
154
181
|
async list(actor) {
|
|
155
|
-
return this.snapshot.read(state => {
|
|
182
|
+
return this.snapshot.read(state => {
|
|
183
|
+
this.authorize(state, actor, 'admin');
|
|
184
|
+
return state.devices.map(device => {
|
|
185
|
+
const provenance = state.provenance[device.endpoint.id];
|
|
186
|
+
if (provenance === 'account')
|
|
187
|
+
return { ...device, source: 'account' };
|
|
188
|
+
if (provenance === 'local-cli' || provenance === 'local-recovery')
|
|
189
|
+
return { ...device, source: 'local' };
|
|
190
|
+
return { ...device };
|
|
191
|
+
});
|
|
192
|
+
});
|
|
156
193
|
}
|
|
157
194
|
async recipients() {
|
|
158
195
|
return this.snapshot.read(state => {
|
|
@@ -238,7 +275,10 @@ export class BridgePolicyStore {
|
|
|
238
275
|
async revoke(actor, endpointId) {
|
|
239
276
|
await this.snapshot.transact(state => {
|
|
240
277
|
this.authorize(state, actor, 'admin');
|
|
278
|
+
if (state.account?.checkpoint.devices.some(item => item.endpoint.id === endpointId))
|
|
279
|
+
throw new BridgeSecurityError('account_approval_required');
|
|
241
280
|
state.devices = state.devices.filter(device => device.endpoint.id !== endpointId);
|
|
281
|
+
delete state.provenance[endpointId];
|
|
242
282
|
state.mcp = state.mcp.filter(item => item.approved.endpoint.id !== endpointId);
|
|
243
283
|
state.generation++;
|
|
244
284
|
});
|
|
@@ -256,8 +296,120 @@ export class BridgePolicyStore {
|
|
|
256
296
|
state.devices.push({ endpoint: candidate, label: 'Local CLI', permissions: ['read', 'control', 'admin'],
|
|
257
297
|
approvedAt: new Date(this.now()).toISOString(), grantId: null, expiresAt: null });
|
|
258
298
|
state.generation++;
|
|
299
|
+
state.provenance[candidate.id] = 'local-cli';
|
|
300
|
+
});
|
|
301
|
+
}
|
|
302
|
+
async accountTrust() {
|
|
303
|
+
return this.snapshot.read(state => { this.check(state); return state.account; });
|
|
304
|
+
}
|
|
305
|
+
async accountEndpointIds() {
|
|
306
|
+
return this.snapshot.read(state => { this.check(state); return state.account?.checkpoint.devices.map(item => item.endpoint.id) ?? []; });
|
|
307
|
+
}
|
|
308
|
+
blockAccount(code) { this.connectivity.block(code); }
|
|
309
|
+
async accountAvailable() {
|
|
310
|
+
return this.snapshot.read(state => {
|
|
311
|
+
this.check(state);
|
|
312
|
+
if (!state.account)
|
|
313
|
+
return true;
|
|
314
|
+
try {
|
|
315
|
+
this.connectivity.check(state.account);
|
|
316
|
+
return state.account.checkpoint.bridges.some(item => item.bridgeId === this.bridgeId && item.endpoint.id === this.bridge.id);
|
|
317
|
+
}
|
|
318
|
+
catch {
|
|
319
|
+
return false;
|
|
320
|
+
}
|
|
321
|
+
});
|
|
322
|
+
}
|
|
323
|
+
/** Trusted startup bootstrap only; no remote endpoint can call this entry point. */
|
|
324
|
+
async pinBootstrap(trust) {
|
|
325
|
+
await this.snapshot.transact(async (state) => {
|
|
326
|
+
this.check(state);
|
|
327
|
+
if (state.account) {
|
|
328
|
+
if (state.account.checkpoint.rootId !== trust.checkpoint.rootId)
|
|
329
|
+
throw new BridgeSecurityError('account_trust_rollback');
|
|
330
|
+
return;
|
|
331
|
+
}
|
|
332
|
+
const checkpoint = await verifyAccountHistory(trust.history, trust.checkpoint, this.now());
|
|
333
|
+
this.requireOwnBridge(checkpoint);
|
|
334
|
+
this.projectAccount(state, { ...trust, checkpoint, lastServerReadAt: 0, lastObservedAt: 0 });
|
|
335
|
+
});
|
|
336
|
+
}
|
|
337
|
+
requireOwnBridge(checkpoint) {
|
|
338
|
+
const own = checkpoint.bridges.find(item => item.bridgeId === this.bridgeId);
|
|
339
|
+
if (checkpoint.ownerId !== this.bridge.ownerId || !own || own.endpoint.id !== this.bridge.id
|
|
340
|
+
|| own.endpoint.publicKey !== this.bridge.publicKey || own.endpoint.ownerId !== this.bridge.ownerId)
|
|
341
|
+
throw new BridgeSecurityError('wrong_context');
|
|
342
|
+
}
|
|
343
|
+
projectAccount(state, trust) {
|
|
344
|
+
const previous = state.devices.filter(item => item.endpoint.kind === 'browser');
|
|
345
|
+
const first = state.account === null;
|
|
346
|
+
const unchanged = state.account?.checkpoint.head === trust.checkpoint.head;
|
|
347
|
+
state.devices = state.devices.filter(item => item.endpoint.kind !== 'browser'
|
|
348
|
+
|| (!first && state.provenance[item.endpoint.id] === 'local-recovery'
|
|
349
|
+
&& !trust.checkpoint.devices.some(member => member.endpoint.id === item.endpoint.id)
|
|
350
|
+
&& !trust.checkpoint.revokedDeviceIds.includes(item.endpoint.id)));
|
|
351
|
+
if (first)
|
|
352
|
+
state.invitations = [];
|
|
353
|
+
for (const entry of previous)
|
|
354
|
+
if (!state.devices.some(item => item.endpoint.id === entry.endpoint.id))
|
|
355
|
+
delete state.provenance[entry.endpoint.id];
|
|
356
|
+
const own = trust.checkpoint.bridges.find(item => item.bridgeId === this.bridgeId);
|
|
357
|
+
if (own?.endpoint.id === this.bridge.id && own.endpoint.publicKey === this.bridge.publicKey) {
|
|
358
|
+
for (const member of trust.checkpoint.devices) {
|
|
359
|
+
if (state.devices.some(item => item.endpoint.id === member.endpoint.id))
|
|
360
|
+
throw new BridgeSecurityError('wrong_context');
|
|
361
|
+
state.devices.push({ endpoint: member.endpoint, label: displayLabel(member.label), permissions: ['read', 'control', 'admin'],
|
|
362
|
+
approvedAt: member.approvedAt, grantId: null, expiresAt: null });
|
|
363
|
+
state.provenance[member.endpoint.id] = 'account';
|
|
364
|
+
}
|
|
365
|
+
}
|
|
366
|
+
state.account = trust;
|
|
367
|
+
if (!unchanged)
|
|
368
|
+
state.generation++;
|
|
369
|
+
return previous.filter(item => !state.devices.some(next => next.endpoint.id === item.endpoint.id)).map(item => item.endpoint.id);
|
|
370
|
+
}
|
|
371
|
+
/** Only an authenticated API read reaches here; browser-supplied timestamps never do. */
|
|
372
|
+
async applyAccountRead(history, adoption) {
|
|
373
|
+
const result = await this.snapshot.transact(async (state) => {
|
|
374
|
+
this.check(state);
|
|
375
|
+
if (!state.account && !adoption)
|
|
376
|
+
throw new BridgeSecurityError('account_approval_required');
|
|
377
|
+
if (adoption) {
|
|
378
|
+
if (adoption.actor.endpoint.kind !== 'browser')
|
|
379
|
+
throw new BridgeSecurityError('permission_denied');
|
|
380
|
+
this.authorize(state, adoption.actor, 'admin');
|
|
381
|
+
}
|
|
382
|
+
const checkpoint = await verifyAccountHistory(history, state.account?.checkpoint ?? null, this.now());
|
|
383
|
+
if (checkpoint.ownerId !== this.bridge.ownerId)
|
|
384
|
+
throw new BridgeSecurityError('wrong_context');
|
|
385
|
+
if (adoption) {
|
|
386
|
+
const head = adoption.head;
|
|
387
|
+
if (head.rootId !== checkpoint.rootId || head.revision !== checkpoint.revision || head.head !== checkpoint.head)
|
|
388
|
+
throw new BridgeSecurityError('account_trust_conflict');
|
|
389
|
+
this.requireOwnBridge(checkpoint);
|
|
390
|
+
const member = checkpoint.devices.find(item => item.endpoint.id === adoption.actor.endpoint.id);
|
|
391
|
+
if (!member || member.endpoint.publicKey !== adoption.actor.endpoint.publicKey || member.endpoint.ownerId !== adoption.actor.endpoint.ownerId) {
|
|
392
|
+
throw new BridgeSecurityError('account_device_revoked');
|
|
393
|
+
}
|
|
394
|
+
this.authorize(state, adoption.actor, 'admin');
|
|
395
|
+
}
|
|
396
|
+
const initial = state.account ?? { checkpoint, history, lastServerReadAt: 0, lastObservedAt: 0 };
|
|
397
|
+
const now = this.connectivity.observed(initial);
|
|
398
|
+
const trust = { checkpoint, history, lastServerReadAt: Math.max(initial.lastServerReadAt, now),
|
|
399
|
+
lastObservedAt: Math.max(initial.lastObservedAt, now) };
|
|
400
|
+
const revoked = this.projectAccount(state, trust);
|
|
401
|
+
return { head: { rootId: checkpoint.rootId, revision: checkpoint.revision, head: checkpoint.head }, revoked, trust };
|
|
402
|
+
});
|
|
403
|
+
this.connectivity.renew(result.trust);
|
|
404
|
+
return { head: result.head, revoked: result.revoked };
|
|
405
|
+
}
|
|
406
|
+
async close() {
|
|
407
|
+
await this.snapshot.transact(state => {
|
|
408
|
+
this.check(state);
|
|
409
|
+
if (state.account)
|
|
410
|
+
state.account.lastObservedAt = Math.max(state.account.lastObservedAt, this.connectivity.highwater());
|
|
259
411
|
});
|
|
412
|
+
await this.snapshot.close();
|
|
260
413
|
}
|
|
261
|
-
async close() { await this.snapshot.close(); }
|
|
262
414
|
}
|
|
263
415
|
//# sourceMappingURL=policy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/security/bridge/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,UAAU,CAAC;AACpC,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAChD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;IAC5G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5G,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5H,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3I,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;WACrF,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM;WAC/E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eACpE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;eAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;WACjE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACrH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAA2B,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAI/G,2GAA2G;AAC3G,MAAM,OAAO,iBAAiB;IAGU;IAA2B;IAAyC;IAFzF,QAAQ,CAAyB;IACjC,GAAG,CAAe;IACnC,YAAY,OAAe,EAAW,QAAgB,EAAW,MAAsB,EAAmB,UAAyB,EAAE;QAA/F,aAAQ,GAAR,QAAQ,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAgB;QAAmB,YAAO,GAAP,OAAO,CAAoB;QACnI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YAChG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;IACO,KAAK,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3H,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,cAAc,GAAG,KAAK;QACtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACjF,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,aAAa,CAAC,KAAa,EAAE,MAAwB;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW;YAC5H,gBAAgB,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,KAAwB,EAAE,UAA8B;QACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,iBAAiB,GAAG,KAAK;QAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,UAA+B;QACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/I,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAiD,EAAE,OAA0B;QAClG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,KAAK,wBAAwB;gBAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAA0B,EAAE,OAAO,CAAC,CAAC;YACnG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACxF,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YAC3G,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;IAChH,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,OAA0B;QAChD,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAC5D,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;YACpF,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACxG,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE;oBAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;gBACjG,yFAAyF;gBACzF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YAC3H,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK;gBAC9G,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7H,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACnC,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,KAAK,CAAC;gBAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,QAAqB;QAC9D,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACnI,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;eAClE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;eACzF,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;eACvG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,SAAS,CAAC;eACpI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACxH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC5H,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjI,IAAI,OAAgB,CAAC;YACrB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;uBAC9F,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;uBACtF,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;uBACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBAC5I,OAAO,GAAG,QAAQ,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACrH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;oBACxG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACnH,OAAO,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC1G,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC7D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBACvH,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACzG,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACrH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAwB,EAAE,OAAe;QACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;mBAC1H,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC7H,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAwB,EAAE,UAAkB;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAClF,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAC/E,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,QAAwB;QACnD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAChI,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;gBACrG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1G,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAC9D"}
|
|
1
|
+
{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/security/bridge/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,UAAU,CAAC;AACpC,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACpH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;IAC5G,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5G,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5H,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/F,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;WACrF,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM;WAC/E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eACpE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;eAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;WACjE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACrH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAA2B,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAI/G,2GAA2G;AAC3G,MAAM,OAAO,iBAAiB;IAIU;IAA2B;IAAyC;IAHzF,QAAQ,CAAyB;IACjC,GAAG,CAAe;IAClB,YAAY,CAAsB;IACnD,YAAY,OAAe,EAAW,QAAgB,EAAW,MAAsB,EAAmB,UAAyB,EAAE;QAA/F,aAAQ,GAAR,QAAQ,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAgB;QAAmB,YAAO,GAAP,OAAO,CAAoB;QACnI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAS,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACxG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;SACrE,CAAC,CAAC,CAAC;IACN,CAAC;IACO,KAAK,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3H,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,cAAc,GAAG,KAAK;QACtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACzF,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,OAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC9J,CAAC;aAAM,IAAI,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC9H,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACjF,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,aAAa,CAAC,KAAa,EAAE,MAAwB;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW;YAC5H,gBAAgB,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,KAAwB,EAAE,UAA8B;QACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,iBAAiB,GAAG,KAAK;QAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,UAA+B;QACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/I,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAiD,EAAE,OAA0B;QAClG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAA0B,EAAE,OAAO,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,OAAO,IAAK,KAA2B,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC9I,CAAC;YACD,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACxF,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvI,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YAC3G,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;IAChH,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,OAA0B;QAChD,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAC5D,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;YACpF,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACxG,IAAI,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,UAAU,KAAK,gBAAgB;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACrH,wFAAwF;YACxF,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;mBACjG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YACnI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE;oBAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;gBACjG,yFAAyF;gBACzF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YAC3H,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK;gBAC9G,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7H,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;YACvD,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;gBAChC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACxD,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;gBAC/E,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,gBAAgB;oBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAC;gBAClH,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACnC,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,KAAK,CAAC;gBAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,QAAqB;QAC9D,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACnI,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;eAClE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;eACzF,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;eACvG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,SAAS,CAAC;eACpI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACxH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC5H,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjI,IAAI,OAAgB,CAAC;YACrB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;uBAC9F,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;uBACtF,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;uBACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBAC5I,OAAO,GAAG,QAAQ,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACrH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;oBACxG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACnH,OAAO,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC1G,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC7D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBACvH,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACzG,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACrH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAwB,EAAE,OAAe;QACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;mBAC1H,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC7H,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAwB,EAAE,UAAkB;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAChJ,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAC/E,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,QAAwB;QACnD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAChI,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;gBACrG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACxG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,kBAAkB;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,CAAC;IACD,YAAY,CAAC,IAAuB,IAAU,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/H,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,oFAAoF;IACpF,KAAK,CAAC,YAAY,CAAC,KAA2B;QAC5C,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;YACzC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM;oBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBACzH,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;IACO,gBAAgB,CAAC,UAA4C;QACnE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE;eACvF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACxJ,CAAC;IACO,cAAc,CAAC,KAAa,EAAE,KAAyB;QAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3E,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,gBAAgB;mBAChE,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;mBACjF,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK;YAAE,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClJ,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5F,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACxH,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;oBAC1H,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;YACnD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IACD,yFAAyF;IACzF,KAAK,CAAC,gBAAgB,CAAC,OAAuB,EAAE,QAA0D;QACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;YACxD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC5F,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBACnG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtG,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/F,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;oBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBACzK,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAC9I,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YACjG,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;gBAC5F,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1H,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}
|
|
@@ -1,10 +1,12 @@
|
|
|
1
1
|
import type { ApplicationJson, ApprovedEndpoint, BridgeInvitation, BridgeSecurity, EndpointIdentity, EnrollmentPacket, InboundTransportContext, InvitationOptions, LocalRecoveryAuthority, McpApproval, McpBridgeApproval, SecureApplication, SecureEnvelope, SecurePublication, VerifiedApplication, VerifiedPrincipal } from '../protocol.js';
|
|
2
2
|
import { BridgePolicyStore, type PolicyOptions } from './policy.js';
|
|
3
3
|
import { BridgeAuditStore } from './audit.js';
|
|
4
|
+
import type { AccountHead, AccountHistory, VerifiedAccountTrust } from '../account-protocol.js';
|
|
4
5
|
export declare const applicationJson: (value: unknown) => ApplicationJson;
|
|
5
6
|
export interface BridgeSecurityOptions extends PolicyOptions {
|
|
6
7
|
relayUserId: string;
|
|
7
8
|
browserOrigin?: string;
|
|
9
|
+
readAccountHistory?: (signal?: AbortSignal) => Promise<AccountHistory | null>;
|
|
8
10
|
}
|
|
9
11
|
export declare class BridgeSecurityService implements BridgeSecurity {
|
|
10
12
|
readonly identity: EndpointIdentity;
|
|
@@ -20,6 +22,9 @@ export declare class BridgeSecurityService implements BridgeSecurity {
|
|
|
20
22
|
private readonly admissions;
|
|
21
23
|
private readonly verified;
|
|
22
24
|
private closed;
|
|
25
|
+
private accountTimer;
|
|
26
|
+
private accountRefresh;
|
|
27
|
+
private readonly accountAbort;
|
|
23
28
|
constructor(identity: EndpointIdentity, bridgeId: string, dataDir: string, options: BridgeSecurityOptions);
|
|
24
29
|
private context;
|
|
25
30
|
private freshness;
|
|
@@ -45,6 +50,12 @@ export declare class BridgeSecurityService implements BridgeSecurity {
|
|
|
45
50
|
expiresAt: string;
|
|
46
51
|
}>;
|
|
47
52
|
revokeEndpoint(actor: VerifiedPrincipal, endpointId: string): Promise<void>;
|
|
53
|
+
/** Called once at startup; legacy/Solo stores never adopt an unsigned server directory. */
|
|
54
|
+
startAccount(trust?: VerifiedAccountTrust): Promise<void>;
|
|
55
|
+
private accountFailure;
|
|
56
|
+
private emitRevoked;
|
|
57
|
+
refreshAccount(): Promise<void>;
|
|
58
|
+
adoptAccount(actor: VerifiedPrincipal, head: AccountHead): Promise<AccountHead>;
|
|
48
59
|
onRevoked(listener: (endpointId: string) => void): () => void;
|
|
49
60
|
close(): Promise<void>;
|
|
50
61
|
}
|
|
@@ -6,6 +6,8 @@ import { BridgeAuditStore } from './audit.js';
|
|
|
6
6
|
import { BridgeSecurityError } from './errors.js';
|
|
7
7
|
import { classifyCommand, classifyHttp, classifyTerminal } from './permissions.js';
|
|
8
8
|
import { endpointSchema } from './metadata.js';
|
|
9
|
+
import { ACCOUNT_TRUST_LIMITS, AccountTrustError } from '../account-crypto.js';
|
|
10
|
+
import { AccountReadUnavailable } from './account-client.js';
|
|
9
11
|
const token = z.string().regex(/^[A-Za-z0-9_-]{1,200}$/);
|
|
10
12
|
const actionSchema = z.object({ actionId: token, parentActionId: token.nullable(), clientId: token, grantId: token,
|
|
11
13
|
tool: z.string().max(200), operation: z.string().max(200).nullable() }).strict();
|
|
@@ -35,6 +37,9 @@ export class BridgeSecurityService {
|
|
|
35
37
|
admissions = new Map();
|
|
36
38
|
verified = new WeakSet();
|
|
37
39
|
closed = false;
|
|
40
|
+
accountTimer = null;
|
|
41
|
+
accountRefresh = null;
|
|
42
|
+
accountAbort = new AbortController();
|
|
38
43
|
constructor(identity, bridgeId, dataDir, options) {
|
|
39
44
|
this.identity = identity;
|
|
40
45
|
this.bridgeId = bridgeId;
|
|
@@ -113,7 +118,12 @@ export class BridgeSecurityService {
|
|
|
113
118
|
this.freshness(envelope, false);
|
|
114
119
|
const principal = await this.policy.principal(envelope.senderId, true);
|
|
115
120
|
const hello = z.object({ type: z.literal('hello'), challenge: token }).strict().parse(await this.decode(principal.endpoint, envelope, route));
|
|
116
|
-
|
|
121
|
+
const welcome = await this.reply(principal.endpoint, 'welcome', { type: 'welcome', challenge: hello.challenge, receiverEpoch: this.receiverEpoch }, route, envelope.messageId);
|
|
122
|
+
// Pending MCP identities may hello but cannot acquire ordinary application permissions.
|
|
123
|
+
const current = await this.policy.principal(principal.endpoint.id, true);
|
|
124
|
+
if (current.endpoint.publicKey !== principal.endpoint.publicKey)
|
|
125
|
+
throw new BridgeSecurityError('wrong_context');
|
|
126
|
+
return welcome;
|
|
117
127
|
}
|
|
118
128
|
parseApplication(value) {
|
|
119
129
|
const parsed = z.object({ type: z.literal('application'), route: routeSchema, data: z.unknown(), mcp: actionSchema.nullable() }).strict().parse(value);
|
|
@@ -272,7 +282,8 @@ export class BridgeSecurityService {
|
|
|
272
282
|
packets.push(await this.sealTo(recipient.endpoint.id, application, { transport: 'cloud', channel, bridgeId: this.bridgeId, pairId: null }));
|
|
273
283
|
}
|
|
274
284
|
catch (error) {
|
|
275
|
-
if (!(error instanceof BridgeSecurityError) || !['endpoint_revoked', 'approval_required', 'expired'].includes(error.code)
|
|
285
|
+
if (!(error instanceof BridgeSecurityError) || (!['endpoint_revoked', 'approval_required', 'expired', 'invalid_account_trust'].includes(error.code)
|
|
286
|
+
&& !error.code.startsWith('account_')))
|
|
276
287
|
throw error;
|
|
277
288
|
}
|
|
278
289
|
}
|
|
@@ -292,7 +303,86 @@ export class BridgeSecurityService {
|
|
|
292
303
|
for (const listener of this.revoked)
|
|
293
304
|
listener(endpointId);
|
|
294
305
|
}
|
|
306
|
+
/** Called once at startup; legacy/Solo stores never adopt an unsigned server directory. */
|
|
307
|
+
async startAccount(trust) {
|
|
308
|
+
if (trust)
|
|
309
|
+
await this.policy.pinBootstrap(trust);
|
|
310
|
+
await this.refreshAccount().catch(() => undefined);
|
|
311
|
+
if (!this.closed && !this.accountTimer && this.options.readAccountHistory) {
|
|
312
|
+
this.accountTimer = setInterval(() => { void this.refreshAccount().catch(() => undefined); }, ACCOUNT_TRUST_LIMITS.refreshIntervalMs);
|
|
313
|
+
this.accountTimer.unref();
|
|
314
|
+
}
|
|
315
|
+
}
|
|
316
|
+
accountFailure(error) {
|
|
317
|
+
return error instanceof BridgeSecurityError ? error : new BridgeSecurityError(error instanceof AccountTrustError ? error.code : 'invalid_account_trust');
|
|
318
|
+
}
|
|
319
|
+
emitRevoked(endpointIds) {
|
|
320
|
+
for (const id of endpointIds)
|
|
321
|
+
for (const listener of this.revoked)
|
|
322
|
+
listener(id);
|
|
323
|
+
}
|
|
324
|
+
async refreshAccount() {
|
|
325
|
+
if (this.accountRefresh)
|
|
326
|
+
return this.accountRefresh;
|
|
327
|
+
const run = async () => {
|
|
328
|
+
if (this.closed || !await this.policy.accountTrust())
|
|
329
|
+
return;
|
|
330
|
+
try {
|
|
331
|
+
if (!this.options.readAccountHistory)
|
|
332
|
+
throw new AccountReadUnavailable();
|
|
333
|
+
const history = await this.options.readAccountHistory(this.accountAbort.signal);
|
|
334
|
+
if (!history)
|
|
335
|
+
throw new BridgeSecurityError('account_trust_rollback');
|
|
336
|
+
if (this.closed)
|
|
337
|
+
return;
|
|
338
|
+
const result = await this.policy.applyAccountRead(history);
|
|
339
|
+
this.emitRevoked(result.revoked);
|
|
340
|
+
}
|
|
341
|
+
catch (error) {
|
|
342
|
+
if (!(error instanceof AccountReadUnavailable))
|
|
343
|
+
this.policy.blockAccount(this.accountFailure(error).code);
|
|
344
|
+
if (!await this.policy.accountAvailable())
|
|
345
|
+
this.emitRevoked(await this.policy.accountEndpointIds());
|
|
346
|
+
throw error;
|
|
347
|
+
}
|
|
348
|
+
};
|
|
349
|
+
this.accountRefresh = run().finally(() => { this.accountRefresh = null; });
|
|
350
|
+
return this.accountRefresh;
|
|
351
|
+
}
|
|
352
|
+
async adoptAccount(actor, head) {
|
|
353
|
+
await this.policy.revalidate(actor, 'admin');
|
|
354
|
+
if (actor.endpoint.kind !== 'browser' || !this.options.readAccountHistory)
|
|
355
|
+
throw new BridgeSecurityError('account_approval_required');
|
|
356
|
+
try {
|
|
357
|
+
const parsedHead = z.object({ rootId: z.string().regex(/^[A-Za-z0-9_-]{43}$/), head: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
|
|
358
|
+
revision: z.number().int().min(0).max(ACCOUNT_TRUST_LIMITS.maxTransitions) }).strict().parse(head);
|
|
359
|
+
const history = await this.options.readAccountHistory(this.accountAbort.signal);
|
|
360
|
+
if (!history)
|
|
361
|
+
throw new BridgeSecurityError('account_approval_required');
|
|
362
|
+
if (this.closed)
|
|
363
|
+
throw new BridgeSecurityError('account_storage_unavailable');
|
|
364
|
+
const result = await this.policy.applyAccountRead(history, { actor, head: parsedHead });
|
|
365
|
+
this.emitRevoked(result.revoked);
|
|
366
|
+
return result.head;
|
|
367
|
+
}
|
|
368
|
+
catch (error) {
|
|
369
|
+
if (error instanceof AccountReadUnavailable)
|
|
370
|
+
throw new BridgeSecurityError('account_storage_unavailable');
|
|
371
|
+
throw this.accountFailure(error);
|
|
372
|
+
}
|
|
373
|
+
}
|
|
295
374
|
onRevoked(listener) { this.revoked.add(listener); return () => this.revoked.delete(listener); }
|
|
296
|
-
async close() {
|
|
375
|
+
async close() {
|
|
376
|
+
this.closed = true;
|
|
377
|
+
this.accountAbort.abort();
|
|
378
|
+
if (this.accountTimer)
|
|
379
|
+
clearInterval(this.accountTimer);
|
|
380
|
+
this.accountTimer = null;
|
|
381
|
+
await this.accountRefresh?.catch(() => undefined);
|
|
382
|
+
this.revoked.clear();
|
|
383
|
+
this.replay.clear();
|
|
384
|
+
await this.audit.close();
|
|
385
|
+
await this.policy.close();
|
|
386
|
+
}
|
|
297
387
|
}
|
|
298
388
|
//# sourceMappingURL=security.js.map
|