youmd 0.11.0 → 0.13.0

package/dist/lib/connected-context.js

@@ -0,0 +1,610 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONNECTED_CONTEXT_RESOURCE_URI = exports.CONNECTED_CONTEXT_SCOPES = exports.CONNECTED_CONTEXT_AUDIENCE = exports.CONNECTED_CONTEXT_RUNTIME_BINDING = exports.CONNECTED_CONTEXT_APPLICATION_ID = void 0;
+exports.createNativeConnectedContext = createNativeConnectedContext;
+exports.bootstrapConnectedContext = bootstrapConnectedContext;
+exports.getConnectedContextStatus = getConnectedContextStatus;
+exports.verifyConnectedContext = verifyConnectedContext;
+exports.revokeConnectedContext = revokeConnectedContext;
+exports.readConnectedContextResource = readConnectedContextResource;
+exports.listConnectedContextMcpResource = listConnectedContextMcpResource;
+exports.readConnectedContextMcpResource = readConnectedContextMcpResource;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const canonical_json_1 = require("./canonical-json");
+const machine_identity_1 = require("./machine-identity");
+const connected_access_native_1 = require("./connected-access-native");
+exports.CONNECTED_CONTEXT_APPLICATION_ID = "app:youmd-local-helper";
+exports.CONNECTED_CONTEXT_RUNTIME_BINDING = "com.youmd.connected-access-bootstrap";
+exports.CONNECTED_CONTEXT_AUDIENCE = "youmd:personal";
+exports.CONNECTED_CONTEXT_SCOPES = ["read:private"];
+exports.CONNECTED_CONTEXT_RESOURCE_URI = "youmd://connected-context/current";
+const PROD_ISSUER = "https://kindly-cassowary-600.convex.site";
+const ROOT_SCHEMA = "you-md/connected-agent-access/owner-workspace-manifest/v1";
+const DIGEST = /^sha256:[a-f0-9]{64}$/;
+const B64URL_43 = /^[A-Za-z0-9_-]{43}$/;
+const SECRET_CANARY = /(?:\b(?:yg|ym)_[A-Za-z0-9._-]{3,}|\bbearer\s+[A-Za-z0-9._-]+|file:\/{1,3}|(?:^|[\s'"=])(?:~\/|\/Users\/|\/home\/)|\b(?:access|refresh|id)?[_-]?(?:token|cookie|totp|password|api[_-]?key|secret|authorization|client[_-]?secret)\s*[:=])/im;
+function bootstrapNativeLoaded(deps) {
+    return {
+        // Bootstrap CLI control is bound by the request vocabulary below, not by
+        // a Chrome extension identity. The native host ignores this legacy config
+        // field in CLI-control mode and independently validates the executable.
+        config: { extensionId: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", bindingClass: "owner_registered_development" },
+        paths: (0, connected_access_native_1.nativeHostPaths)((deps.homedir ?? os.homedir)()),
+    };
+}
+function exactNativeFields(value, expected) {
+    if (Object.keys(value).sort().join(",") !== [...expected].sort().join(",") || value.ok !== true || value.authorityGranted !== false || value.secretValuesExposed !== false)
+        throw new Error("native_bootstrap_response_invalid");
+}
+function parseNativeBootstrapKey(value, expectedType, expectedStatus) {
+    exactNativeFields(value, ["type", "ok", "status", "publicJwk", "keyThumbprint", "keyStorage", "authorityGranted", "secretValuesExposed"]);
+    if (value.type !== expectedType || value.status !== expectedStatus || value.keyStorage !== "macos_keychain_backed")
+        throw new Error("native_bootstrap_key_invalid");
+    const publicJwk = exactJwk(value.publicJwk);
+    const keyThumbprint = typeof value.keyThumbprint === "string" ? value.keyThumbprint : "";
+    if (keyThumbprint !== thumbprint(publicJwk))
+        throw new Error("native_bootstrap_key_invalid");
+    return { publicJwk, keyThumbprint };
+}
+function parseNativeDpop(value, expectedStatus) {
+    exactNativeFields(value, ["type", "ok", "status", "dpopProof", "publicJwk", "keyThumbprint", "iat", "jti", "keyStorage", "authorityGranted", "secretValuesExposed"]);
+    const key = parseNativeBootstrapKey({ type: value.type, ok: value.ok, status: "key_ready", publicJwk: value.publicJwk, keyThumbprint: value.keyThumbprint, keyStorage: value.keyStorage, authorityGranted: value.authorityGranted, secretValuesExposed: value.secretValuesExposed }, "connected_access.dpop_proof_result.v1", "key_ready");
+    if (value.type !== "connected_access.dpop_proof_result.v1" || value.status !== expectedStatus || typeof value.dpopProof !== "string" || typeof value.iat !== "number" || !Number.isInteger(value.iat) || typeof value.jti !== "string")
+        throw new Error("native_bootstrap_dpop_invalid");
+    return { ...key, dpopProof: value.dpopProof, iat: value.iat, jti: value.jti };
+}
+/** Strict adapter over the installed Swift native helper's CLI-control ABI. */
+function createNativeConnectedContext(deps = {}) {
+    const common = { applicationId: exports.CONNECTED_CONTEXT_APPLICATION_ID, runtimeBinding: exports.CONNECTED_CONTEXT_RUNTIME_BINDING };
+    const call = (request) => (0, connected_access_native_1.nativeHostCall)(request, bootstrapNativeLoaded(deps), deps);
+    return {
+        keyInfo: async () => {
+            const value = await call({ type: "connected_access.bootstrap_key_info_request.v1", ...common });
+            if (value.status === "key_absent") {
+                exactNativeFields(value, ["type", "ok", "status", "keyStorage", "authorityGranted", "secretValuesExposed"]);
+                if (value.type !== "connected_access.bootstrap_key_info_result.v1" || value.keyStorage !== "macos_keychain_backed")
+                    throw new Error("native_bootstrap_key_invalid");
+                return null;
+            }
+            return parseNativeBootstrapKey(value, "connected_access.bootstrap_key_info_result.v1", "key_present");
+        },
+        ensureKey: async () => parseNativeBootstrapKey(await call({ type: "connected_access.ensure_bootstrap_key_request.v1", ...common }), "connected_access.ensure_bootstrap_key_result.v1", "key_ready"),
+        signExchange: async ({ nonce }) => parseNativeDpop(await call({ type: "connected_access.dpop_exchange_proof_request.v1", ...common, nonce }), "signed_dpop_exchange_proof"),
+        signArtifact: async ({ artifactId, accessTokenDigest }) => parseNativeDpop(await call({ type: "connected_access.dpop_artifact_proof_request.v1", ...common, artifactId, accessTokenDigest }), "signed_dpop_artifact_proof"),
+    };
+}
+function now(deps) { return (deps.now ?? Date.now)(); }
+function hashBytes(value) { return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`; }
+function b64urlHash(value) { return crypto.createHash("sha256").update(value, "utf8").digest("base64url"); }
+function exactObject(value, keys, code) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(code);
+    const row = value;
+    if (Object.keys(row).sort().join(",") !== [...keys].sort().join(","))
+        throw new Error(code);
+    return row;
+}
+function exactJwk(value) {
+    const row = exactObject(value, ["crv", "kty", "x"], "bootstrap_key_invalid");
+    if (row.kty !== "OKP" || row.crv !== "Ed25519" || typeof row.x !== "string" || !B64URL_43.test(row.x))
+        throw new Error("bootstrap_key_invalid");
+    return { kty: "OKP", crv: "Ed25519", x: row.x };
+}
+function thumbprint(jwk) { return crypto.createHash("sha256").update((0, canonical_json_1.canonicalJsonString)(jwk)).digest("base64url"); }
+function safeId(value, pattern, code) { if (typeof value !== "string" || !pattern.test(value))
+    throw new Error(code); return value; }
+function isoMs(value, code) { if (typeof value !== "string")
+    throw new Error(code); const parsed = Date.parse(value); if (!Number.isFinite(parsed))
+    throw new Error(code); return parsed; }
+function without(value, key) { const copy = { ...value }; delete copy[key]; return copy; }
+function verifyEd25519(jwk, message, signature, code) {
+    if (typeof signature !== "string" || !/^[A-Za-z0-9+/]{86}==$/.test(signature))
+        throw new Error(code);
+    let key;
+    try {
+        key = crypto.createPublicKey({ key: jwk, format: "jwk" });
+    }
+    catch {
+        throw new Error(code);
+    }
+    if (!crypto.verify(null, Buffer.from(message, "utf8"), key, Buffer.from(signature, "base64")))
+        throw new Error(code);
+}
+function verifySignature(payload, signatureValue, jwk, expectedKeyId, code) {
+    const signature = exactObject(signatureValue, ["algorithm", "canonicalization", "keyId", "canonicalDigest", "value"], code);
+    if (signature.algorithm !== "ed25519" || signature.canonicalization !== "RFC8785" || signature.keyId !== expectedKeyId)
+        throw new Error(code);
+    const digest = hashBytes((0, canonical_json_1.canonicalJsonString)(payload));
+    if (signature.canonicalDigest !== digest)
+        throw new Error(code);
+    verifyEd25519(jwk, (0, canonical_json_1.canonicalJsonString)({ payload, canonicalization: "RFC8785" }), signature.value, code);
+}
+function parseJwks(value, keyId) {
+    const root = exactObject(value, ["keys"], "bootstrap_jwks_invalid");
+    if (!Array.isArray(root.keys) || root.keys.length < 1 || root.keys.length > 2)
+        throw new Error("bootstrap_jwks_invalid");
+    const matches = root.keys.filter((candidate) => candidate && typeof candidate === "object" && !Array.isArray(candidate) && candidate.kid === keyId);
+    if (matches.length !== 1)
+        throw new Error("bootstrap_issuer_key_not_found");
+    const key = exactObject(matches[0], ["alg", "crv", "kid", "kty", "use", "x"], "bootstrap_jwks_invalid");
+    if (key.alg !== "EdDSA" || key.use !== "sig" || key.kid !== keyId || "d" in key)
+        throw new Error("bootstrap_jwks_invalid");
+    return exactJwk({ kty: key.kty, crv: key.crv, x: key.x });
+}
+function validateManifestShape(value) {
+    const keys = ["schemaVersion", "manifestId", "issuer", "ownerRef", "workspaceRef", "tenantRef", "audience", "generation", "notBefore", "issuedAt", "expiresAt", "devices", "applications", "capabilityAllowlist", "toolAllowlist", "resourceAllowlist", "defaultBudget", "mcpProtectedResources", "artifacts", "bootstrap", "rollback", "keyGovernance", "secretValuesExposed", "signature"];
+    const row = exactObject(value, keys, "bootstrap_manifest_schema_invalid");
+    if (row.schemaVersion !== ROOT_SCHEMA || row.secretValuesExposed !== false)
+        throw new Error("bootstrap_manifest_schema_invalid");
+    safeId(row.manifestId, /^manifest:[a-z0-9][a-z0-9_-]{7,127}$/, "bootstrap_manifest_schema_invalid");
+    safeId(row.ownerRef, /^user:[A-Za-z0-9._-]{3,128}$/, "bootstrap_manifest_schema_invalid");
+    safeId(row.workspaceRef, /^workspace:[a-f0-9]{64}$/, "bootstrap_manifest_schema_invalid");
+    if (row.tenantRef !== "personal" || row.audience !== exports.CONNECTED_CONTEXT_AUDIENCE || !Number.isInteger(row.generation) || Number(row.generation) < 1)
+        throw new Error("bootstrap_manifest_binding_invalid");
+    for (const field of ["notBefore", "issuedAt", "expiresAt"])
+        isoMs(row[field], "bootstrap_manifest_time_invalid");
+    if (!Array.isArray(row.devices) || row.devices.length !== 1 || !Array.isArray(row.applications) || row.applications.length !== 1 || !Array.isArray(row.artifacts) || row.artifacts.length !== 1)
+        throw new Error("bootstrap_manifest_schema_invalid");
+    return row;
+}
+function verifyManifest(value, manifestDigest, jwk, expected) {
+    const manifest = validateManifestShape(value);
+    if (manifest.issuer !== expected.issuer || expected.issuer !== PROD_ISSUER)
+        throw new Error("bootstrap_manifest_issuer_invalid");
+    const notBefore = isoMs(manifest.notBefore, "bootstrap_manifest_time_invalid");
+    const issuedAt = isoMs(manifest.issuedAt, "bootstrap_manifest_time_invalid");
+    const expiresAt = isoMs(manifest.expiresAt, "bootstrap_manifest_time_invalid");
+    if (notBefore > expected.now + 60000 || issuedAt > expected.now + 60000 || expiresAt <= expected.now || expiresAt - issuedAt > 10 * 60000)
+        throw new Error("bootstrap_manifest_expired");
+    const generation = Number(manifest.generation);
+    if (generation < expected.floor)
+        throw new Error("bootstrap_manifest_rollback");
+    const device = manifest.devices.find((item) => item && typeof item === "object" && item.deviceId === expected.deviceId);
+    if (!device || device.status !== "active" || device.revokedAt !== null || !Array.isArray(device.keyThumbprints) || device.keyThumbprints.length !== 1 || device.keyThumbprints[0] !== expected.keyThumbprint)
+        throw new Error("bootstrap_manifest_device_mismatch");
+    const application = manifest.applications.find((item) => item && typeof item === "object" && item.applicationId === exports.CONNECTED_CONTEXT_APPLICATION_ID);
+    if (!application || application.status !== "active" || application.revokedAt !== null)
+        throw new Error("bootstrap_manifest_application_mismatch");
+    if ((0, canonical_json_1.canonicalJsonString)(manifest.capabilityAllowlist) !== (0, canonical_json_1.canonicalJsonString)([{ capabilityRef: "capability:context-read", scopes: [...exports.CONNECTED_CONTEXT_SCOPES] }])
+        || (0, canonical_json_1.canonicalJsonString)(manifest.toolAllowlist) !== (0, canonical_json_1.canonicalJsonString)([{ toolRef: "tool:context-reader", capabilityRef: "capability:context-read", actionKinds: ["read"] }])
+        || (0, canonical_json_1.canonicalJsonString)(manifest.resourceAllowlist) !== (0, canonical_json_1.canonicalJsonString)([{ resourceRef: "resource:you-context", origin: expected.issuer, actionKinds: ["read"] }])
+        || (0, canonical_json_1.canonicalJsonString)(manifest.defaultBudget) !== (0, canonical_json_1.canonicalJsonString)({ maxSteps: 1, maxInputTokens: 1, maxOutputTokens: 1, maxCostUsd: 0.01, maxDurationSeconds: 60 })
+        || !Array.isArray(manifest.mcpProtectedResources) || manifest.mcpProtectedResources.length !== 0)
+        throw new Error("bootstrap_manifest_capability_invalid");
+    const bootstrap = exactObject(manifest.bootstrap, ["contextArtifactRef", "contextDigest", "exchange", "fetchUri"], "bootstrap_manifest_schema_invalid");
+    const exchange = exactObject(bootstrap.exchange, ["audience", "dpopKeyThumbprint", "dpopRequired", "expiresAt", "nonceRef", "scopes"], "bootstrap_manifest_schema_invalid");
+    if (exchange.audience !== exports.CONNECTED_CONTEXT_AUDIENCE || exchange.dpopRequired !== true || exchange.dpopKeyThumbprint !== expected.keyThumbprint || JSON.stringify(exchange.scopes) !== JSON.stringify(exports.CONNECTED_CONTEXT_SCOPES) || isoMs(exchange.expiresAt, "bootstrap_manifest_time_invalid") <= expected.now)
+        throw new Error("bootstrap_exchange_binding_invalid");
+    safeId(exchange.nonceRef, /^nonce:[A-Za-z0-9_-]{16,128}$/, "bootstrap_exchange_binding_invalid");
+    const artifact = manifest.artifacts[0];
+    const artifactUnsigned = without(exactObject(artifact, ["artifactRef", "digest", "kind", "signature", "uri"], "bootstrap_artifact_binding_invalid"), "signature");
+    if (artifact.kind !== "youstack" || artifact.artifactRef !== bootstrap.contextArtifactRef || artifact.digest !== bootstrap.contextDigest || !DIGEST.test(String(artifact.digest)) || artifact.uri !== bootstrap.fetchUri || artifact.uri !== `${expected.issuer}/api/v1/agent-access/bootstrap/artifacts/${artifact.artifactRef}`)
+        throw new Error("bootstrap_artifact_binding_invalid");
+    const rollback = exactObject(manifest.rollback, ["minimumAcceptedGeneration", "previousManifestHash", "rollbackAuthorized"], "bootstrap_rollback_invalid");
+    if (rollback.minimumAcceptedGeneration !== generation || rollback.rollbackAuthorized !== false || (rollback.previousManifestHash !== null && !DIGEST.test(String(rollback.previousManifestHash))))
+        throw new Error("bootstrap_rollback_invalid");
+    const governance = exactObject(manifest.keyGovernance, ["activeKeyIds", "allowedAlgorithms", "issuer", "keySetUri", "rotationMaxAgeDays"], "bootstrap_key_governance_invalid");
+    if (governance.issuer !== expected.issuer || governance.keySetUri !== `${expected.issuer}/api/v1/agent-access/bootstrap/jwks` || JSON.stringify(governance.allowedAlgorithms) !== '["ed25519"]' || !Array.isArray(governance.activeKeyIds) || governance.activeKeyIds.length < 1)
+        throw new Error("bootstrap_key_governance_invalid");
+    const signature = manifest.signature;
+    const keyId = safeId(signature?.keyId, /^key:[A-Za-z0-9._-]{3,128}$/, "bootstrap_signature_invalid");
+    if (!governance.activeKeyIds.includes(keyId))
+        throw new Error("bootstrap_signature_invalid");
+    verifySignature(artifactUnsigned, artifact.signature, jwk, keyId, "bootstrap_artifact_signature_invalid");
+    verifySignature(without(manifest, "signature"), manifest.signature, jwk, keyId, "bootstrap_manifest_signature_invalid");
+    if (manifestDigest !== hashBytes((0, canonical_json_1.canonicalJsonString)(manifest)))
+        throw new Error("bootstrap_manifest_digest_invalid");
+    return { manifest, artifact, bootstrap, generation };
+}
+function verifyDpopResult(proof, expected) {
+    if ((0, canonical_json_1.canonicalJsonString)(proof.publicJwk) !== (0, canonical_json_1.canonicalJsonString)(expected.jwk) || proof.keyThumbprint !== expected.thumbprint || thumbprint(proof.publicJwk) !== expected.thumbprint)
+        throw new Error("bootstrap_dpop_key_mismatch");
+    const parts = proof.dpopProof.split(".");
+    if (parts.length !== 3)
+        throw new Error("bootstrap_dpop_invalid");
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+        payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    }
+    catch {
+        throw new Error("bootstrap_dpop_invalid");
+    }
+    if (header.typ !== "dpop+jwt" || header.alg !== "EdDSA" || (0, canonical_json_1.canonicalJsonString)(header.jwk) !== (0, canonical_json_1.canonicalJsonString)(expected.jwk))
+        throw new Error("bootstrap_dpop_invalid");
+    const allowed = new Set(["htu", "htm", "iat", "jti", ...(expected.nonce ? ["nonce"] : []), ...(expected.ath ? ["ath"] : [])]);
+    if (Object.keys(payload).some((key) => !allowed.has(key)) || payload.htu !== expected.htu || payload.htm !== expected.htm || payload.iat !== proof.iat || payload.jti !== proof.jti || (expected.nonce ? payload.nonce !== expected.nonce : "nonce" in payload) || (expected.ath ? payload.ath !== expected.ath : "ath" in payload) || typeof proof.iat !== "number" || Math.abs(expected.now - proof.iat * 1000) > 60000 || typeof proof.jti !== "string" || proof.jti.length < 16)
+        throw new Error("bootstrap_dpop_claims_invalid");
+    let key;
+    try {
+        key = crypto.createPublicKey({ key: expected.jwk, format: "jwk" });
+    }
+    catch {
+        throw new Error("bootstrap_dpop_invalid");
+    }
+    if (!crypto.verify(null, Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], "base64url")))
+        throw new Error("bootstrap_dpop_signature_invalid");
+}
+function connectedRoot(homedir = os.homedir) { return path.join(homedir(), ".you", "connected-access"); }
+function secureDirectory(dir) { const stat = fs.lstatSync(dir); if (!stat.isDirectory() || stat.isSymbolicLink() || (typeof process.getuid === "function" && stat.uid !== process.getuid()))
+    throw new Error("connected_context_store_unsafe"); fs.chmodSync(dir, 0o700); }
+function secureRegularFile(file) { const stat = fs.lstatSync(file); if (!stat.isFile() || stat.isSymbolicLink() || (typeof process.getuid === "function" && stat.uid !== process.getuid()) || (stat.mode & 0o077) !== 0)
+    throw new Error("connected_context_store_unsafe"); }
+function ensureRoot(root) { fs.mkdirSync(path.join(root, "snapshots"), { recursive: true, mode: 0o700 }); secureDirectory(root); secureDirectory(path.join(root, "snapshots")); }
+function atomicJson(file, value, random) { const temp = `${file}.tmp-${random(8).toString("hex")}`; fs.writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 }); fs.chmodSync(temp, 0o600); fs.renameSync(temp, file); }
+function readJson(file) { secureRegularFile(file); return JSON.parse(fs.readFileSync(file, "utf8")); }
+function optionalJson(file) { try {
+    return readJson(file);
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return null;
+    throw error;
+} }
+function floorAt(root) { const value = optionalJson(path.join(root, "rollback-floor.json")); if (value === null)
+    return 0; const row = exactObject(value, ["minimumAcceptedGeneration"], "connected_context_floor_invalid"); if (!Number.isInteger(row.minimumAcceptedGeneration) || Number(row.minimumAcceptedGeneration) < 1)
+    throw new Error("connected_context_floor_invalid"); return Number(row.minimumAcceptedGeneration); }
+function markerAt(root) { const value = optionalJson(path.join(root, "revoked.json")); if (value === null)
+    return null; const row = value && typeof value === "object" && !Array.isArray(value) ? value : undefined; const keys = row ? Object.keys(row).sort().join(",") : ""; if (!row || (keys !== "applicationRevoked,keyRevoked,manifestId,revokedAt" && keys !== "applicationRevoked,keyRevoked,manifestId,reason,revokedAt") || typeof row.manifestId !== "string" || !/^manifest:[a-z0-9][a-z0-9_-]{7,127}$/.test(row.manifestId) || typeof row.revokedAt !== "string" || !Number.isFinite(Date.parse(row.revokedAt)) || typeof row.applicationRevoked !== "boolean" || typeof row.keyRevoked !== "boolean" || ("reason" in row && row.reason !== "remote_manifest_not_active"))
+    throw new Error("connected_context_revocation_invalid"); return row; }
+function priorAccepted(root) {
+    const pointer = optionalJson(path.join(root, "current.json"));
+    if (pointer === null)
+        return null;
+    const row = exactObject(pointer, ["snapshot"], "connected_context_pointer_invalid");
+    if (typeof row.snapshot !== "string" || !/^[1-9][0-9]*-[a-f0-9]{16}$/.test(row.snapshot))
+        throw new Error("connected_context_pointer_invalid");
+    const metadata = readJson(path.join(root, "snapshots", row.snapshot, "manifest.json"));
+    if (!Number.isInteger(metadata.generation) || !DIGEST.test(metadata.manifestDigest))
+        throw new Error("connected_context_metadata_invalid");
+    return { generation: metadata.generation, manifestDigest: metadata.manifestDigest };
+}
+function hasAnyLocalTrustState(root) {
+    for (const name of ["rollback-floor.json", "current.json", "revoked.json"]) {
+        try {
+            fs.lstatSync(path.join(root, name));
+            return true;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    try {
+        return fs.readdirSync(path.join(root, "snapshots")).length > 0;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function loadSnapshotUnchecked(dir, floor, clock) {
+    secureDirectory(dir);
+    secureRegularFile(path.join(dir, "manifest.json"));
+    secureRegularFile(path.join(dir, "context.md"));
+    const metadata = readJson(path.join(dir, "manifest.json"));
+    if (!metadata || metadata.schemaVersion !== "you-md/connected-context-snapshot/v1" || metadata.secretValuesExposed !== false || !Number.isInteger(metadata.generation) || metadata.generation < floor || !DIGEST.test(metadata.artifactDigest) || !DIGEST.test(metadata.manifestDigest) || metadata.applicationId !== exports.CONNECTED_CONTEXT_APPLICATION_ID || !/^dak_[A-Za-z0-9]{32}$/.test(metadata.keyId))
+        throw new Error("connected_context_metadata_invalid");
+    const bytes = fs.readFileSync(path.join(dir, "context.md"));
+    if (hashBytes(bytes) !== metadata.artifactDigest || bytes.length > 512 * 1024)
+        throw new Error("connected_context_digest_invalid");
+    const context = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    if (SECRET_CANARY.test(context))
+        throw new Error("connected_context_forbidden_material");
+    const raw = metadata.issuerKey;
+    const issuerJwk = exactJwk({ kty: raw.kty, crv: raw.crv, x: raw.x });
+    const deviceJwk = exactJwk(metadata.devicePublicJwk);
+    const verified = verifyManifest(metadata.manifest, metadata.manifestDigest, issuerJwk, { issuer: PROD_ISSUER, deviceId: metadata.deviceId, keyThumbprint: thumbprint(deviceJwk), now: clock, floor });
+    if (verified.generation !== metadata.generation || verified.manifest.expiresAt !== metadata.expiresAt || verified.artifact.digest !== metadata.artifactDigest)
+        throw new Error("connected_context_metadata_invalid");
+    return { metadata, context };
+}
+function loadCurrent(root, clock) {
+    try {
+        secureDirectory(root);
+        secureDirectory(path.join(root, "snapshots"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw new Error("connected_context_missing");
+        throw error;
+    }
+    const floor = floorAt(root);
+    let selected;
+    try {
+        const pointer = readJson(path.join(root, "current.json"));
+        if (typeof pointer.snapshot === "string" && /^[1-9][0-9]*-[a-f0-9]{16}$/.test(pointer.snapshot))
+            selected = pointer.snapshot;
+    }
+    catch { /* recover below */ }
+    const candidates = [selected, ...(() => { try {
+            return fs.readdirSync(path.join(root, "snapshots")).filter((name) => /^[1-9][0-9]*-[a-f0-9]{16}$/.test(name)).sort((a, b) => Number(b.split("-")[0]) - Number(a.split("-")[0]));
+        }
+        catch {
+            return [];
+        } })()].filter((value, index, all) => Boolean(value) && all.indexOf(value) === index);
+    let sawExpired = false;
+    for (const name of candidates) {
+        try {
+            const loaded = loadSnapshotUnchecked(path.join(root, "snapshots", name), floor, clock);
+            if (isoMs(loaded.metadata.expiresAt, "connected_context_expired") <= clock) {
+                sawExpired = true;
+                continue;
+            }
+            const recovered = name !== selected;
+            if (recovered)
+                atomicJson(path.join(root, "current.json"), { snapshot: name }, crypto.randomBytes);
+            return { ...loaded, recovered };
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes("expired"))
+                sawExpired = true;
+        }
+    }
+    throw new Error(sawExpired ? "connected_context_expired" : candidates.length ? "connected_context_invalid" : "connected_context_missing");
+}
+function persistSnapshot(root, metadata, context, random) {
+    ensureRoot(root);
+    const name = `${metadata.generation}-${metadata.manifestDigest.slice(7, 23)}`;
+    const finalDir = path.join(root, "snapshots", name);
+    const tempDir = path.join(root, "snapshots", `.tmp-${random(8).toString("hex")}`);
+    fs.mkdirSync(tempDir, { mode: 0o700 });
+    fs.writeFileSync(path.join(tempDir, "manifest.json"), `${JSON.stringify(metadata, null, 2)}\n`, { mode: 0o600 });
+    fs.writeFileSync(path.join(tempDir, "context.md"), context, { mode: 0o600 });
+    fs.chmodSync(tempDir, 0o700);
+    if (!fs.existsSync(finalDir))
+        fs.renameSync(tempDir, finalDir);
+    else
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    atomicJson(path.join(root, "rollback-floor.json"), { minimumAcceptedGeneration: metadata.generation }, random);
+    atomicJson(path.join(root, "current.json"), { snapshot: name }, random);
+    try {
+        const marker = markerAt(root);
+        if (marker?.manifestId !== metadata.manifest.manifestId)
+            fs.unlinkSync(path.join(root, "revoked.json"));
+    }
+    catch { /* marker absent */ }
+}
+async function requestJson(deps, url, init, owner = false) {
+    const headers = { Accept: "application/json", ...(init.body ? { "Content-Type": "application/json" } : {}) };
+    if (owner) {
+        const token = deps.authToken();
+        if (!token)
+            throw new Error("authentication_required");
+        headers.Authorization = `Bearer ${token}`;
+    }
+    const response = await deps.fetch(url, { ...init, headers: { ...headers, ...init.headers }, redirect: "error" });
+    let data = {};
+    try {
+        data = await response.json();
+    }
+    catch { /* handled by status */ }
+    if (!response.ok)
+        throw new Error(`connected_context_http_${response.status}`);
+    return { response, data };
+}
+async function bootstrapConnectedContext(deps, options = {}) {
+    if (!deps.authToken())
+        throw new Error("authentication_required");
+    if (options.trustCurrentGeneration !== undefined && options.trustCurrentGeneration !== true)
+        throw new Error("bootstrap_trust_option_invalid");
+    const issuer = deps.apiUrl().replace(/\/$/, "");
+    if (issuer !== PROD_ISSUER)
+        throw new Error("bootstrap_issuer_not_allowed");
+    const clock = now(deps);
+    const root = connectedRoot(deps.homedir);
+    const hadLocalTrustState = hasAnyLocalTrustState(root);
+    const floor = floorAt(root);
+    const prior = priorAccepted(root);
+    const deviceId = `device:${(deps.machineKey ?? machine_identity_1.getPhysicalMachineKey)()}`;
+    if (!/^device:[A-Za-z0-9._-]{8,120}$/.test(deviceId))
+        throw new Error("invalid_local_machine_identity");
+    const key = await deps.native.keyInfo?.() ?? await deps.native.ensureKey();
+    const jwk = exactJwk(key.publicJwk);
+    if (key.keyThumbprint !== thumbprint(jwk))
+        throw new Error("bootstrap_key_thumbprint_mismatch");
+    const enrolled = (await requestJson(deps, `${issuer}/api/v1/me/agent-access/device-keys/enroll`, { method: "POST", body: JSON.stringify({ deviceId, publicJwk: (0, canonical_json_1.canonicalJsonString)(jwk) }) }, true)).data.deviceKey;
+    const keyId = safeId(enrolled?.keyId, /^dak_[A-Za-z0-9]{32}$/, "bootstrap_key_enroll_invalid");
+    if (enrolled.keyThumbprint !== key.keyThumbprint || !Number.isInteger(enrolled.generation) || Number(enrolled.generation) < 1 || enrolled.status !== "active")
+        throw new Error("bootstrap_key_enroll_invalid");
+    const app = (await requestJson(deps, `${issuer}/api/v1/me/agent-access/applications/register`, { method: "POST", body: JSON.stringify({ applicationId: exports.CONNECTED_CONTEXT_APPLICATION_ID, runtime: "native_helper", runtimeBinding: exports.CONNECTED_CONTEXT_RUNTIME_BINDING, allowedOrigins: ["https://www.you.md"] }) }, true)).data.application;
+    if (app?.applicationId !== exports.CONNECTED_CONTEXT_APPLICATION_ID || app.runtimeBinding !== exports.CONNECTED_CONTEXT_RUNTIME_BINDING || !Number.isInteger(app.generation) || app.status !== "active")
+        throw new Error("bootstrap_application_register_invalid");
+    const prepared = (await requestJson(deps, `${issuer}/api/v1/me/agent-access/bootstrap/prepare`, { method: "POST", body: JSON.stringify({ deviceId, keyId, applicationId: exports.CONNECTED_CONTEXT_APPLICATION_ID, audience: exports.CONNECTED_CONTEXT_AUDIENCE, requestedScopes: [...exports.CONNECTED_CONTEXT_SCOPES] }) }, true)).data;
+    const rawManifest = validateManifestShape(prepared.manifest);
+    const rawSignature = rawManifest.signature;
+    const signingKeyId = safeId(rawSignature.keyId, /^key:[A-Za-z0-9._-]{3,128}$/, "bootstrap_signature_invalid");
+    const jwks = (await requestJson(deps, `${issuer}/api/v1/agent-access/bootstrap/jwks`, { method: "GET" })).data;
+    const issuerKey = parseJwks(jwks, signingKeyId);
+    const verified = verifyManifest(rawManifest, prepared.manifestDigest, issuerKey, { issuer, deviceId, keyThumbprint: key.keyThumbprint, now: clock, floor });
+    const rollback = verified.manifest.rollback;
+    const proposedDigest = String(prepared.manifestDigest);
+    if (prior) {
+        if (verified.generation < prior.generation)
+            throw new Error("bootstrap_manifest_rollback");
+        if (verified.generation === prior.generation && proposedDigest !== prior.manifestDigest)
+            throw new Error("bootstrap_manifest_generation_collision");
+        if (verified.generation > prior.generation + 1)
+            throw new Error("bootstrap_manifest_chain_gap");
+        if (verified.generation === prior.generation + 1 && rollback.previousManifestHash !== prior.manifestDigest)
+            throw new Error("bootstrap_manifest_chain_discontinuous");
+    }
+    else if (verified.generation !== 1 || rollback.previousManifestHash !== null) {
+        if (!options.trustCurrentGeneration)
+            throw new Error("bootstrap_manifest_trust_reset_required");
+        if (hadLocalTrustState)
+            throw new Error("bootstrap_manifest_trust_reset_denied");
+        const listed = (await requestJson(deps, `${issuer}/api/v1/me/agent-access/bootstrap/manifests`, { method: "GET" }, true)).data.manifests;
+        const exact = Array.isArray(listed) ? listed.find((entry) => entry && typeof entry === "object" && entry.manifestId === verified.manifest.manifestId) : undefined;
+        if (!exact || exact.generation !== verified.generation || !["active", "consumed"].includes(String(exact.status)) || exact.artifactId !== verified.artifact.artifactRef || exact.audience !== exports.CONNECTED_CONTEXT_AUDIENCE || JSON.stringify(exact.scopes) !== JSON.stringify(exports.CONNECTED_CONTEXT_SCOPES) || Number(exact.expiresAt) <= now(deps))
+            throw new Error("bootstrap_manifest_trust_reset_denied");
+    }
+    const exchange = verified.bootstrap.exchange;
+    const nonce = String(exchange.nonceRef);
+    const tokenHtu = `${issuer}/api/v1/agent-access/bootstrap/token`;
+    const exchangeProof = await deps.native.signExchange({ nonce });
+    verifyDpopResult(exchangeProof, { jwk, thumbprint: key.keyThumbprint, htu: tokenHtu, htm: "POST", nonce, now: now(deps) });
+    const tokenData = (await requestJson(deps, tokenHtu, { method: "POST", body: JSON.stringify({ nonce }), headers: { DPoP: exchangeProof.dpopProof } })).data;
+    const accessToken = typeof tokenData.access_token === "string" && /^dpop_[A-Za-z0-9_-]{32,256}$/.test(tokenData.access_token) ? tokenData.access_token : undefined;
+    if (!accessToken || tokenData.token_type !== "DPoP" || tokenData.scope !== exports.CONNECTED_CONTEXT_SCOPES[0] || tokenData.cnf?.jkt !== key.keyThumbprint)
+        throw new Error("bootstrap_token_response_invalid");
+    const artifactId = String(verified.artifact.artifactRef);
+    const fetchUri = String(verified.bootstrap.fetchUri);
+    const ath = b64urlHash(accessToken);
+    const artifactProof = await deps.native.signArtifact({ artifactId, accessTokenDigest: ath });
+    verifyDpopResult(artifactProof, { jwk, thumbprint: key.keyThumbprint, htu: fetchUri, htm: "GET", ath, now: now(deps) });
+    const artifactResponse = await deps.fetch(fetchUri, { method: "GET", headers: { Accept: "text/markdown", Authorization: `DPoP ${accessToken}`, DPoP: artifactProof.dpopProof }, redirect: "error" });
+    if (!artifactResponse.ok)
+        throw new Error(`connected_context_http_${artifactResponse.status}`);
+    const bytes = new Uint8Array(await artifactResponse.arrayBuffer());
+    if (bytes.byteLength < 1 || bytes.byteLength > 512 * 1024)
+        throw new Error("bootstrap_artifact_size_invalid");
+    const artifactDigest = hashBytes(bytes);
+    if (artifactDigest !== verified.artifact.digest || artifactDigest !== artifactResponse.headers.get("x-content-digest"))
+        throw new Error("bootstrap_artifact_digest_invalid");
+    let context;
+    try {
+        context = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error("bootstrap_artifact_utf8_invalid");
+    }
+    if (SECRET_CANARY.test(context))
+        throw new Error("bootstrap_artifact_forbidden_material");
+    const metadata = { schemaVersion: "you-md/connected-context-snapshot/v1", storedAt: new Date(now(deps)).toISOString(), manifestDigest: String(prepared.manifestDigest), artifactDigest, issuerKey: { kid: signingKeyId, ...issuerKey, alg: "EdDSA", use: "sig" }, devicePublicJwk: jwk, manifest: verified.manifest, keyId, applicationId: exports.CONNECTED_CONTEXT_APPLICATION_ID, deviceId, generation: verified.generation, expiresAt: String(verified.manifest.expiresAt), secretValuesExposed: false };
+    persistSnapshot(root, metadata, context, deps.randomBytes ?? crypto.randomBytes);
+    return { connected: true, state: "ready", manifestId: String(verified.manifest.manifestId), generation: verified.generation, expiresAt: metadata.expiresAt, artifactDigest, authorityGranted: false, secretValuesExposed: false };
+}
+function getConnectedContextStatus(deps = {}) {
+    const root = connectedRoot(deps.homedir);
+    try {
+        const marker = markerAt(root);
+        const clock = now(deps);
+        const loaded = loadCurrent(root, clock);
+        const manifestId = String(loaded.metadata.manifest.manifestId);
+        if (marker?.manifestId === manifestId)
+            return { connected: false, state: "revoked", manifestId, generation: loaded.metadata.generation, expiresAt: loaded.metadata.expiresAt, authorityGranted: false, secretValuesExposed: false };
+        return { connected: true, state: "ready", manifestId, generation: loaded.metadata.generation, expiresAt: loaded.metadata.expiresAt, artifactDigest: loaded.metadata.artifactDigest, recovered: loaded.recovered || undefined, authorityGranted: false, secretValuesExposed: false };
+    }
+    catch (error) {
+        const code = error instanceof Error ? error.message : "connected_context_invalid";
+        return { connected: false, state: code.includes("missing") ? "missing" : code.includes("expired") ? "expired" : "invalid", authorityGranted: false, secretValuesExposed: false };
+    }
+}
+async function verifyConnectedContext(deps) {
+    const root = connectedRoot(deps.homedir);
+    const loaded = loadCurrent(root, now(deps));
+    const manifest = loaded.metadata.manifest;
+    const signature = manifest.signature;
+    const keyId = String(signature.keyId);
+    const issuerKey = parseJwks((await requestJson(deps, `${PROD_ISSUER}/api/v1/agent-access/bootstrap/jwks`, { method: "GET" })).data, keyId);
+    const storedKey = loaded.metadata.issuerKey;
+    if ((0, canonical_json_1.canonicalJsonString)(issuerKey) !== (0, canonical_json_1.canonicalJsonString)({ kty: storedKey.kty, crv: storedKey.crv, x: storedKey.x }))
+        throw new Error("connected_context_issuer_key_changed");
+    verifySignature(without(manifest, "signature"), manifest.signature, issuerKey, keyId, "connected_context_signature_invalid");
+    const listed = (await requestJson(deps, `${PROD_ISSUER}/api/v1/me/agent-access/bootstrap/manifests`, { method: "GET" }, true)).data.manifests;
+    const exact = Array.isArray(listed) ? listed.find((entry) => entry && typeof entry === "object" && entry.manifestId === manifest.manifestId) : undefined;
+    if (!exact || !["active", "consumed"].includes(String(exact.status)) || exact.generation !== loaded.metadata.generation || exact.artifactId !== manifest.bootstrap.contextArtifactRef || exact.audience !== exports.CONNECTED_CONTEXT_AUDIENCE || JSON.stringify(exact.scopes) !== JSON.stringify(exports.CONNECTED_CONTEXT_SCOPES) || Number(exact.expiresAt) <= now(deps) || exact.dependenciesActive !== true) {
+        ensureRoot(root);
+        atomicJson(path.join(root, "revoked.json"), { manifestId: manifest.manifestId, revokedAt: new Date(now(deps)).toISOString(), reason: "remote_manifest_not_active", applicationRevoked: false, keyRevoked: false }, deps.randomBytes ?? crypto.randomBytes);
+        throw new Error("connected_context_revoked");
+    }
+    return getConnectedContextStatus(deps);
+}
+async function revokeConnectedContext(deps, options = {}) {
+    const root = connectedRoot(deps.homedir);
+    const loaded = loadCurrent(root, now(deps));
+    const manifestId = options.manifestId ?? String(loaded.metadata.manifest.manifestId);
+    if (manifestId !== loaded.metadata.manifest.manifestId)
+        throw new Error("connected_context_manifest_mismatch");
+    const manifestAck = (await requestJson(deps, `${PROD_ISSUER}/api/v1/me/agent-access/bootstrap/manifests/revoke`, { method: "POST", body: JSON.stringify({ manifestId }) }, true)).data;
+    if (manifestAck.manifestId !== manifestId || manifestAck.revoked !== true || manifestAck.authorityGranted !== false || manifestAck.secretValuesExposed !== false)
+        throw new Error("connected_context_revoke_ack_invalid");
+    const random = deps.randomBytes ?? crypto.randomBytes;
+    ensureRoot(root);
+    const marker = { manifestId, revokedAt: new Date(now(deps)).toISOString(), applicationRevoked: false, keyRevoked: false };
+    // The local read path must fail closed as soon as the manifest revoke lands,
+    // even when a separately requested app/key revocation later fails.
+    atomicJson(path.join(root, "revoked.json"), marker, random);
+    if (options.revokeApplication) {
+        const ack = (await requestJson(deps, `${PROD_ISSUER}/api/v1/me/agent-access/applications/revoke`, { method: "POST", body: JSON.stringify({ applicationId: exports.CONNECTED_CONTEXT_APPLICATION_ID }) }, true)).data.application;
+        if (ack?.applicationId !== exports.CONNECTED_CONTEXT_APPLICATION_ID || ack.status !== "revoked")
+            throw new Error("connected_context_revoke_ack_invalid");
+        marker.applicationRevoked = true;
+        atomicJson(path.join(root, "revoked.json"), marker, random);
+    }
+    if (options.revokeKey) {
+        const listed = (await requestJson(deps, `${PROD_ISSUER}/api/v1/me/agent-access/device-keys`, { method: "GET" }, true)).data.deviceKeys;
+        const expectedThumbprint = thumbprint(exactJwk(loaded.metadata.devicePublicJwk));
+        const exact = Array.isArray(listed) ? listed.find((entry) => entry && typeof entry === "object" && entry.keyId === loaded.metadata.keyId) : undefined;
+        if (!exact || exact.deviceId !== loaded.metadata.deviceId || exact.keyThumbprint !== expectedThumbprint || exact.status !== "active")
+            throw new Error("connected_context_key_binding_invalid");
+        const ack = (await requestJson(deps, `${PROD_ISSUER}/api/v1/me/agent-access/device-keys/revoke`, { method: "POST", body: JSON.stringify({ keyId: exact.keyId }) }, true)).data.deviceKey;
+        if (ack?.keyId !== exact.keyId || ack.status !== "revoked")
+            throw new Error("connected_context_revoke_ack_invalid");
+        marker.keyRevoked = true;
+        atomicJson(path.join(root, "revoked.json"), marker, random);
+    }
+    return getConnectedContextStatus(deps);
+}
+function readConnectedContextResource(deps = {}) {
+    const root = connectedRoot(deps.homedir);
+    const loaded = loadCurrent(root, now(deps));
+    if (markerAt(root)?.manifestId === loaded.metadata.manifest.manifestId)
+        throw new Error("connected_context_revoked");
+    return loaded.context;
+}
+async function listConnectedContextMcpResource(deps) {
+    try {
+        await verifyConnectedContext(deps);
+        return { uri: exports.CONNECTED_CONTEXT_RESOURCE_URI, name: "connected-context/current", description: "Locally verified signed owner context. Read-only; every MCP discovery/read rechecks authoritative owner manifest status and fails closed offline.", mimeType: "text/markdown" };
+    }
+    catch {
+        return null;
+    }
+}
+async function readConnectedContextMcpResource(uri, deps) {
+    if (uri !== exports.CONNECTED_CONTEXT_RESOURCE_URI)
+        throw new Error("connected_context_resource_unknown");
+    await verifyConnectedContext(deps);
+    return { contents: [{ uri, mimeType: "text/markdown", text: readConnectedContextResource(deps) }] };
+}
+//# sourceMappingURL=connected-context.js.map