youmd 0.11.0 → 0.13.0

package/dist/lib/connected-access-native.js

@@ -0,0 +1,403 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spawnNativeHost = exports.NATIVE_HOST_CLI_CONTROL_ARGV = exports.MAX_NATIVE_FRAME_BYTES = void 0;
+exports.nativeHostPaths = nativeHostPaths;
+exports.parseNativeHostConfig = parseNativeHostConfig;
+exports.requireBrowserNativeHostConfig = requireBrowserNativeHostConfig;
+exports.loadNativeHostConfig = loadNativeHostConfig;
+exports.assertNativeHostExecutable = assertNativeHostExecutable;
+exports.encodeNativeFrame = encodeNativeFrame;
+exports.decodeNativeFrame = decodeNativeFrame;
+exports.sha256Hex = sha256Hex;
+exports.nativeHostCall = nativeHostCall;
+exports.ensureNativeDevicePublicKey = ensureNativeDevicePublicKey;
+exports.readCachedNativeObservation = readCachedNativeObservation;
+exports.signPreparedNativeProof = signPreparedNativeProof;
+exports.signApprovedLocalCodexJobClaim = signApprovedLocalCodexJobClaim;
+exports.signApprovedLocalCodexJobStep = signApprovedLocalCodexJobStep;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+/** The native host enforces this same Chrome Native Messaging limit. */
+exports.MAX_NATIVE_FRAME_BYTES = 64 * 1024;
+const MAX_NATIVE_STDERR_BYTES = 8 * 1024;
+const NATIVE_TIMEOUT_MS = 5000;
+const EXTENSION_ID = /^[a-p]{32}$/;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+const FORBIDDEN_KEYS = new Set([
+    "cookie", "token", "authorization", "credential", "password", "secret", "totp",
+    "storage", "dom", "html", "content", "conversationtext", "rawdom",
+]);
+const CLI_ONLY_REQUEST_TYPES = new Set([
+    "connected_access.bootstrap_key_info_request.v1",
+    "connected_access.ensure_bootstrap_key_request.v1",
+    "connected_access.dpop_exchange_proof_request.v1",
+    "connected_access.dpop_artifact_proof_request.v1",
+]);
+/** The only privileged native-host surface available to this CLI. */
+exports.NATIVE_HOST_CLI_CONTROL_ARGV = ["--youmd-cli-control"];
+function nativeHostPaths(homedir = os.homedir()) {
+    const root = path.join(homedir, "Library", "Application Support", "YouMDConnectedAccess");
+    return {
+        root,
+        configPath: path.join(root, "native-host-config.json"),
+        executablePath: path.join(root, "bin", "youmd-native-host"),
+    };
+}
+function secureFile(pathname, deps, kind) {
+    const lstat = deps.lstatSync ?? fs.lstatSync;
+    const entry = lstat(pathname);
+    if (!entry.isFile() || entry.isSymbolicLink())
+        throw new Error(`native_host_${kind}_unsafe`);
+    // Installed host assets are private to this macOS account. Do not accept a
+    // group/world-writable binding or executable that another local account may replace.
+    if ((entry.mode & 0o022) !== 0 || (kind === "config" && (entry.mode & 0o077) !== 0)) {
+        throw new Error(`native_host_${kind}_permissions_unsafe`);
+    }
+    const currentUid = (deps.getuid ?? process.getuid)?.();
+    if (typeof currentUid === "number" && typeof entry.uid === "number" && entry.uid !== currentUid) {
+        throw new Error(`native_host_${kind}_owner_mismatch`);
+    }
+    if (kind === "executable" && (entry.mode & 0o111) === 0)
+        throw new Error("native_host_executable_not_executable");
+}
+function parseNativeHostConfig(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("native_host_config_invalid_json");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("native_host_config_invalid");
+    const record = value;
+    if (Object.keys(record).length === 1 && record.bindingClass === "cli_only")
+        return { bindingClass: "cli_only" };
+    if (Object.keys(record).length !== 2 || !("extensionId" in record) || !("bindingClass" in record))
+        throw new Error("native_host_config_unexpected_fields");
+    if (typeof record.extensionId !== "string" || !EXTENSION_ID.test(record.extensionId))
+        throw new Error("native_host_config_invalid_extension_id");
+    if (record.bindingClass !== "owner_registered_development" && record.bindingClass !== "chrome_web_store_provisioned") {
+        throw new Error("native_host_binding_class_not_supported");
+    }
+    return { extensionId: record.extensionId, bindingClass: record.bindingClass };
+}
+function requireBrowserNativeHostConfig(config) {
+    if (config.bindingClass === "cli_only")
+        throw new Error("native_host_browser_binding_required");
+    return config;
+}
+function loadNativeHostConfig(deps = {}) {
+    const paths = nativeHostPaths((deps.homedir ?? os.homedir)());
+    try {
+        secureFile(paths.configPath, deps, "config");
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            throw new Error("native_host_not_installed");
+        throw error;
+    }
+    const readFile = deps.readFileSync ?? fs.readFileSync;
+    const raw = readFile(paths.configPath, "utf8");
+    return { config: parseNativeHostConfig(raw), paths };
+}
+function assertNativeHostExecutable(paths, deps = {}) {
+    try {
+        secureFile(paths.executablePath, deps, "executable");
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            throw new Error("native_host_not_installed");
+        throw error;
+    }
+}
+function encodeNativeFrame(payload) {
+    if (payload.length > exports.MAX_NATIVE_FRAME_BYTES)
+        throw new Error("native_host_frame_too_large");
+    const header = Buffer.allocUnsafe(4);
+    header.writeUInt32LE(payload.length, 0);
+    return Buffer.concat([header, payload]);
+}
+/** Decode exactly one Native Messaging frame; trailing data is fail-closed. */
+function decodeNativeFrame(frame) {
+    if (frame.length < 4)
+        throw new Error("native_host_malformed_frame");
+    const length = frame.readUInt32LE(0);
+    if (length > exports.MAX_NATIVE_FRAME_BYTES)
+        throw new Error("native_host_frame_too_large");
+    if (frame.length !== length + 4)
+        throw new Error("native_host_malformed_frame");
+    return frame.subarray(4);
+}
+function ensureNoSecretMaterial(value) {
+    if (Array.isArray(value)) {
+        value.forEach(ensureNoSecretMaterial);
+        return;
+    }
+    if (!value || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (FORBIDDEN_KEYS.has(key.toLowerCase()))
+            throw new Error("native_host_forbidden_material");
+        ensureNoSecretMaterial(child);
+    }
+}
+function randomRequestId() {
+    return crypto.randomBytes(18).toString("base64url");
+}
+function sha256Hex(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+}
+/** Executes a one-request native messaging host process without a shell. */
+const spawnNativeHost = (executablePath, argv, framedRequest, timeoutMs) => new Promise((resolve, reject) => {
+    // `argv` originates in this module only. There is intentionally no CLI flag
+    // or config field that can add native-host arguments.
+    if (argv.length !== 1 || argv[0] !== exports.NATIVE_HOST_CLI_CONTROL_ARGV[0])
+        return reject(new Error("native_host_invalid_control_argv"));
+    const child = (0, child_process_1.spawn)(executablePath, [...argv], { stdio: ["pipe", "pipe", "pipe"], shell: false, windowsHide: true });
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let settled = false;
+    const finish = (error, result) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        if (error) {
+            child.kill();
+            reject(error);
+        }
+        else
+            resolve(result);
+    };
+    const timer = setTimeout(() => finish(new Error("native_host_timeout")), timeoutMs);
+    child.once("error", () => finish(new Error("native_host_unavailable")));
+    child.stdout.on("data", (chunk) => {
+        stdoutBytes += chunk.length;
+        if (stdoutBytes > exports.MAX_NATIVE_FRAME_BYTES + 4)
+            return finish(new Error("native_host_output_too_large"));
+        stdout.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+        stderrBytes += chunk.length;
+        if (stderrBytes > MAX_NATIVE_STDERR_BYTES)
+            return finish(new Error("native_host_stderr_too_large"));
+        stderr.push(chunk);
+    });
+    child.once("close", (code) => {
+        if (code !== 0)
+            return finish(new Error("native_host_failed"));
+        finish(undefined, Buffer.concat(stdout));
+    });
+    child.stdin.once("error", () => finish(new Error("native_host_write_failed")));
+    child.stdin.end(framedRequest);
+});
+exports.spawnNativeHost = spawnNativeHost;
+async function nativeHostCall(request, loaded, deps = {}) {
+    const local = loaded ?? loadNativeHostConfig(deps);
+    if (local.config.bindingClass === "cli_only" && !CLI_ONLY_REQUEST_TYPES.has(String(request.type))) {
+        throw new Error("native_host_cli_only_request_denied");
+    }
+    assertNativeHostExecutable(local.paths, deps);
+    ensureNoSecretMaterial(request);
+    const payload = Buffer.from(JSON.stringify(request), "utf8");
+    if (payload.length > exports.MAX_NATIVE_FRAME_BYTES)
+        throw new Error("native_host_request_too_large");
+    const frame = await (deps.run ?? exports.spawnNativeHost)(local.paths.executablePath, exports.NATIVE_HOST_CLI_CONTROL_ARGV, encodeNativeFrame(payload), NATIVE_TIMEOUT_MS);
+    const responsePayload = decodeNativeFrame(frame);
+    let response;
+    try {
+        response = JSON.parse(responsePayload.toString("utf8"));
+    }
+    catch {
+        throw new Error("native_host_invalid_json");
+    }
+    if (!response || typeof response !== "object" || Array.isArray(response))
+        throw new Error("native_host_invalid_response");
+    ensureNoSecretMaterial(response);
+    const result = response;
+    if (result.authorityGranted !== false || result.secretValuesExposed !== false)
+        throw new Error("native_host_response_not_non_authoritative");
+    if (result.ok !== true)
+        throw new Error(typeof result.error === "string" ? `native_host_${result.error}` : "native_host_rejected");
+    return result;
+}
+function baseRequest(type, config) {
+    const browser = requireBrowserNativeHostConfig(config);
+    return {
+        type,
+        applicationId: "com.youmd.connected-access.helper",
+        nativeHost: "com.youmd.connected_access",
+        extensionId: browser.extensionId,
+    };
+}
+async function ensureNativeDevicePublicKey(loaded, deps = {}) {
+    const local = loaded ?? loadNativeHostConfig(deps);
+    const result = await nativeHostCall(baseRequest("connected_access.ensure_key_request.v1", local.config), local, deps);
+    const x = result.publicKey;
+    if (typeof x !== "string" || !BASE64URL.test(x) || x.length !== 43 || result.keyStorage !== "macos_keychain_backed") {
+        throw new Error("native_host_invalid_public_key");
+    }
+    return { publicJwk: JSON.stringify({ crv: "Ed25519", kty: "OKP", x }), publicKey: x, config: local.config, paths: local.paths };
+}
+async function readCachedNativeObservation(loaded, deps = {}) {
+    const local = loaded ?? loadNativeHostConfig(deps);
+    const result = await nativeHostCall(baseRequest("connected_access.read_cached_observation_request.v1", local.config), local, deps);
+    const envelope = result.envelope;
+    const signature = result.signature;
+    const publicKey = result.publicKey;
+    const observationHash = result.observationHash;
+    const expiresAt = result.expiresAt;
+    // Native Messaging host serializes epoch seconds (Swift Int64); browser/API
+    // timestamps elsewhere use milliseconds. Keep the boundary explicit.
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    if (typeof envelope !== "string" || !BASE64URL.test(envelope) || typeof signature !== "string" || !BASE64URL.test(signature)
+        || typeof publicKey !== "string" || !BASE64URL.test(publicKey) || publicKey.length !== 43
+        || typeof observationHash !== "string" || !SHA256_HEX.test(observationHash)
+        || typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || !Number.isInteger(expiresAt)
+        || expiresAt <= nowSeconds || expiresAt > nowSeconds + 120) {
+        throw new Error("native_host_invalid_cached_observation");
+    }
+    return { envelope, signature, publicKey, observationHash, expiresAt, config: local.config, paths: local.paths };
+}
+async function signPreparedNativeProof(input, loaded, deps = {}) {
+    const local = loaded ?? loadNativeHostConfig(deps);
+    if (!BASE64URL.test(input.preparedCanonicalPayload) || !SHA256_HEX.test(input.observationHash)
+        || !BASE64URL.test(input.expectedPublicKey) || input.expiresAt <= Date.now())
+        throw new Error("invalid_prepared_proof");
+    const prepared = Buffer.from(input.preparedCanonicalPayload, "base64url");
+    if (prepared.length === 0 || prepared.length > 4096)
+        throw new Error("invalid_prepared_proof");
+    const localHash = sha256Hex(prepared);
+    const result = await nativeHostCall({
+        ...baseRequest("connected_access.sign_prepared_request.v1", local.config),
+        requestId: randomRequestId(),
+        expiresAt: Math.trunc(input.expiresAt / 1000),
+        observationHash: input.observationHash,
+        preparedCanonicalPayload: input.preparedCanonicalPayload,
+    }, local, deps);
+    if (result.payloadHash !== localHash || result.publicKey !== input.expectedPublicKey || typeof result.signature !== "string"
+        || !BASE64URL.test(result.signature) || result.signature.length < 80 || result.signature.length > 128) {
+        throw new Error("native_host_signature_response_mismatch");
+    }
+    return { signature: result.signature, payloadHash: localHash };
+}
+/**
+ * Signs only a server-canonical, separately approved job claim. This is not
+ * browser-observation proof and deliberately has no observation hash input.
+ */
+async function signApprovedLocalCodexJobClaim(input, loaded, deps = {}) {
+    const local = loaded ?? loadNativeHostConfig(deps);
+    if (!BASE64URL.test(input.approvedCanonicalClaim) || !BASE64URL.test(input.expectedPublicKey)
+        || input.expectedPublicKey.length !== 43 || !Number.isFinite(input.expiresAt) || input.expiresAt <= Date.now()) {
+        throw new Error("invalid_approved_job_claim");
+    }
+    const claim = Buffer.from(input.approvedCanonicalClaim, "base64url");
+    if (claim.length === 0 || claim.length > 8192)
+        throw new Error("invalid_approved_job_claim");
+    const localHash = sha256Hex(claim);
+    let parsed;
+    try {
+        parsed = JSON.parse(claim.toString("utf8"));
+    }
+    catch {
+        throw new Error("invalid_approved_job_claim");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("invalid_approved_job_claim");
+    const record = parsed;
+    const required = ["schemaVersion", "jobId", "jobDigest", "approvalNonce", "approvalRef", "idempotencyKey", "keyId", "keyGeneration", "applicationId", "applicationGeneration", "deviceId", "ownerRef", "workspaceRef", "tenantRef", "projectRef", "runtimeId", "audience", "target", "action", "contextRef", "contextDigest", "fileHashes", "modelClass", "executionProfile", "networkPolicy", "writePolicy", "authorizationEvidence", "deadline", "htu", "htm", "iat", "jti"];
+    if (Object.keys(record).length !== required.length || required.some((key) => !(key in record))
+        || record.schemaVersion !== "you-md/connected-agent-access/local-codex-job-claim/v1"
+        || record.applicationId !== "app:youmd-local-codex-adapter"
+        || record.audience !== "youmd:personal" || record.target !== "openai_codex" || record.action !== "read_only_audit" || record.modelClass !== "codex"
+        || record.tenantRef !== "personal" || record.projectRef !== "project:youmd-owner-context" || record.runtimeId !== "runtime:youmd-local-codex" || record.contextRef !== "context:youmd-owner-summary" || record.contextDigest !== "sha256:4f5580463381df28be0ae267baa874c39ee5abee03096998803996df8440cf85"
+        || typeof record.htu !== "string" || record.htu !== `https://kindly-cassowary-600.convex.site/api/v1/me/agent-jobs/${record.jobId}/claim` || record.htm !== "POST"
+        || !isExactReadonlyProfile(record.executionProfile) || !isExactNoPolicy(record.networkPolicy) || !isExactNoPolicy(record.writePolicy)
+        || !Array.isArray(record.fileHashes) || record.fileHashes.length < 1 || record.fileHashes.some((file) => !isExactFileHash(file))
+        || !record.authorizationEvidence || typeof record.authorizationEvidence !== "object" || Array.isArray(record.authorizationEvidence)
+        || record.authorizationEvidence.kind !== "owner_scoped_grant")
+        throw new Error("invalid_approved_job_claim");
+    const result = await nativeHostCall({
+        ...baseRequest("connected_access.sign_approved_job_claim_request.v1", local.config),
+        requestId: randomRequestId(),
+        expiresAt: Math.trunc(input.expiresAt / 1000),
+        approvedCanonicalClaim: input.approvedCanonicalClaim,
+    }, local, deps);
+    if (result.payloadHash !== localHash || result.publicKey !== input.expectedPublicKey || typeof result.signature !== "string"
+        || !BASE64URL.test(result.signature) || result.signature.length < 80 || result.signature.length > 128) {
+        throw new Error("native_host_approved_job_signature_response_mismatch");
+    }
+    return { signature: result.signature, payloadHash: localHash };
+}
+function isSafeDeclaredPath(value) { return /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]{1,512}$/.test(value) && !value.toLowerCase().split("/").some((part) => /^(\.env(?:\..*)?|\.codex|\.claude|\.cursor|\.ssh|\.gnupg|\.git|node_modules|auth\.json|.*(?:credential|secret|token|cookie).*|keychains|chrome|application support)$/.test(part)); }
+function isExactFileHash(value) { return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join(",") === "digest,path" && typeof value.path === "string" && isSafeDeclaredPath(value.path) && /^sha256:[a-f0-9]{64}$/.test(String(value.digest)); }
+function isExactNoPolicy(value) { if (!value || typeof value !== "object" || Array.isArray(value))
+    return false; const record = value; const keys = Object.keys(record).sort().join(","); const allowed = keys === "allowedOrigins,mode" ? record.allowedOrigins : keys === "allowedPaths,mode" ? record.allowedPaths : undefined; return record.mode === "none" && Array.isArray(allowed) && allowed.length === 0; }
+function isExactReadonlyProfile(value) { if (!value || typeof value !== "object" || Array.isArray(value))
+    return false; const r = value; const keys = ["profile", "runtimeTrust", "runner", "inputPresentationMode", "toolFilesystemMode", "toolNetworkMode", "toolWriteMode", "providerInferenceTransport", "outputMode", "lifecycleEventSchema"]; return Object.keys(r).length === keys.length && keys.every((key) => key in r) && r.profile === "bounded_local_codex_readonly/v1" && r.runtimeTrust === "trusted_local_private" && r.runner === "local_codex" && r.inputPresentationMode === "declared_snapshot" && r.toolFilesystemMode === "read_only" && r.toolNetworkMode === "none" && r.toolWriteMode === "none" && r.providerInferenceTransport === "first_party_client_managed/openai" && r.outputMode === "hash_only" && r.lifecycleEventSchema === "you-md/connected-agent-access/agent-job-lifecycle-event/v1"; }
+/** CLI-control-only signature for one canonical start/event/complete payload. */
+async function signApprovedLocalCodexJobStep(input, loaded, deps = {}) {
+    const local = loaded ?? loadNativeHostConfig(deps);
+    if (!BASE64URL.test(input.approvedCanonicalStep) || !BASE64URL.test(input.expectedPublicKey) || input.expectedPublicKey.length !== 43 || input.expiresAt <= Date.now())
+        throw new Error("invalid_approved_job_step");
+    const step = Buffer.from(input.approvedCanonicalStep, "base64url");
+    if (step.length === 0 || step.length > 8192)
+        throw new Error("invalid_approved_job_step");
+    let parsed;
+    try {
+        parsed = JSON.parse(step.toString("utf8"));
+    }
+    catch {
+        throw new Error("invalid_approved_job_step");
+    }
+    const base = ["schemaVersion", "type", "jobId", "jobDigest", "idempotencyKey", "approvalRef", "keyId", "keyGeneration", "applicationId", "applicationGeneration", "deviceId", "ownerRef", "workspaceRef", "tenantRef", "projectRef", "runtimeId", "audience", "target", "action", "contextRef", "contextDigest", "fileHashes", "modelClass", "executionProfile", "networkPolicy", "writePolicy", "authorizationEvidence", "deadline", "htu", "htm", "iat", "jti"];
+    const extra = parsed.type === "start" ? [] : parsed.type === "event" ? ["eventId", "eventType", "sequence", "payloadHash"] : ["outcome", "resultDigest"];
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || Object.keys(parsed).length !== base.length + extra.length || [...base, ...extra].some((key) => !(key in parsed)) || parsed.schemaVersion !== "you-md/connected-agent-access/local-codex-job-step/v1" || !["start", "event", "complete"].includes(String(parsed.type)) || parsed.applicationId !== "app:youmd-local-codex-adapter" || parsed.audience !== "youmd:personal" || parsed.target !== "openai_codex" || parsed.action !== "read_only_audit" || parsed.modelClass !== "codex" || parsed.tenantRef !== "personal" || parsed.projectRef !== "project:youmd-owner-context" || parsed.runtimeId !== "runtime:youmd-local-codex" || parsed.contextRef !== "context:youmd-owner-summary" || parsed.contextDigest !== "sha256:4f5580463381df28be0ae267baa874c39ee5abee03096998803996df8440cf85" || parsed.htm !== "POST" || typeof parsed.jobId !== "string" || parsed.htu !== `https://kindly-cassowary-600.convex.site/api/v1/me/agent-jobs/${parsed.jobId}/${parsed.type === "event" ? "events" : parsed.type}` || !isExactReadonlyProfile(parsed.executionProfile) || !isExactNoPolicy(parsed.networkPolicy) || !isExactNoPolicy(parsed.writePolicy) || !Array.isArray(parsed.fileHashes) || parsed.fileHashes.length < 1 || parsed.fileHashes.some((file) => !isExactFileHash(file)))
+        throw new Error("invalid_approved_job_step");
+    const payloadHash = sha256Hex(step);
+    const result = await nativeHostCall({ ...baseRequest("connected_access.sign_approved_job_step_request.v1", local.config), requestId: randomRequestId(), expiresAt: Math.trunc(input.expiresAt / 1000), approvedCanonicalStep: input.approvedCanonicalStep }, local, deps);
+    if (result.payloadHash !== payloadHash || result.publicKey !== input.expectedPublicKey || typeof result.signature !== "string" || !BASE64URL.test(result.signature) || result.signature.length < 80 || result.signature.length > 128)
+        throw new Error("native_host_approved_job_step_signature_response_mismatch");
+    return { signature: result.signature, payloadHash };
+}
+//# sourceMappingURL=connected-access-native.js.map

package/dist/lib/connected-access-native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-access-native.js","sourceRoot":"","sources":["../../src/lib/connected-access-native.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,0CAOC;AAkBD,sDAYC;AAED,wEAGC;AAED,oDASC;AAED,gEAKC;AAED,8CAKC;AAGD,8CAMC;AAeD,8BAEC;AA6CD,wCAuBC;AAYD,kEAQC;AAED,kEAmBC;AAED,0DAwBC;AAMD,wEAuCC;AAQD,sEAWC;AApVD,+CAAiC;AACjC,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,iDAAsC;AAEtC,wEAAwE;AAC3D,QAAA,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,CAAC;AACzC,MAAM,iBAAiB,GAAG,IAAK,CAAC;AAChC,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM;IAC9E,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,QAAQ;CAClE,CAAC,CAAC;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,gDAAgD;IAChD,kDAAkD;IAClD,iDAAiD;IACjD,iDAAiD;CAClD,CAAC,CAAC;AAcH,qEAAqE;AACxD,QAAA,4BAA4B,GAAG,CAAC,qBAAqB,CAAU,CAAC;AAW7E,SAAgB,eAAe,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,sBAAsB,CAAC,CAAC;IAC1F,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAAoB,EAAE,IAA6B;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC;IAC7F,2EAA2E;IAC3E,qFAAqF;IACrF,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,qBAAqB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IACvD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,iBAAiB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AACpH,CAAC;AAED,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAAC,CAAC;IAC9F,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IAChH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC3J,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACjJ,IAAI,MAAM,CAAC,YAAY,KAAK,8BAA8B,IAAI,MAAM,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;QACrH,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AAChF,CAAC;AAED,SAAgB,8BAA8B,CAAC,MAAwB;IACrE,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAuB,EAAE;IAC5D,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC;QAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACnE,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtG,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,CAAC;IACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAED,SAAgB,0BAA0B,CAAC,KAAsB,EAAE,OAAuB,EAAE;IAC1F,IAAI,CAAC;QAAC,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC3E,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtG,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,8BAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,8BAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC7F,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,4EAA4E;AACrE,MAAM,eAAe,GAAqB,CAAC,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACnI,4EAA4E;IAC5E,sDAAsD;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,oCAA4B,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;IACnI,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACrH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAe,EAAE,EAAE;QAChD,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;;YAAM,OAAO,CAAC,MAAO,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,WAAW,GAAG,8BAAsB,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACvG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,WAAW,GAAG,uBAAuB;YAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACpG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAlCU,QAAA,eAAe,mBAkCzB;AAQI,KAAK,UAAU,cAAc,CAClC,OAAgC,EAChC,MAA6D,EAC7D,OAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,0BAA0B,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,8BAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAe,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,oCAA4B,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC3J,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAAC,CAAC;IACvH,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC1H,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,QAAmC,CAAC;IACnD,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,IAAI,MAAM,CAAC,mBAAmB,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC7I,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACnI,OAAO,MAA4B,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAwB;IACzD,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO;QACL,IAAI;QACJ,aAAa,EAAE,mCAAmC;QAClD,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAAC,MAA6D,EAAE,OAAuB,EAAE;IACxI,MAAM,KAAK,GAAG,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,wCAAwC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACtH,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,KAAK,uBAAuB,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAClI,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAAC,MAA6D,EAAE,OAAuB,EAAE;IACxI,MAAM,KAAK,GAAG,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,qDAAqD,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnI,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;WACvH,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;WACtF,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC;WACxE,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;WAC5F,SAAS,IAAI,UAAU,IAAI,SAAS,GAAG,UAAU,GAAG,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAClH,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAAC,KAK7C,EAAE,MAA6D,EAAE,OAAuB,EAAE;IACzF,MAAM,KAAK,GAAG,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;WACzF,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1H,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,WAAW,CAAC,2CAA2C,EAAE,KAAK,CAAC,MAAM,CAAC;QACzE,SAAS,EAAE,eAAe,EAAE;QAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QAC7C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;KACzD,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChB,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WACvH,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,8BAA8B,CAAC,KAIpD,EAAE,MAA6D,EAAE,OAAuB,EAAE;IACzF,MAAM,KAAK,GAAG,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;WACxF,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjH,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAAC,CAAC;IAC7G,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,uBAAuB,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/c,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;WACzF,MAAM,CAAC,aAAa,KAAK,wDAAwD;WACjF,MAAM,CAAC,aAAa,KAAK,+BAA+B;WACxD,MAAM,CAAC,QAAQ,KAAK,gBAAgB,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO;WAChJ,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,6BAA6B,IAAI,MAAM,CAAC,SAAS,KAAK,2BAA2B,IAAI,MAAM,CAAC,UAAU,KAAK,6BAA6B,IAAI,MAAM,CAAC,aAAa,KAAK,yEAAyE;WACvS,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,iEAAiE,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM;WAC/J,CAAC,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;WAClI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;WAC7H,CAAC,MAAM,CAAC,qBAAqB,IAAI,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;WAC/H,MAAM,CAAC,qBAAiD,CAAC,IAAI,KAAK,oBAAoB;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5I,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,WAAW,CAAC,qDAAqD,EAAE,KAAK,CAAC,MAAM,CAAC;QACnF,SAAS,EAAE,eAAe,EAAE;QAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QAC7C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChB,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WACvH,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,IAAa,OAAO,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sKAAsK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3W,SAAS,eAAe,CAAC,KAAc,IAAa,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,aAAa,IAAI,OAAQ,KAAiC,CAAC,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAE,KAAiC,CAAC,IAAc,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAE,KAAiC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1a,SAAS,eAAe,CAAC,KAAc,IAAa,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAAE,OAAO,KAAK,CAAC,CAAC,MAAM,MAAM,GAAG,KAAgC,CAAC,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,OAAO,GAAG,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;AAClc,SAAS,sBAAsB,CAAC,KAAc,IAAa,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAgC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAE,4BAA4B,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,iCAAiC,IAAI,CAAC,CAAC,YAAY,KAAK,uBAAuB,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,qBAAqB,KAAK,mBAAmB,IAAI,CAAC,CAAC,kBAAkB,KAAK,WAAW,IAAI,CAAC,CAAC,eAAe,KAAK,MAAM,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,CAAC,0BAA0B,KAAK,mCAAmC,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,CAAC,oBAAoB,KAAK,4DAA4D,CAAC,CAAC,CAAC;AAE56B,iFAAiF;AAC1E,KAAK,UAAU,6BAA6B,CAAC,KAAsF,EAAE,MAA6D,EAAE,OAAuB,EAAE;IAClO,MAAM,KAAK,GAAG,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrN,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9J,IAAI,MAA+B,CAAC;IAAC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAAC,CAAC;IAC3K,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,uBAAuB,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAClc,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzJ,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,uDAAuD,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,+BAA+B,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,6BAA6B,IAAI,MAAM,CAAC,SAAS,KAAK,2BAA2B,IAAI,MAAM,CAAC,UAAU,KAAK,6BAA6B,IAAI,MAAM,CAAC,aAAa,KAAK,yEAAyE,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,iEAAiE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/0C,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,WAAW,CAAC,oDAAoD,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/S,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACnT,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;AACtD,CAAC"}

package/dist/lib/connected-context.d.ts

@@ -0,0 +1,82 @@
+import { type NativeHostDeps } from "./connected-access-native";
+export declare const CONNECTED_CONTEXT_APPLICATION_ID = "app:youmd-local-helper";
+export declare const CONNECTED_CONTEXT_RUNTIME_BINDING = "com.youmd.connected-access-bootstrap";
+export declare const CONNECTED_CONTEXT_AUDIENCE = "youmd:personal";
+export declare const CONNECTED_CONTEXT_SCOPES: readonly ["read:private"];
+export declare const CONNECTED_CONTEXT_RESOURCE_URI = "youmd://connected-context/current";
+type PublicJwk = {
+    kty: "OKP";
+    crv: "Ed25519";
+    x: string;
+};
+type BootstrapKey = {
+    publicJwk: PublicJwk;
+    keyThumbprint: string;
+};
+type DpopProof = BootstrapKey & {
+    dpopProof: string;
+    iat: number;
+    jti: string;
+};
+export type ConnectedContextNative = {
+    keyInfo?(): Promise<BootstrapKey | null>;
+    ensureKey(): Promise<BootstrapKey>;
+    signExchange(input: {
+        nonce: string;
+    }): Promise<DpopProof>;
+    signArtifact(input: {
+        artifactId: string;
+        accessTokenDigest: string;
+    }): Promise<DpopProof>;
+};
+export type ConnectedContextDeps = {
+    fetch: typeof fetch;
+    native: ConnectedContextNative;
+    authToken: () => string | undefined;
+    apiUrl: () => string;
+    homedir?: () => string;
+    machineKey?: () => string;
+    now?: () => number;
+    randomBytes?: (size: number) => Buffer;
+};
+export type ConnectedContextVerificationDeps = Pick<ConnectedContextDeps, "fetch" | "authToken" | "apiUrl" | "homedir" | "now" | "randomBytes">;
+export type ConnectedContextBootstrapOptions = {
+    trustCurrentGeneration?: boolean;
+};
+/** Strict adapter over the installed Swift native helper's CLI-control ABI. */
+export declare function createNativeConnectedContext(deps?: NativeHostDeps): ConnectedContextNative;
+export type ConnectedContextStatus = {
+    connected: boolean;
+    state: "ready" | "missing" | "expired" | "revoked" | "invalid";
+    manifestId?: string;
+    generation?: number;
+    expiresAt?: string;
+    artifactDigest?: string;
+    recovered?: boolean;
+    authorityGranted: false;
+    secretValuesExposed: false;
+};
+export declare function bootstrapConnectedContext(deps: ConnectedContextDeps, options?: ConnectedContextBootstrapOptions): Promise<ConnectedContextStatus>;
+export declare function getConnectedContextStatus(deps?: Pick<ConnectedContextDeps, "homedir" | "now">): ConnectedContextStatus;
+export declare function verifyConnectedContext(deps: ConnectedContextVerificationDeps): Promise<ConnectedContextStatus>;
+export declare function revokeConnectedContext(deps: ConnectedContextDeps, options?: {
+    manifestId?: string;
+    revokeApplication?: boolean;
+    revokeKey?: boolean;
+}): Promise<ConnectedContextStatus>;
+export declare function readConnectedContextResource(deps?: Pick<ConnectedContextDeps, "homedir" | "now">): string;
+export declare function listConnectedContextMcpResource(deps: ConnectedContextVerificationDeps): Promise<{
+    uri: string;
+    name: string;
+    description: string;
+    mimeType: string;
+} | null>;
+export declare function readConnectedContextMcpResource(uri: string, deps: ConnectedContextVerificationDeps): Promise<{
+    contents: {
+        uri: string;
+        mimeType: string;
+        text: string;
+    }[];
+}>;
+export {};
+//# sourceMappingURL=connected-context.d.ts.map

package/dist/lib/connected-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-context.d.ts","sourceRoot":"","sources":["../../src/lib/connected-context.ts"],"names":[],"mappings":"AAMA,OAAO,EAAmC,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEjG,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AACzE,eAAO,MAAM,iCAAiC,yCAAyC,CAAC;AACxF,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,2BAA4B,CAAC;AAClE,eAAO,MAAM,8BAA8B,sCAAsC,CAAC;AAOlF,KAAK,SAAS,GAAG;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC3D,KAAK,YAAY,GAAG;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AACpE,KAAK,SAAS,GAAG,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,CAAC,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACzC,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACnC,YAAY,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,YAAY,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC5F,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,MAAM,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACxC,CAAC;AACF,MAAM,MAAM,gCAAgC,GAAG,IAAI,CAAC,oBAAoB,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,aAAa,CAAC,CAAC;AAChJ,MAAM,MAAM,gCAAgC,GAAG;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA+BpF,+EAA+E;AAC/E,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,cAAmB,GAAG,sBAAsB,CAa9F;AAkBD,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,KAAK,CAAC;IACxB,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AA2KF,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,GAAE,gCAAqC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA2C3J;AAED,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,KAAK,CAAM,GAAG,sBAAsB,CAI1H;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,gCAAgC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAYpH;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiBjM;AAED,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,KAAK,CAAM,GAAG,MAAM,CAE7G;AAED,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,gCAAgC;;;;;UAE3F;AAED,wBAAsB,+BAA+B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC;;;;;;GAIxG"}