Add packaged DLP broker and protected Windows service foundation

apps/network-broker/wfp-revalidation.cjs

@@ -0,0 +1,32 @@
+'use strict';
+const {validateTopology}=require('./wfp-topology.cjs');
+// Adapter must come from a protected native service authority, never IPC JSON.
+// Periodic reads supplement unreliable BFE notifications. Neither closes the
+// privileged-change packet window; no atomic kernel claim is made here.
+function createWfpRevalidation({readTopology,quarantine,intervalMs=500,deadlineMs=2000}={}){
+ if(typeof readTopology!=='function'||typeof quarantine!=='function'||!Number.isInteger(intervalMs)||intervalMs<100||intervalMs>1000||!Number.isInteger(deadlineMs)||deadlineMs<10||deadlineMs>5000)throw TypeError('Invalid WFP monitor');
+ let state='new',pending=false,timer,timeout;
+ function fail(reason){if(state==='closed'||state==='quarantined')return;state='quarantined';clearInterval(timer);clearTimeout(timeout);quarantine(reason);}
+ async function check(){
+  if(pending||state==='closed'||state==='quarantined')return false;
+  pending=true;
+  timeout=setTimeout(()=>fail('wfp-revalidation-timeout'),deadlineMs);timeout.unref?.();
+  try{
+   const snapshot=await readTopology();
+   if(state==='closed'||state==='quarantined')return false;
+   if(snapshot?.bfeRunning!==true){fail('wfp-bfe-unavailable');return false;}
+   const result=validateTopology(snapshot);
+   if(!result.safe){fail(result.reason);return false;}
+   return true;
+  }catch{fail('wfp-revalidation-unavailable');return false;}
+  finally{pending=false;clearTimeout(timeout);}
+ }
+ return Object.freeze({
+  async start(){if(state!=='new')throw Error('WFP monitor already started');state='starting';if(!await check())return false;if(state!=='starting')return false;state='verified';timer=setInterval(()=>{void check();},intervalMs);timer.unref?.();return true;},
+  changed(){fail('wfp-topology-changed');},
+  current(){return state==='verified';},
+  close(){state='closed';clearInterval(timer);clearTimeout(timeout);},
+  status(){return Object.freeze({state,pending});}
+ });
+}
+module.exports={createWfpRevalidation};