@agimon-ai/doompi-session 0.0.1-alpha.1

package/dist/src/services/peerInboxApi/index.mjs

@@ -0,0 +1,48 @@
+import { createPeerReplayGuard, parseSessionPeerEnvelope, peerSessionReference, readSessionPeerConfig, verifyPeerRequest } from "../peerTransport/index.mjs";
+import { deliverSessionPeerEnvelope } from "../peerInbox/index.mjs";
+//#region src/services/peerInboxApi/index.ts
+const MAX_BODY_BYTES = 65536;
+const DELIVERY_TYPES = /* @__PURE__ */ new Set(["doom/session-delivery/envelope", "doom/session-delivery/ack"]);
+function response(status, error) {
+	return Response.json({ error }, { status });
+}
+/** Narrow HMAC-authenticated endpoint that a trusted tunnel may forward without device authentication. */
+const peerInboxApi = {
+	basePath: "session-peer",
+	start(context) {
+		const config = context.homeDirectory === void 0 ? void 0 : readSessionPeerConfig(context.homeDirectory);
+		const replay = context.homeDirectory === void 0 ? void 0 : createPeerReplayGuard(context.homeDirectory);
+		return {
+			async fetch(request) {
+				if (request.method !== "POST" || new URL(request.url).pathname !== "/inbox") return response(404, "Not found.");
+				if (!config) return response(503, "Paired Session delivery is not configured.");
+				const length = request.headers.get("content-length");
+				if (length !== null && (!/^\d+$/u.test(length) || Number(length) > MAX_BODY_BYTES)) return response(413, "Request body is too large.");
+				const body = await request.text();
+				if (Buffer.byteLength(body) > MAX_BODY_BYTES) return response(413, "Request body is too large.");
+				const peer = verifyPeerRequest(config, request, body);
+				if (!peer) return response(401, "Paired Session request is unauthorized.");
+				if (!replay?.admit(request)) return response(409, "Paired Session request was already received.");
+				let parsed;
+				try {
+					parsed = JSON.parse(body);
+				} catch {
+					return response(400, "Paired Session request is malformed.");
+				}
+				const envelope = parseSessionPeerEnvelope(parsed);
+				if (!envelope || !DELIVERY_TYPES.has(envelope.type)) return response(400, "Paired Session envelope is invalid.");
+				if (!peer.allowedSessionIds.includes(envelope.targetSessionId)) return response(403, "Peer is not granted this session.");
+				const state = deliverSessionPeerEnvelope(envelope.targetSessionId, peerSessionReference(peer.hostId, envelope.sourceSessionId), envelope.type, envelope.payload);
+				return state === void 0 ? response(404, "Target Session is unavailable.") : Response.json({
+					accepted: true,
+					state
+				}, { status: 202 });
+			},
+			close: () => replay?.close()
+		};
+	}
+};
+//#endregion
+export { peerInboxApi };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/peerInboxApi/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/peerInboxApi/index.ts"],"sourcesContent":["import type { DoomApi, DoomApiHandler } from '@agimon-ai/doompi-core/package-api';\n\nimport { deliverSessionPeerEnvelope } from '../peerInbox';\nimport {\n  createPeerReplayGuard,\n  parseSessionPeerEnvelope,\n  peerSessionReference,\n  readSessionPeerConfig,\n  verifyPeerRequest,\n} from '../peerTransport';\n\nconst MAX_BODY_BYTES = 64 * 1024;\nconst DELIVERY_TYPES = new Set(['doom/session-delivery/envelope', 'doom/session-delivery/ack']);\n\nfunction response(status: number, error: string): Response {\n  return Response.json({ error }, { status });\n}\n\n/** Narrow HMAC-authenticated endpoint that a trusted tunnel may forward without device authentication. */\nexport const peerInboxApi: DoomApi = {\n  basePath: 'session-peer',\n  start(context): DoomApiHandler {\n    const config = context.homeDirectory === undefined ? undefined : readSessionPeerConfig(context.homeDirectory);\n    const replay = context.homeDirectory === undefined ? undefined : createPeerReplayGuard(context.homeDirectory);\n    return {\n      async fetch(request) {\n        if (request.method !== 'POST' || new URL(request.url).pathname !== '/inbox') return response(404, 'Not found.');\n        if (!config) return response(503, 'Paired Session delivery is not configured.');\n        const length = request.headers.get('content-length');\n        if (length !== null && (!/^\\d+$/u.test(length) || Number(length) > MAX_BODY_BYTES))\n          return response(413, 'Request body is too large.');\n        const body = await request.text();\n        if (Buffer.byteLength(body) > MAX_BODY_BYTES) return response(413, 'Request body is too large.');\n        const peer = verifyPeerRequest(config, request, body);\n        if (!peer) return response(401, 'Paired Session request is unauthorized.');\n        if (!replay?.admit(request)) return response(409, 'Paired Session request was already received.');\n        let parsed: unknown;\n        try {\n          parsed = JSON.parse(body) as unknown;\n        } catch {\n          return response(400, 'Paired Session request is malformed.');\n        }\n        const envelope = parseSessionPeerEnvelope(parsed);\n        if (!envelope || !DELIVERY_TYPES.has(envelope.type))\n          return response(400, 'Paired Session envelope is invalid.');\n        if (!peer.allowedSessionIds.includes(envelope.targetSessionId))\n          return response(403, 'Peer is not granted this session.');\n        const state = deliverSessionPeerEnvelope(\n          envelope.targetSessionId,\n          peerSessionReference(peer.hostId, envelope.sourceSessionId),\n          envelope.type,\n          envelope.payload,\n        );\n        return state === undefined\n          ? response(404, 'Target Session is unavailable.')\n          : Response.json({ accepted: true, state }, { status: 202 });\n      },\n      close: () => replay?.close(),\n    };\n  },\n};\n"],"mappings":";;;AAWA,MAAM,iBAAiB;AACvB,MAAM,iCAAiB,IAAI,IAAI,CAAC,kCAAkC,2BAA2B,CAAC;AAE9F,SAAS,SAAS,QAAgB,OAAyB;CACzD,OAAO,SAAS,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;AAC5C;;AAGA,MAAa,eAAwB;CACnC,UAAU;CACV,MAAM,SAAyB;EAC7B,MAAM,SAAS,QAAQ,kBAAkB,KAAA,IAAY,KAAA,IAAY,sBAAsB,QAAQ,aAAa;EAC5G,MAAM,SAAS,QAAQ,kBAAkB,KAAA,IAAY,KAAA,IAAY,sBAAsB,QAAQ,aAAa;EAC5G,OAAO;GACL,MAAM,MAAM,SAAS;IACnB,IAAI,QAAQ,WAAW,UAAU,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,UAAU,OAAO,SAAS,KAAK,YAAY;IAC9G,IAAI,CAAC,QAAQ,OAAO,SAAS,KAAK,4CAA4C;IAC9E,MAAM,SAAS,QAAQ,QAAQ,IAAI,gBAAgB;IACnD,IAAI,WAAW,SAAS,CAAC,SAAS,KAAK,MAAM,KAAK,OAAO,MAAM,IAAI,iBACjE,OAAO,SAAS,KAAK,4BAA4B;IACnD,MAAM,OAAO,MAAM,QAAQ,KAAK;IAChC,IAAI,OAAO,WAAW,IAAI,IAAI,gBAAgB,OAAO,SAAS,KAAK,4BAA4B;IAC/F,MAAM,OAAO,kBAAkB,QAAQ,SAAS,IAAI;IACpD,IAAI,CAAC,MAAM,OAAO,SAAS,KAAK,yCAAyC;IACzE,IAAI,CAAC,QAAQ,MAAM,OAAO,GAAG,OAAO,SAAS,KAAK,8CAA8C;IAChG,IAAI;IACJ,IAAI;KACF,SAAS,KAAK,MAAM,IAAI;IAC1B,QAAQ;KACN,OAAO,SAAS,KAAK,sCAAsC;IAC7D;IACA,MAAM,WAAW,yBAAyB,MAAM;IAChD,IAAI,CAAC,YAAY,CAAC,eAAe,IAAI,SAAS,IAAI,GAChD,OAAO,SAAS,KAAK,qCAAqC;IAC5D,IAAI,CAAC,KAAK,kBAAkB,SAAS,SAAS,eAAe,GAC3D,OAAO,SAAS,KAAK,mCAAmC;IAC1D,MAAM,QAAQ,2BACZ,SAAS,iBACT,qBAAqB,KAAK,QAAQ,SAAS,eAAe,GAC1D,SAAS,MACT,SAAS,OACX;IACA,OAAO,UAAU,KAAA,IACb,SAAS,KAAK,gCAAgC,IAC9C,SAAS,KAAK;KAAE,UAAU;KAAM;IAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;GAC9D;GACA,aAAa,QAAQ,MAAM;EAC7B;CACF;AACF"}

package/dist/src/services/peerTransport/index.cjs

@@ -0,0 +1,206 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+let node_crypto = require("node:crypto");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let node_sqlite = require("node:sqlite");
+//#region src/services/peerTransport/index.ts
+const PEER_CONFIG_VERSION = 1;
+const PEER_CONFIG_FILE = "peers.json";
+const PEER_ROUTE = "/api/plugins/session-peer/inbox";
+const PEER_HEADER = "x-doompi-session-peer";
+const TIMESTAMP_HEADER = "x-doompi-session-timestamp";
+const SIGNATURE_HEADER = "x-doompi-session-signature";
+const MAX_CLOCK_SKEW_MS = 3e5;
+const MAX_REPLAY_ENTRIES = 1e4;
+const REPLAY_DATABASE_FILE = "peer-replay.sqlite";
+function validId(value) {
+	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value);
+}
+function peerOf(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	if (!validId(record.hostId) || typeof record.url !== "string" || typeof record.secret !== "string") return void 0;
+	let url;
+	try {
+		url = new URL(record.url);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return void 0;
+	const allowedSessionIds = Array.isArray(record.allowedSessionIds) && record.allowedSessionIds.every(validId) ? record.allowedSessionIds : void 0;
+	const allowedVoiceSessionIds = Array.isArray(record.allowedVoiceSessionIds) && record.allowedVoiceSessionIds.every(validId) ? record.allowedVoiceSessionIds : [];
+	if (allowedSessionIds === void 0 || record.secret.length < 32) return void 0;
+	return {
+		hostId: record.hostId,
+		url: url.toString(),
+		secret: record.secret,
+		allowedSessionIds,
+		allowedVoiceSessionIds
+	};
+}
+function sessionPeerConfigPath(homeDirectory) {
+	return node_path.default.join(homeDirectory, ".pi", ".doom", "session", PEER_CONFIG_FILE);
+}
+/** Reads operator-provisioned peers. Invalid or unreadable config fails closed. */
+function readSessionPeerConfig(homeDirectory) {
+	let parsed;
+	try {
+		const file = sessionPeerConfigPath(homeDirectory);
+		if ((node_fs.default.statSync(file).mode & 63) !== 0) return void 0;
+		parsed = JSON.parse(node_fs.default.readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const record = parsed;
+	if (record.version !== PEER_CONFIG_VERSION || !validId(record.hostId) || !Array.isArray(record.peers)) return void 0;
+	const peers = record.peers.map(peerOf);
+	if (peers.some((peer) => peer === void 0)) return void 0;
+	const resolved = peers;
+	if (new Set(resolved.map((peer) => peer.hostId)).size !== resolved.length || resolved.some((peer) => peer.hostId === record.hostId)) return void 0;
+	return {
+		version: PEER_CONFIG_VERSION,
+		hostId: record.hostId,
+		peers: resolved
+	};
+}
+/** `peer/<host-id>/<session-id>` is the only remote target spelling. */
+function parseRemoteSessionReference(value) {
+	const match = /^peer\/([^/]+)\/([^/]+)$/u.exec(value);
+	return match && validId(match[1]) && validId(match[2]) ? {
+		hostId: match[1],
+		sessionId: match[2]
+	} : void 0;
+}
+function peerSessionReference(hostId, sessionId) {
+	if (!validId(hostId) || !validId(sessionId)) throw new TypeError("Remote host and session identifiers must be safe opaque IDs.");
+	return `peer/${hostId}/${sessionId}`;
+}
+function signature(secret, method, pathname, timestamp, body) {
+	const digest = (0, node_crypto.createHash)("sha256").update(body).digest("base64url");
+	return (0, node_crypto.createHmac)("sha256", secret).update(`${method}\n${pathname}\n${timestamp}\n${digest}`).digest("base64url");
+}
+function peerRequestHeaders(sourceHostId, peer, method, pathname, body, now = Date.now()) {
+	if (!validId(sourceHostId)) throw new TypeError("Source host identity must be a safe opaque ID.");
+	const timestamp = String(now);
+	return new Headers({
+		"content-type": "application/json",
+		[PEER_HEADER]: sourceHostId,
+		[TIMESTAMP_HEADER]: timestamp,
+		[SIGNATURE_HEADER]: signature(peer.secret, method, pathname, timestamp, body)
+	});
+}
+/** Persists accepted peer signatures so a valid request cannot be replayed within its clock-skew window. */
+function createPeerReplayGuard(homeDirectory) {
+	const directory = node_path.default.dirname(sessionPeerConfigPath(homeDirectory));
+	node_fs.default.mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const database = new node_sqlite.DatabaseSync(node_path.default.join(directory, REPLAY_DATABASE_FILE));
+	database.exec(`
+    PRAGMA journal_mode = WAL;
+    CREATE TABLE IF NOT EXISTS peer_request_replays (
+      signature TEXT PRIMARY KEY,
+      expires_at INTEGER NOT NULL
+    );
+  `);
+	const removeExpired = database.prepare("DELETE FROM peer_request_replays WHERE expires_at < ?");
+	const insert = database.prepare("INSERT OR IGNORE INTO peer_request_replays (signature, expires_at) VALUES (?, ?)");
+	const count = database.prepare("SELECT COUNT(*) AS count FROM peer_request_replays");
+	const trim = database.prepare(`
+    DELETE FROM peer_request_replays
+    WHERE signature IN (
+      SELECT signature FROM peer_request_replays ORDER BY expires_at ASC, signature ASC LIMIT ?
+    )
+  `);
+	return {
+		admit(request, now = Date.now()) {
+			const supplied = request.headers.get(SIGNATURE_HEADER);
+			if (!supplied) return false;
+			database.exec("BEGIN IMMEDIATE");
+			try {
+				removeExpired.run(now);
+				const accepted = insert.run(supplied, now + MAX_CLOCK_SKEW_MS).changes === 1;
+				const total = Number(count.get().count);
+				if (total > MAX_REPLAY_ENTRIES) trim.run(total - MAX_REPLAY_ENTRIES);
+				database.exec("COMMIT");
+				return accepted;
+			} catch (cause) {
+				database.exec("ROLLBACK");
+				throw cause;
+			}
+		},
+		close: () => database.close()
+	};
+}
+function verifyPeerRequest(config, request, body, now = Date.now()) {
+	const hostId = request.headers.get(PEER_HEADER);
+	const timestamp = request.headers.get(TIMESTAMP_HEADER);
+	const supplied = request.headers.get(SIGNATURE_HEADER);
+	if (!hostId || !timestamp || !supplied || !/^\d{1,16}$/u.test(timestamp)) return void 0;
+	const sentAt = Number(timestamp);
+	if (!Number.isSafeInteger(sentAt) || Math.abs(now - sentAt) > MAX_CLOCK_SKEW_MS) return void 0;
+	const peer = config.peers.find((candidate) => candidate.hostId === hostId);
+	if (!peer) return void 0;
+	const expected = Buffer.from(signature(peer.secret, request.method, new URL(request.url).pathname, timestamp, body));
+	const actual = Buffer.from(supplied);
+	return actual.byteLength === expected.byteLength && (0, node_crypto.timingSafeEqual)(actual, expected) ? peer : void 0;
+}
+function envelopeOf(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	return validId(record.sourceSessionId) && validId(record.targetSessionId) && typeof record.type === "string" && record.type !== "" ? {
+		sourceSessionId: record.sourceSessionId,
+		targetSessionId: record.targetSessionId,
+		type: record.type,
+		payload: record.payload
+	} : void 0;
+}
+function parseSessionPeerEnvelope(value) {
+	return envelopeOf(value);
+}
+/** Adds asynchronous tunnel publication to a host-bound local communication endpoint. */
+function createPeerCommunication(options) {
+	const config = readSessionPeerConfig(options.homeDirectory);
+	const send = options.fetch ?? fetch;
+	return {
+		sessionId: options.local.sessionId,
+		publish(target, type, payload) {
+			const remote = parseRemoteSessionReference(target);
+			if (!remote) return options.local.publish(target, type, payload);
+			const peer = config?.peers.find((candidate) => candidate.hostId === remote.hostId);
+			if (!config || !peer || !peer.allowedSessionIds.includes(remote.sessionId)) return false;
+			const body = JSON.stringify({
+				sourceSessionId: options.local.sessionId,
+				targetSessionId: remote.sessionId,
+				type,
+				payload
+			});
+			const url = new URL(PEER_ROUTE, peer.url);
+			send(url, {
+				method: "POST",
+				headers: peerRequestHeaders(config.hostId, peer, "POST", "/inbox", body),
+				body
+			}).catch(() => void 0);
+			return true;
+		},
+		subscribe: (type, listener) => options.local.subscribe(type, listener),
+		onPeerReady: (listener) => options.local.onPeerReady(listener),
+		close: () => options.local.close()
+	};
+}
+//#endregion
+exports.createPeerCommunication = createPeerCommunication;
+exports.createPeerReplayGuard = createPeerReplayGuard;
+exports.parseRemoteSessionReference = parseRemoteSessionReference;
+exports.parseSessionPeerEnvelope = parseSessionPeerEnvelope;
+exports.peerRequestHeaders = peerRequestHeaders;
+exports.peerSessionReference = peerSessionReference;
+exports.readSessionPeerConfig = readSessionPeerConfig;
+exports.sessionPeerConfigPath = sessionPeerConfigPath;
+exports.verifyPeerRequest = verifyPeerRequest;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/peerTransport/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["path","fs","createHash","createHmac","DatabaseSync","timingSafeEqual"],"sources":["../../../../src/services/peerTransport/index.ts"],"sourcesContent":["import { createHash, createHmac, timingSafeEqual } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { DatabaseSync } from 'node:sqlite';\n\nimport type { DoomSessionCommunicationEndpoint } from '@agimon-ai/doompi-core/hub-channel';\n\nconst PEER_CONFIG_VERSION = 1;\nconst PEER_CONFIG_FILE = 'peers.json';\nconst PEER_ROUTE = '/api/plugins/session-peer/inbox';\nconst PEER_HEADER = 'x-doompi-session-peer';\nconst TIMESTAMP_HEADER = 'x-doompi-session-timestamp';\nconst SIGNATURE_HEADER = 'x-doompi-session-signature';\nconst MAX_CLOCK_SKEW_MS = 5 * 60_000;\nconst MAX_REPLAY_ENTRIES = 10_000;\nconst REPLAY_DATABASE_FILE = 'peer-replay.sqlite';\n\nexport interface SessionPeer {\n  readonly hostId: string;\n  readonly url: string;\n  readonly secret: string;\n  /** Explicit remote durable-message targets. Empty means no delivery grant. */\n  readonly allowedSessionIds: readonly string[];\n  /** Explicit remote Voice media targets. Empty means no media grant. */\n  readonly allowedVoiceSessionIds: readonly string[];\n}\n\nexport interface SessionPeerConfig {\n  readonly version: typeof PEER_CONFIG_VERSION;\n  readonly hostId: string;\n  readonly peers: readonly SessionPeer[];\n}\n\nexport interface RemoteSessionReference {\n  readonly hostId: string;\n  readonly sessionId: string;\n}\n\nexport interface SessionPeerEnvelope {\n  readonly sourceSessionId: string;\n  readonly targetSessionId: string;\n  readonly type: string;\n  readonly payload: unknown;\n}\n\nexport interface SessionPeerReplayGuard {\n  admit(request: Request, now?: number): boolean;\n  close(): void;\n}\n\nfunction validId(value: unknown): value is string {\n  return typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value);\n}\n\nfunction peerOf(value: unknown): SessionPeer | undefined {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  if (!validId(record.hostId) || typeof record.url !== 'string' || typeof record.secret !== 'string') return undefined;\n  let url: URL;\n  try {\n    url = new URL(record.url);\n  } catch {\n    return undefined;\n  }\n  if (url.protocol !== 'https:' || url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '')\n    return undefined;\n  const allowedSessionIds =\n    Array.isArray(record.allowedSessionIds) && record.allowedSessionIds.every(validId)\n      ? record.allowedSessionIds\n      : undefined;\n  const allowedVoiceSessionIds =\n    Array.isArray(record.allowedVoiceSessionIds) && record.allowedVoiceSessionIds.every(validId)\n      ? record.allowedVoiceSessionIds\n      : [];\n  if (allowedSessionIds === undefined || record.secret.length < 32) return undefined;\n  return {\n    hostId: record.hostId,\n    url: url.toString(),\n    secret: record.secret,\n    allowedSessionIds,\n    allowedVoiceSessionIds,\n  };\n}\n\nexport function sessionPeerConfigPath(homeDirectory: string): string {\n  return path.join(homeDirectory, '.pi', '.doom', 'session', PEER_CONFIG_FILE);\n}\n\n/** Reads operator-provisioned peers. Invalid or unreadable config fails closed. */\nexport function readSessionPeerConfig(homeDirectory: string): SessionPeerConfig | undefined {\n  let parsed: unknown;\n  try {\n    const file = sessionPeerConfigPath(homeDirectory);\n    if ((fs.statSync(file).mode & 0o077) !== 0) return undefined;\n    parsed = JSON.parse(fs.readFileSync(file, 'utf8')) as unknown;\n  } catch {\n    return undefined;\n  }\n  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return undefined;\n  const record = parsed as Record<string, unknown>;\n  if (record.version !== PEER_CONFIG_VERSION || !validId(record.hostId) || !Array.isArray(record.peers))\n    return undefined;\n  const peers = record.peers.map(peerOf);\n  if (peers.some((peer) => peer === undefined)) return undefined;\n  const resolved = peers as SessionPeer[];\n  if (\n    new Set(resolved.map((peer) => peer.hostId)).size !== resolved.length ||\n    resolved.some((peer) => peer.hostId === record.hostId)\n  )\n    return undefined;\n  return { version: PEER_CONFIG_VERSION, hostId: record.hostId, peers: resolved };\n}\n\n/** `peer/<host-id>/<session-id>` is the only remote target spelling. */\nexport function parseRemoteSessionReference(value: string): RemoteSessionReference | undefined {\n  const match = /^peer\\/([^/]+)\\/([^/]+)$/u.exec(value);\n  return match && validId(match[1]) && validId(match[2]) ? { hostId: match[1], sessionId: match[2] } : undefined;\n}\n\nexport function peerSessionReference(hostId: string, sessionId: string): string {\n  if (!validId(hostId) || !validId(sessionId))\n    throw new TypeError('Remote host and session identifiers must be safe opaque IDs.');\n  return `peer/${hostId}/${sessionId}`;\n}\n\nfunction signature(secret: string, method: string, pathname: string, timestamp: string, body: string): string {\n  const digest = createHash('sha256').update(body).digest('base64url');\n  return createHmac('sha256', secret).update(`${method}\\n${pathname}\\n${timestamp}\\n${digest}`).digest('base64url');\n}\n\nexport function peerRequestHeaders(\n  sourceHostId: string,\n  peer: SessionPeer,\n  method: string,\n  pathname: string,\n  body: string,\n  now = Date.now(),\n): Headers {\n  if (!validId(sourceHostId)) throw new TypeError('Source host identity must be a safe opaque ID.');\n  const timestamp = String(now);\n  return new Headers({\n    'content-type': 'application/json',\n    [PEER_HEADER]: sourceHostId,\n    [TIMESTAMP_HEADER]: timestamp,\n    [SIGNATURE_HEADER]: signature(peer.secret, method, pathname, timestamp, body),\n  });\n}\n\n/** Persists accepted peer signatures so a valid request cannot be replayed within its clock-skew window. */\nexport function createPeerReplayGuard(homeDirectory: string): SessionPeerReplayGuard {\n  const directory = path.dirname(sessionPeerConfigPath(homeDirectory));\n  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });\n  const database = new DatabaseSync(path.join(directory, REPLAY_DATABASE_FILE));\n  database.exec(`\n    PRAGMA journal_mode = WAL;\n    CREATE TABLE IF NOT EXISTS peer_request_replays (\n      signature TEXT PRIMARY KEY,\n      expires_at INTEGER NOT NULL\n    );\n  `);\n  const removeExpired = database.prepare('DELETE FROM peer_request_replays WHERE expires_at < ?');\n  const insert = database.prepare('INSERT OR IGNORE INTO peer_request_replays (signature, expires_at) VALUES (?, ?)');\n  const count = database.prepare('SELECT COUNT(*) AS count FROM peer_request_replays');\n  const trim = database.prepare(`\n    DELETE FROM peer_request_replays\n    WHERE signature IN (\n      SELECT signature FROM peer_request_replays ORDER BY expires_at ASC, signature ASC LIMIT ?\n    )\n  `);\n  return {\n    admit(request, now = Date.now()) {\n      const supplied = request.headers.get(SIGNATURE_HEADER);\n      if (!supplied) return false;\n      database.exec('BEGIN IMMEDIATE');\n      try {\n        removeExpired.run(now);\n        const accepted = insert.run(supplied, now + MAX_CLOCK_SKEW_MS).changes === 1;\n        const total = Number((count.get() as { count: number | bigint }).count);\n        if (total > MAX_REPLAY_ENTRIES) trim.run(total - MAX_REPLAY_ENTRIES);\n        database.exec('COMMIT');\n        return accepted;\n      } catch (cause) {\n        database.exec('ROLLBACK');\n        throw cause;\n      }\n    },\n    close: () => database.close(),\n  };\n}\n\nexport function verifyPeerRequest(\n  config: SessionPeerConfig,\n  request: Request,\n  body: string,\n  now = Date.now(),\n): SessionPeer | undefined {\n  const hostId = request.headers.get(PEER_HEADER);\n  const timestamp = request.headers.get(TIMESTAMP_HEADER);\n  const supplied = request.headers.get(SIGNATURE_HEADER);\n  if (!hostId || !timestamp || !supplied || !/^\\d{1,16}$/u.test(timestamp)) return undefined;\n  const sentAt = Number(timestamp);\n  if (!Number.isSafeInteger(sentAt) || Math.abs(now - sentAt) > MAX_CLOCK_SKEW_MS) return undefined;\n  const peer = config.peers.find((candidate) => candidate.hostId === hostId);\n  if (!peer) return undefined;\n  const expected = Buffer.from(signature(peer.secret, request.method, new URL(request.url).pathname, timestamp, body));\n  const actual = Buffer.from(supplied);\n  return actual.byteLength === expected.byteLength && timingSafeEqual(actual, expected) ? peer : undefined;\n}\n\nfunction envelopeOf(value: unknown): SessionPeerEnvelope | undefined {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  return validId(record.sourceSessionId) &&\n    validId(record.targetSessionId) &&\n    typeof record.type === 'string' &&\n    record.type !== ''\n    ? {\n        sourceSessionId: record.sourceSessionId,\n        targetSessionId: record.targetSessionId,\n        type: record.type,\n        payload: record.payload,\n      }\n    : undefined;\n}\n\nexport function parseSessionPeerEnvelope(value: unknown): SessionPeerEnvelope | undefined {\n  return envelopeOf(value);\n}\n\n/** Adds asynchronous tunnel publication to a host-bound local communication endpoint. */\nexport function createPeerCommunication(options: {\n  readonly local: DoomSessionCommunicationEndpoint;\n  readonly homeDirectory: string;\n  readonly fetch?: typeof fetch;\n}): DoomSessionCommunicationEndpoint {\n  const config = readSessionPeerConfig(options.homeDirectory);\n  const send = options.fetch ?? fetch;\n  return {\n    sessionId: options.local.sessionId,\n    publish(target, type, payload) {\n      const remote = parseRemoteSessionReference(target);\n      if (!remote) return options.local.publish(target, type, payload);\n      const peer = config?.peers.find((candidate) => candidate.hostId === remote.hostId);\n      // Pairing is not a grant. Outbound delivery needs the same explicit target\n      // allowlist that the receiver enforces for inbound envelopes.\n      if (!config || !peer || !peer.allowedSessionIds.includes(remote.sessionId)) return false;\n      const body = JSON.stringify({\n        sourceSessionId: options.local.sessionId,\n        targetSessionId: remote.sessionId,\n        type,\n        payload,\n      });\n      const url = new URL(PEER_ROUTE, peer.url);\n      void send(url, {\n        method: 'POST',\n        headers: peerRequestHeaders(config.hostId, peer, 'POST', '/inbox', body),\n        body,\n      }).catch(() => undefined);\n      return true;\n    },\n    subscribe: (type, listener) => options.local.subscribe(type, listener),\n    onPeerReady: (listener) => options.local.onPeerReady(listener),\n    close: () => options.local.close(),\n  };\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,sBAAsB;AAC5B,MAAM,mBAAmB;AACzB,MAAM,aAAa;AACnB,MAAM,cAAc;AACpB,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,uBAAuB;AAmC7B,SAAS,QAAQ,OAAiC;CAChD,OAAO,OAAO,UAAU,YAAY,sCAAsC,KAAK,KAAK;AACtF;AAEA,SAAS,OAAO,OAAyC;CACvD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAChF,MAAM,SAAS;CACf,IAAI,CAAC,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,QAAQ,YAAY,OAAO,OAAO,WAAW,UAAU,OAAO,KAAA;CAC3G,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,OAAO,GAAG;CAC1B,QAAQ;EACN;CACF;CACA,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI,SAAS,IAC/G,OAAO,KAAA;CACT,MAAM,oBACJ,MAAM,QAAQ,OAAO,iBAAiB,KAAK,OAAO,kBAAkB,MAAM,OAAO,IAC7E,OAAO,oBACP,KAAA;CACN,MAAM,yBACJ,MAAM,QAAQ,OAAO,sBAAsB,KAAK,OAAO,uBAAuB,MAAM,OAAO,IACvF,OAAO,yBACP,CAAC;CACP,IAAI,sBAAsB,KAAA,KAAa,OAAO,OAAO,SAAS,IAAI,OAAO,KAAA;CACzE,OAAO;EACL,QAAQ,OAAO;EACf,KAAK,IAAI,SAAS;EAClB,QAAQ,OAAO;EACf;EACA;CACF;AACF;AAEA,SAAgB,sBAAsB,eAA+B;CACnE,OAAOA,UAAAA,QAAK,KAAK,eAAe,OAAO,SAAS,WAAW,gBAAgB;AAC7E;;AAGA,SAAgB,sBAAsB,eAAsD;CAC1F,IAAI;CACJ,IAAI;EACF,MAAM,OAAO,sBAAsB,aAAa;EAChD,KAAKC,QAAAA,QAAG,SAAS,IAAI,CAAC,CAAC,OAAO,QAAW,GAAG,OAAO,KAAA;EACnD,SAAS,KAAK,MAAMA,QAAAA,QAAG,aAAa,MAAM,MAAM,CAAC;CACnD,QAAQ;EACN;CACF;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG,OAAO,KAAA;CACnF,MAAM,SAAS;CACf,IAAI,OAAO,YAAY,uBAAuB,CAAC,QAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,QAAQ,OAAO,KAAK,GAClG,OAAO,KAAA;CACT,MAAM,QAAQ,OAAO,MAAM,IAAI,MAAM;CACrC,IAAI,MAAM,MAAM,SAAS,SAAS,KAAA,CAAS,GAAG,OAAO,KAAA;CACrD,MAAM,WAAW;CACjB,IACE,IAAI,IAAI,SAAS,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,SAAS,UAC/D,SAAS,MAAM,SAAS,KAAK,WAAW,OAAO,MAAM,GAErD,OAAO,KAAA;CACT,OAAO;EAAE,SAAS;EAAqB,QAAQ,OAAO;EAAQ,OAAO;CAAS;AAChF;;AAGA,SAAgB,4BAA4B,OAAmD;CAC7F,MAAM,QAAQ,4BAA4B,KAAK,KAAK;CACpD,OAAO,SAAS,QAAQ,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI;EAAE,QAAQ,MAAM;EAAI,WAAW,MAAM;CAAG,IAAI,KAAA;AACvG;AAEA,SAAgB,qBAAqB,QAAgB,WAA2B;CAC9E,IAAI,CAAC,QAAQ,MAAM,KAAK,CAAC,QAAQ,SAAS,GACxC,MAAM,IAAI,UAAU,8DAA8D;CACpF,OAAO,QAAQ,OAAO,GAAG;AAC3B;AAEA,SAAS,UAAU,QAAgB,QAAgB,UAAkB,WAAmB,MAAsB;CAC5G,MAAM,UAAA,GAASC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;CACnE,QAAA,GAAOC,YAAAA,WAAAA,CAAW,UAAU,MAAM,CAAC,CAAC,OAAO,GAAG,OAAO,IAAI,SAAS,IAAI,UAAU,IAAI,QAAQ,CAAC,CAAC,OAAO,WAAW;AAClH;AAEA,SAAgB,mBACd,cACA,MACA,QACA,UACA,MACA,MAAM,KAAK,IAAI,GACN;CACT,IAAI,CAAC,QAAQ,YAAY,GAAG,MAAM,IAAI,UAAU,gDAAgD;CAChG,MAAM,YAAY,OAAO,GAAG;CAC5B,OAAO,IAAI,QAAQ;EACjB,gBAAgB;GACf,cAAc;GACd,mBAAmB;GACnB,mBAAmB,UAAU,KAAK,QAAQ,QAAQ,UAAU,WAAW,IAAI;CAC9E,CAAC;AACH;;AAGA,SAAgB,sBAAsB,eAA+C;CACnF,MAAM,YAAYH,UAAAA,QAAK,QAAQ,sBAAsB,aAAa,CAAC;CACnE,QAAA,QAAG,UAAU,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACxD,MAAM,WAAW,IAAII,YAAAA,aAAaJ,UAAAA,QAAK,KAAK,WAAW,oBAAoB,CAAC;CAC5E,SAAS,KAAK;;;;;;GAMb;CACD,MAAM,gBAAgB,SAAS,QAAQ,uDAAuD;CAC9F,MAAM,SAAS,SAAS,QAAQ,kFAAkF;CAClH,MAAM,QAAQ,SAAS,QAAQ,oDAAoD;CACnF,MAAM,OAAO,SAAS,QAAQ;;;;;GAK7B;CACD,OAAO;EACL,MAAM,SAAS,MAAM,KAAK,IAAI,GAAG;GAC/B,MAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB;GACrD,IAAI,CAAC,UAAU,OAAO;GACtB,SAAS,KAAK,iBAAiB;GAC/B,IAAI;IACF,cAAc,IAAI,GAAG;IACrB,MAAM,WAAW,OAAO,IAAI,UAAU,MAAM,iBAAiB,CAAC,CAAC,YAAY;IAC3E,MAAM,QAAQ,OAAQ,MAAM,IAAI,CAAC,CAAgC,KAAK;IACtE,IAAI,QAAQ,oBAAoB,KAAK,IAAI,QAAQ,kBAAkB;IACnE,SAAS,KAAK,QAAQ;IACtB,OAAO;GACT,SAAS,OAAO;IACd,SAAS,KAAK,UAAU;IACxB,MAAM;GACR;EACF;EACA,aAAa,SAAS,MAAM;CAC9B;AACF;AAEA,SAAgB,kBACd,QACA,SACA,MACA,MAAM,KAAK,IAAI,GACU;CACzB,MAAM,SAAS,QAAQ,QAAQ,IAAI,WAAW;CAC9C,MAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB;CACtD,MAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB;CACrD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc,KAAK,SAAS,GAAG,OAAO,KAAA;CACjF,MAAM,SAAS,OAAO,SAAS;CAC/B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,IAAI,MAAM,MAAM,IAAI,mBAAmB,OAAO,KAAA;CACxF,MAAM,OAAO,OAAO,MAAM,MAAM,cAAc,UAAU,WAAW,MAAM;CACzE,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,WAAW,OAAO,KAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,UAAU,WAAW,IAAI,CAAC;CACnH,MAAM,SAAS,OAAO,KAAK,QAAQ;CACnC,OAAO,OAAO,eAAe,SAAS,eAAA,GAAcK,YAAAA,gBAAAA,CAAgB,QAAQ,QAAQ,IAAI,OAAO,KAAA;AACjG;AAEA,SAAS,WAAW,OAAiD;CACnE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAChF,MAAM,SAAS;CACf,OAAO,QAAQ,OAAO,eAAe,KACnC,QAAQ,OAAO,eAAe,KAC9B,OAAO,OAAO,SAAS,YACvB,OAAO,SAAS,KACd;EACE,iBAAiB,OAAO;EACxB,iBAAiB,OAAO;EACxB,MAAM,OAAO;EACb,SAAS,OAAO;CAClB,IACA,KAAA;AACN;AAEA,SAAgB,yBAAyB,OAAiD;CACxF,OAAO,WAAW,KAAK;AACzB;;AAGA,SAAgB,wBAAwB,SAIH;CACnC,MAAM,SAAS,sBAAsB,QAAQ,aAAa;CAC1D,MAAM,OAAO,QAAQ,SAAS;CAC9B,OAAO;EACL,WAAW,QAAQ,MAAM;EACzB,QAAQ,QAAQ,MAAM,SAAS;GAC7B,MAAM,SAAS,4BAA4B,MAAM;GACjD,IAAI,CAAC,QAAQ,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM,OAAO;GAC/D,MAAM,OAAO,QAAQ,MAAM,MAAM,cAAc,UAAU,WAAW,OAAO,MAAM;GAGjF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,kBAAkB,SAAS,OAAO,SAAS,GAAG,OAAO;GACnF,MAAM,OAAO,KAAK,UAAU;IAC1B,iBAAiB,QAAQ,MAAM;IAC/B,iBAAiB,OAAO;IACxB;IACA;GACF,CAAC;GACD,MAAM,MAAM,IAAI,IAAI,YAAY,KAAK,GAAG;GACxC,KAAU,KAAK;IACb,QAAQ;IACR,SAAS,mBAAmB,OAAO,QAAQ,MAAM,QAAQ,UAAU,IAAI;IACvE;GACF,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;GACxB,OAAO;EACT;EACA,YAAY,MAAM,aAAa,QAAQ,MAAM,UAAU,MAAM,QAAQ;EACrE,cAAc,aAAa,QAAQ,MAAM,YAAY,QAAQ;EAC7D,aAAa,QAAQ,MAAM,MAAM;CACnC;AACF"}

package/dist/src/services/peerTransport/index.d.cts

@@ -0,0 +1,49 @@
+import { DoomSessionCommunicationEndpoint } from "@agimon-ai/doompi-core/hub-channel";
+//#region src/services/peerTransport/index.d.ts
+declare const PEER_CONFIG_VERSION = 1;
+export interface SessionPeer {
+  readonly hostId: string;
+  readonly url: string;
+  readonly secret: string;
+  /** Explicit remote durable-message targets. Empty means no delivery grant. */
+  readonly allowedSessionIds: readonly string[];
+  /** Explicit remote Voice media targets. Empty means no media grant. */
+  readonly allowedVoiceSessionIds: readonly string[];
+}
+export interface SessionPeerConfig {
+  readonly version: typeof PEER_CONFIG_VERSION;
+  readonly hostId: string;
+  readonly peers: readonly SessionPeer[];
+}
+export interface RemoteSessionReference {
+  readonly hostId: string;
+  readonly sessionId: string;
+}
+export interface SessionPeerEnvelope {
+  readonly sourceSessionId: string;
+  readonly targetSessionId: string;
+  readonly type: string;
+  readonly payload: unknown;
+}
+export interface SessionPeerReplayGuard {
+  admit(request: Request, now?: number): boolean;
+  close(): void;
+}
+export declare function sessionPeerConfigPath(homeDirectory: string): string;
+/** Reads operator-provisioned peers. Invalid or unreadable config fails closed. */
+export declare function readSessionPeerConfig(homeDirectory: string): SessionPeerConfig | undefined;
+/** `peer/<host-id>/<session-id>` is the only remote target spelling. */
+export declare function parseRemoteSessionReference(value: string): RemoteSessionReference | undefined;
+export declare function peerSessionReference(hostId: string, sessionId: string): string;
+export declare function peerRequestHeaders(sourceHostId: string, peer: SessionPeer, method: string, pathname: string, body: string, now?: number): Headers;
+/** Persists accepted peer signatures so a valid request cannot be replayed within its clock-skew window. */
+export declare function createPeerReplayGuard(homeDirectory: string): SessionPeerReplayGuard;
+export declare function verifyPeerRequest(config: SessionPeerConfig, request: Request, body: string, now?: number): SessionPeer | undefined;
+/** Adds asynchronous tunnel publication to a host-bound local communication endpoint. */
+export declare function createPeerCommunication(options: {
+  readonly local: DoomSessionCommunicationEndpoint;
+  readonly homeDirectory: string;
+  readonly fetch?: typeof fetch;
+}): DoomSessionCommunicationEndpoint;
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/src/services/peerTransport/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../../src/services/peerTransport/index.ts"],"mappings":";;cAOM;iBAUW;WACN;WACA;WACA;;WAEA;;WAEA;;iBAGM;WACN,gBAAgB;WAChB;WACA,gBAAgB;;iBAGV;WACN;WACA;;iBAGM;WACN;WACA;WACA;WACA;;iBAGM;EACf,MAAM,SAAS,SAAS;EACxB;;wBAqCc,sBAAsB;;wBAKtB,sBAAsB,wBAAwB;;wBAyB9C,4BAA4B,gBAAgB;wBAK5C,qBAAqB,gBAAgB;wBAWrC,mBACd,sBACA,MAAM,aACN,gBACA,kBACA,cACA,eACC;;wBAYa,sBAAsB,wBAAwB;wBAyC9C,kBACd,QAAQ,mBACR,SAAS,SACT,cACA,eACC;;wBAmCa,wBAAwB;WAC7B,OAAO;WACP;WACA,eAAe;IACtB"}

package/dist/src/services/peerTransport/index.d.mts

@@ -0,0 +1,49 @@
+import { DoomSessionCommunicationEndpoint } from "@agimon-ai/doompi-core/hub-channel";
+//#region src/services/peerTransport/index.d.ts
+declare const PEER_CONFIG_VERSION = 1;
+export interface SessionPeer {
+  readonly hostId: string;
+  readonly url: string;
+  readonly secret: string;
+  /** Explicit remote durable-message targets. Empty means no delivery grant. */
+  readonly allowedSessionIds: readonly string[];
+  /** Explicit remote Voice media targets. Empty means no media grant. */
+  readonly allowedVoiceSessionIds: readonly string[];
+}
+export interface SessionPeerConfig {
+  readonly version: typeof PEER_CONFIG_VERSION;
+  readonly hostId: string;
+  readonly peers: readonly SessionPeer[];
+}
+export interface RemoteSessionReference {
+  readonly hostId: string;
+  readonly sessionId: string;
+}
+export interface SessionPeerEnvelope {
+  readonly sourceSessionId: string;
+  readonly targetSessionId: string;
+  readonly type: string;
+  readonly payload: unknown;
+}
+export interface SessionPeerReplayGuard {
+  admit(request: Request, now?: number): boolean;
+  close(): void;
+}
+export declare function sessionPeerConfigPath(homeDirectory: string): string;
+/** Reads operator-provisioned peers. Invalid or unreadable config fails closed. */
+export declare function readSessionPeerConfig(homeDirectory: string): SessionPeerConfig | undefined;
+/** `peer/<host-id>/<session-id>` is the only remote target spelling. */
+export declare function parseRemoteSessionReference(value: string): RemoteSessionReference | undefined;
+export declare function peerSessionReference(hostId: string, sessionId: string): string;
+export declare function peerRequestHeaders(sourceHostId: string, peer: SessionPeer, method: string, pathname: string, body: string, now?: number): Headers;
+/** Persists accepted peer signatures so a valid request cannot be replayed within its clock-skew window. */
+export declare function createPeerReplayGuard(homeDirectory: string): SessionPeerReplayGuard;
+export declare function verifyPeerRequest(config: SessionPeerConfig, request: Request, body: string, now?: number): SessionPeer | undefined;
+/** Adds asynchronous tunnel publication to a host-bound local communication endpoint. */
+export declare function createPeerCommunication(options: {
+  readonly local: DoomSessionCommunicationEndpoint;
+  readonly homeDirectory: string;
+  readonly fetch?: typeof fetch;
+}): DoomSessionCommunicationEndpoint;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/peerTransport/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/peerTransport/index.ts"],"mappings":";;cAOM;iBAUW;WACN;WACA;WACA;;WAEA;;WAEA;;iBAGM;WACN,gBAAgB;WAChB;WACA,gBAAgB;;iBAGV;WACN;WACA;;iBAGM;WACN;WACA;WACA;WACA;;iBAGM;EACf,MAAM,SAAS,SAAS;EACxB;;wBAqCc,sBAAsB;;wBAKtB,sBAAsB,wBAAwB;;wBAyB9C,4BAA4B,gBAAgB;wBAK5C,qBAAqB,gBAAgB;wBAWrC,mBACd,sBACA,MAAM,aACN,gBACA,kBACA,cACA,eACC;;wBAYa,sBAAsB,wBAAwB;wBAyC9C,kBACd,QAAQ,mBACR,SAAS,SACT,cACA,eACC;;wBAmCa,wBAAwB;WAC7B,OAAO;WACP;WACA,eAAe;IACtB"}

package/dist/src/services/peerTransport/index.mjs

@@ -0,0 +1,195 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { DatabaseSync } from "node:sqlite";
+//#region src/services/peerTransport/index.ts
+const PEER_CONFIG_VERSION = 1;
+const PEER_CONFIG_FILE = "peers.json";
+const PEER_ROUTE = "/api/plugins/session-peer/inbox";
+const PEER_HEADER = "x-doompi-session-peer";
+const TIMESTAMP_HEADER = "x-doompi-session-timestamp";
+const SIGNATURE_HEADER = "x-doompi-session-signature";
+const MAX_CLOCK_SKEW_MS = 3e5;
+const MAX_REPLAY_ENTRIES = 1e4;
+const REPLAY_DATABASE_FILE = "peer-replay.sqlite";
+function validId(value) {
+	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value);
+}
+function peerOf(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	if (!validId(record.hostId) || typeof record.url !== "string" || typeof record.secret !== "string") return void 0;
+	let url;
+	try {
+		url = new URL(record.url);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return void 0;
+	const allowedSessionIds = Array.isArray(record.allowedSessionIds) && record.allowedSessionIds.every(validId) ? record.allowedSessionIds : void 0;
+	const allowedVoiceSessionIds = Array.isArray(record.allowedVoiceSessionIds) && record.allowedVoiceSessionIds.every(validId) ? record.allowedVoiceSessionIds : [];
+	if (allowedSessionIds === void 0 || record.secret.length < 32) return void 0;
+	return {
+		hostId: record.hostId,
+		url: url.toString(),
+		secret: record.secret,
+		allowedSessionIds,
+		allowedVoiceSessionIds
+	};
+}
+function sessionPeerConfigPath(homeDirectory) {
+	return path.join(homeDirectory, ".pi", ".doom", "session", PEER_CONFIG_FILE);
+}
+/** Reads operator-provisioned peers. Invalid or unreadable config fails closed. */
+function readSessionPeerConfig(homeDirectory) {
+	let parsed;
+	try {
+		const file = sessionPeerConfigPath(homeDirectory);
+		if ((fs.statSync(file).mode & 63) !== 0) return void 0;
+		parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const record = parsed;
+	if (record.version !== PEER_CONFIG_VERSION || !validId(record.hostId) || !Array.isArray(record.peers)) return void 0;
+	const peers = record.peers.map(peerOf);
+	if (peers.some((peer) => peer === void 0)) return void 0;
+	const resolved = peers;
+	if (new Set(resolved.map((peer) => peer.hostId)).size !== resolved.length || resolved.some((peer) => peer.hostId === record.hostId)) return void 0;
+	return {
+		version: PEER_CONFIG_VERSION,
+		hostId: record.hostId,
+		peers: resolved
+	};
+}
+/** `peer/<host-id>/<session-id>` is the only remote target spelling. */
+function parseRemoteSessionReference(value) {
+	const match = /^peer\/([^/]+)\/([^/]+)$/u.exec(value);
+	return match && validId(match[1]) && validId(match[2]) ? {
+		hostId: match[1],
+		sessionId: match[2]
+	} : void 0;
+}
+function peerSessionReference(hostId, sessionId) {
+	if (!validId(hostId) || !validId(sessionId)) throw new TypeError("Remote host and session identifiers must be safe opaque IDs.");
+	return `peer/${hostId}/${sessionId}`;
+}
+function signature(secret, method, pathname, timestamp, body) {
+	const digest = createHash("sha256").update(body).digest("base64url");
+	return createHmac("sha256", secret).update(`${method}\n${pathname}\n${timestamp}\n${digest}`).digest("base64url");
+}
+function peerRequestHeaders(sourceHostId, peer, method, pathname, body, now = Date.now()) {
+	if (!validId(sourceHostId)) throw new TypeError("Source host identity must be a safe opaque ID.");
+	const timestamp = String(now);
+	return new Headers({
+		"content-type": "application/json",
+		[PEER_HEADER]: sourceHostId,
+		[TIMESTAMP_HEADER]: timestamp,
+		[SIGNATURE_HEADER]: signature(peer.secret, method, pathname, timestamp, body)
+	});
+}
+/** Persists accepted peer signatures so a valid request cannot be replayed within its clock-skew window. */
+function createPeerReplayGuard(homeDirectory) {
+	const directory = path.dirname(sessionPeerConfigPath(homeDirectory));
+	fs.mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const database = new DatabaseSync(path.join(directory, REPLAY_DATABASE_FILE));
+	database.exec(`
+    PRAGMA journal_mode = WAL;
+    CREATE TABLE IF NOT EXISTS peer_request_replays (
+      signature TEXT PRIMARY KEY,
+      expires_at INTEGER NOT NULL
+    );
+  `);
+	const removeExpired = database.prepare("DELETE FROM peer_request_replays WHERE expires_at < ?");
+	const insert = database.prepare("INSERT OR IGNORE INTO peer_request_replays (signature, expires_at) VALUES (?, ?)");
+	const count = database.prepare("SELECT COUNT(*) AS count FROM peer_request_replays");
+	const trim = database.prepare(`
+    DELETE FROM peer_request_replays
+    WHERE signature IN (
+      SELECT signature FROM peer_request_replays ORDER BY expires_at ASC, signature ASC LIMIT ?
+    )
+  `);
+	return {
+		admit(request, now = Date.now()) {
+			const supplied = request.headers.get(SIGNATURE_HEADER);
+			if (!supplied) return false;
+			database.exec("BEGIN IMMEDIATE");
+			try {
+				removeExpired.run(now);
+				const accepted = insert.run(supplied, now + MAX_CLOCK_SKEW_MS).changes === 1;
+				const total = Number(count.get().count);
+				if (total > MAX_REPLAY_ENTRIES) trim.run(total - MAX_REPLAY_ENTRIES);
+				database.exec("COMMIT");
+				return accepted;
+			} catch (cause) {
+				database.exec("ROLLBACK");
+				throw cause;
+			}
+		},
+		close: () => database.close()
+	};
+}
+function verifyPeerRequest(config, request, body, now = Date.now()) {
+	const hostId = request.headers.get(PEER_HEADER);
+	const timestamp = request.headers.get(TIMESTAMP_HEADER);
+	const supplied = request.headers.get(SIGNATURE_HEADER);
+	if (!hostId || !timestamp || !supplied || !/^\d{1,16}$/u.test(timestamp)) return void 0;
+	const sentAt = Number(timestamp);
+	if (!Number.isSafeInteger(sentAt) || Math.abs(now - sentAt) > MAX_CLOCK_SKEW_MS) return void 0;
+	const peer = config.peers.find((candidate) => candidate.hostId === hostId);
+	if (!peer) return void 0;
+	const expected = Buffer.from(signature(peer.secret, request.method, new URL(request.url).pathname, timestamp, body));
+	const actual = Buffer.from(supplied);
+	return actual.byteLength === expected.byteLength && timingSafeEqual(actual, expected) ? peer : void 0;
+}
+function envelopeOf(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	return validId(record.sourceSessionId) && validId(record.targetSessionId) && typeof record.type === "string" && record.type !== "" ? {
+		sourceSessionId: record.sourceSessionId,
+		targetSessionId: record.targetSessionId,
+		type: record.type,
+		payload: record.payload
+	} : void 0;
+}
+function parseSessionPeerEnvelope(value) {
+	return envelopeOf(value);
+}
+/** Adds asynchronous tunnel publication to a host-bound local communication endpoint. */
+function createPeerCommunication(options) {
+	const config = readSessionPeerConfig(options.homeDirectory);
+	const send = options.fetch ?? fetch;
+	return {
+		sessionId: options.local.sessionId,
+		publish(target, type, payload) {
+			const remote = parseRemoteSessionReference(target);
+			if (!remote) return options.local.publish(target, type, payload);
+			const peer = config?.peers.find((candidate) => candidate.hostId === remote.hostId);
+			if (!config || !peer || !peer.allowedSessionIds.includes(remote.sessionId)) return false;
+			const body = JSON.stringify({
+				sourceSessionId: options.local.sessionId,
+				targetSessionId: remote.sessionId,
+				type,
+				payload
+			});
+			const url = new URL(PEER_ROUTE, peer.url);
+			send(url, {
+				method: "POST",
+				headers: peerRequestHeaders(config.hostId, peer, "POST", "/inbox", body),
+				body
+			}).catch(() => void 0);
+			return true;
+		},
+		subscribe: (type, listener) => options.local.subscribe(type, listener),
+		onPeerReady: (listener) => options.local.onPeerReady(listener),
+		close: () => options.local.close()
+	};
+}
+//#endregion
+export { createPeerCommunication, createPeerReplayGuard, parseRemoteSessionReference, parseSessionPeerEnvelope, peerRequestHeaders, peerSessionReference, readSessionPeerConfig, sessionPeerConfigPath, verifyPeerRequest };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/peerTransport/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/peerTransport/index.ts"],"sourcesContent":["import { createHash, createHmac, timingSafeEqual } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { DatabaseSync } from 'node:sqlite';\n\nimport type { DoomSessionCommunicationEndpoint } from '@agimon-ai/doompi-core/hub-channel';\n\nconst PEER_CONFIG_VERSION = 1;\nconst PEER_CONFIG_FILE = 'peers.json';\nconst PEER_ROUTE = '/api/plugins/session-peer/inbox';\nconst PEER_HEADER = 'x-doompi-session-peer';\nconst TIMESTAMP_HEADER = 'x-doompi-session-timestamp';\nconst SIGNATURE_HEADER = 'x-doompi-session-signature';\nconst MAX_CLOCK_SKEW_MS = 5 * 60_000;\nconst MAX_REPLAY_ENTRIES = 10_000;\nconst REPLAY_DATABASE_FILE = 'peer-replay.sqlite';\n\nexport interface SessionPeer {\n  readonly hostId: string;\n  readonly url: string;\n  readonly secret: string;\n  /** Explicit remote durable-message targets. Empty means no delivery grant. */\n  readonly allowedSessionIds: readonly string[];\n  /** Explicit remote Voice media targets. Empty means no media grant. */\n  readonly allowedVoiceSessionIds: readonly string[];\n}\n\nexport interface SessionPeerConfig {\n  readonly version: typeof PEER_CONFIG_VERSION;\n  readonly hostId: string;\n  readonly peers: readonly SessionPeer[];\n}\n\nexport interface RemoteSessionReference {\n  readonly hostId: string;\n  readonly sessionId: string;\n}\n\nexport interface SessionPeerEnvelope {\n  readonly sourceSessionId: string;\n  readonly targetSessionId: string;\n  readonly type: string;\n  readonly payload: unknown;\n}\n\nexport interface SessionPeerReplayGuard {\n  admit(request: Request, now?: number): boolean;\n  close(): void;\n}\n\nfunction validId(value: unknown): value is string {\n  return typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value);\n}\n\nfunction peerOf(value: unknown): SessionPeer | undefined {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  if (!validId(record.hostId) || typeof record.url !== 'string' || typeof record.secret !== 'string') return undefined;\n  let url: URL;\n  try {\n    url = new URL(record.url);\n  } catch {\n    return undefined;\n  }\n  if (url.protocol !== 'https:' || url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '')\n    return undefined;\n  const allowedSessionIds =\n    Array.isArray(record.allowedSessionIds) && record.allowedSessionIds.every(validId)\n      ? record.allowedSessionIds\n      : undefined;\n  const allowedVoiceSessionIds =\n    Array.isArray(record.allowedVoiceSessionIds) && record.allowedVoiceSessionIds.every(validId)\n      ? record.allowedVoiceSessionIds\n      : [];\n  if (allowedSessionIds === undefined || record.secret.length < 32) return undefined;\n  return {\n    hostId: record.hostId,\n    url: url.toString(),\n    secret: record.secret,\n    allowedSessionIds,\n    allowedVoiceSessionIds,\n  };\n}\n\nexport function sessionPeerConfigPath(homeDirectory: string): string {\n  return path.join(homeDirectory, '.pi', '.doom', 'session', PEER_CONFIG_FILE);\n}\n\n/** Reads operator-provisioned peers. Invalid or unreadable config fails closed. */\nexport function readSessionPeerConfig(homeDirectory: string): SessionPeerConfig | undefined {\n  let parsed: unknown;\n  try {\n    const file = sessionPeerConfigPath(homeDirectory);\n    if ((fs.statSync(file).mode & 0o077) !== 0) return undefined;\n    parsed = JSON.parse(fs.readFileSync(file, 'utf8')) as unknown;\n  } catch {\n    return undefined;\n  }\n  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return undefined;\n  const record = parsed as Record<string, unknown>;\n  if (record.version !== PEER_CONFIG_VERSION || !validId(record.hostId) || !Array.isArray(record.peers))\n    return undefined;\n  const peers = record.peers.map(peerOf);\n  if (peers.some((peer) => peer === undefined)) return undefined;\n  const resolved = peers as SessionPeer[];\n  if (\n    new Set(resolved.map((peer) => peer.hostId)).size !== resolved.length ||\n    resolved.some((peer) => peer.hostId === record.hostId)\n  )\n    return undefined;\n  return { version: PEER_CONFIG_VERSION, hostId: record.hostId, peers: resolved };\n}\n\n/** `peer/<host-id>/<session-id>` is the only remote target spelling. */\nexport function parseRemoteSessionReference(value: string): RemoteSessionReference | undefined {\n  const match = /^peer\\/([^/]+)\\/([^/]+)$/u.exec(value);\n  return match && validId(match[1]) && validId(match[2]) ? { hostId: match[1], sessionId: match[2] } : undefined;\n}\n\nexport function peerSessionReference(hostId: string, sessionId: string): string {\n  if (!validId(hostId) || !validId(sessionId))\n    throw new TypeError('Remote host and session identifiers must be safe opaque IDs.');\n  return `peer/${hostId}/${sessionId}`;\n}\n\nfunction signature(secret: string, method: string, pathname: string, timestamp: string, body: string): string {\n  const digest = createHash('sha256').update(body).digest('base64url');\n  return createHmac('sha256', secret).update(`${method}\\n${pathname}\\n${timestamp}\\n${digest}`).digest('base64url');\n}\n\nexport function peerRequestHeaders(\n  sourceHostId: string,\n  peer: SessionPeer,\n  method: string,\n  pathname: string,\n  body: string,\n  now = Date.now(),\n): Headers {\n  if (!validId(sourceHostId)) throw new TypeError('Source host identity must be a safe opaque ID.');\n  const timestamp = String(now);\n  return new Headers({\n    'content-type': 'application/json',\n    [PEER_HEADER]: sourceHostId,\n    [TIMESTAMP_HEADER]: timestamp,\n    [SIGNATURE_HEADER]: signature(peer.secret, method, pathname, timestamp, body),\n  });\n}\n\n/** Persists accepted peer signatures so a valid request cannot be replayed within its clock-skew window. */\nexport function createPeerReplayGuard(homeDirectory: string): SessionPeerReplayGuard {\n  const directory = path.dirname(sessionPeerConfigPath(homeDirectory));\n  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });\n  const database = new DatabaseSync(path.join(directory, REPLAY_DATABASE_FILE));\n  database.exec(`\n    PRAGMA journal_mode = WAL;\n    CREATE TABLE IF NOT EXISTS peer_request_replays (\n      signature TEXT PRIMARY KEY,\n      expires_at INTEGER NOT NULL\n    );\n  `);\n  const removeExpired = database.prepare('DELETE FROM peer_request_replays WHERE expires_at < ?');\n  const insert = database.prepare('INSERT OR IGNORE INTO peer_request_replays (signature, expires_at) VALUES (?, ?)');\n  const count = database.prepare('SELECT COUNT(*) AS count FROM peer_request_replays');\n  const trim = database.prepare(`\n    DELETE FROM peer_request_replays\n    WHERE signature IN (\n      SELECT signature FROM peer_request_replays ORDER BY expires_at ASC, signature ASC LIMIT ?\n    )\n  `);\n  return {\n    admit(request, now = Date.now()) {\n      const supplied = request.headers.get(SIGNATURE_HEADER);\n      if (!supplied) return false;\n      database.exec('BEGIN IMMEDIATE');\n      try {\n        removeExpired.run(now);\n        const accepted = insert.run(supplied, now + MAX_CLOCK_SKEW_MS).changes === 1;\n        const total = Number((count.get() as { count: number | bigint }).count);\n        if (total > MAX_REPLAY_ENTRIES) trim.run(total - MAX_REPLAY_ENTRIES);\n        database.exec('COMMIT');\n        return accepted;\n      } catch (cause) {\n        database.exec('ROLLBACK');\n        throw cause;\n      }\n    },\n    close: () => database.close(),\n  };\n}\n\nexport function verifyPeerRequest(\n  config: SessionPeerConfig,\n  request: Request,\n  body: string,\n  now = Date.now(),\n): SessionPeer | undefined {\n  const hostId = request.headers.get(PEER_HEADER);\n  const timestamp = request.headers.get(TIMESTAMP_HEADER);\n  const supplied = request.headers.get(SIGNATURE_HEADER);\n  if (!hostId || !timestamp || !supplied || !/^\\d{1,16}$/u.test(timestamp)) return undefined;\n  const sentAt = Number(timestamp);\n  if (!Number.isSafeInteger(sentAt) || Math.abs(now - sentAt) > MAX_CLOCK_SKEW_MS) return undefined;\n  const peer = config.peers.find((candidate) => candidate.hostId === hostId);\n  if (!peer) return undefined;\n  const expected = Buffer.from(signature(peer.secret, request.method, new URL(request.url).pathname, timestamp, body));\n  const actual = Buffer.from(supplied);\n  return actual.byteLength === expected.byteLength && timingSafeEqual(actual, expected) ? peer : undefined;\n}\n\nfunction envelopeOf(value: unknown): SessionPeerEnvelope | undefined {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  return validId(record.sourceSessionId) &&\n    validId(record.targetSessionId) &&\n    typeof record.type === 'string' &&\n    record.type !== ''\n    ? {\n        sourceSessionId: record.sourceSessionId,\n        targetSessionId: record.targetSessionId,\n        type: record.type,\n        payload: record.payload,\n      }\n    : undefined;\n}\n\nexport function parseSessionPeerEnvelope(value: unknown): SessionPeerEnvelope | undefined {\n  return envelopeOf(value);\n}\n\n/** Adds asynchronous tunnel publication to a host-bound local communication endpoint. */\nexport function createPeerCommunication(options: {\n  readonly local: DoomSessionCommunicationEndpoint;\n  readonly homeDirectory: string;\n  readonly fetch?: typeof fetch;\n}): DoomSessionCommunicationEndpoint {\n  const config = readSessionPeerConfig(options.homeDirectory);\n  const send = options.fetch ?? fetch;\n  return {\n    sessionId: options.local.sessionId,\n    publish(target, type, payload) {\n      const remote = parseRemoteSessionReference(target);\n      if (!remote) return options.local.publish(target, type, payload);\n      const peer = config?.peers.find((candidate) => candidate.hostId === remote.hostId);\n      // Pairing is not a grant. Outbound delivery needs the same explicit target\n      // allowlist that the receiver enforces for inbound envelopes.\n      if (!config || !peer || !peer.allowedSessionIds.includes(remote.sessionId)) return false;\n      const body = JSON.stringify({\n        sourceSessionId: options.local.sessionId,\n        targetSessionId: remote.sessionId,\n        type,\n        payload,\n      });\n      const url = new URL(PEER_ROUTE, peer.url);\n      void send(url, {\n        method: 'POST',\n        headers: peerRequestHeaders(config.hostId, peer, 'POST', '/inbox', body),\n        body,\n      }).catch(() => undefined);\n      return true;\n    },\n    subscribe: (type, listener) => options.local.subscribe(type, listener),\n    onPeerReady: (listener) => options.local.onPeerReady(listener),\n    close: () => options.local.close(),\n  };\n}\n"],"mappings":";;;;;AAOA,MAAM,sBAAsB;AAC5B,MAAM,mBAAmB;AACzB,MAAM,aAAa;AACnB,MAAM,cAAc;AACpB,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,uBAAuB;AAmC7B,SAAS,QAAQ,OAAiC;CAChD,OAAO,OAAO,UAAU,YAAY,sCAAsC,KAAK,KAAK;AACtF;AAEA,SAAS,OAAO,OAAyC;CACvD,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAChF,MAAM,SAAS;CACf,IAAI,CAAC,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,QAAQ,YAAY,OAAO,OAAO,WAAW,UAAU,OAAO,KAAA;CAC3G,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,OAAO,GAAG;CAC1B,QAAQ;EACN;CACF;CACA,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI,SAAS,IAC/G,OAAO,KAAA;CACT,MAAM,oBACJ,MAAM,QAAQ,OAAO,iBAAiB,KAAK,OAAO,kBAAkB,MAAM,OAAO,IAC7E,OAAO,oBACP,KAAA;CACN,MAAM,yBACJ,MAAM,QAAQ,OAAO,sBAAsB,KAAK,OAAO,uBAAuB,MAAM,OAAO,IACvF,OAAO,yBACP,CAAC;CACP,IAAI,sBAAsB,KAAA,KAAa,OAAO,OAAO,SAAS,IAAI,OAAO,KAAA;CACzE,OAAO;EACL,QAAQ,OAAO;EACf,KAAK,IAAI,SAAS;EAClB,QAAQ,OAAO;EACf;EACA;CACF;AACF;AAEA,SAAgB,sBAAsB,eAA+B;CACnE,OAAO,KAAK,KAAK,eAAe,OAAO,SAAS,WAAW,gBAAgB;AAC7E;;AAGA,SAAgB,sBAAsB,eAAsD;CAC1F,IAAI;CACJ,IAAI;EACF,MAAM,OAAO,sBAAsB,aAAa;EAChD,KAAK,GAAG,SAAS,IAAI,CAAC,CAAC,OAAO,QAAW,GAAG,OAAO,KAAA;EACnD,SAAS,KAAK,MAAM,GAAG,aAAa,MAAM,MAAM,CAAC;CACnD,QAAQ;EACN;CACF;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG,OAAO,KAAA;CACnF,MAAM,SAAS;CACf,IAAI,OAAO,YAAY,uBAAuB,CAAC,QAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,QAAQ,OAAO,KAAK,GAClG,OAAO,KAAA;CACT,MAAM,QAAQ,OAAO,MAAM,IAAI,MAAM;CACrC,IAAI,MAAM,MAAM,SAAS,SAAS,KAAA,CAAS,GAAG,OAAO,KAAA;CACrD,MAAM,WAAW;CACjB,IACE,IAAI,IAAI,SAAS,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,SAAS,UAC/D,SAAS,MAAM,SAAS,KAAK,WAAW,OAAO,MAAM,GAErD,OAAO,KAAA;CACT,OAAO;EAAE,SAAS;EAAqB,QAAQ,OAAO;EAAQ,OAAO;CAAS;AAChF;;AAGA,SAAgB,4BAA4B,OAAmD;CAC7F,MAAM,QAAQ,4BAA4B,KAAK,KAAK;CACpD,OAAO,SAAS,QAAQ,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI;EAAE,QAAQ,MAAM;EAAI,WAAW,MAAM;CAAG,IAAI,KAAA;AACvG;AAEA,SAAgB,qBAAqB,QAAgB,WAA2B;CAC9E,IAAI,CAAC,QAAQ,MAAM,KAAK,CAAC,QAAQ,SAAS,GACxC,MAAM,IAAI,UAAU,8DAA8D;CACpF,OAAO,QAAQ,OAAO,GAAG;AAC3B;AAEA,SAAS,UAAU,QAAgB,QAAgB,UAAkB,WAAmB,MAAsB;CAC5G,MAAM,SAAS,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;CACnE,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,GAAG,OAAO,IAAI,SAAS,IAAI,UAAU,IAAI,QAAQ,CAAC,CAAC,OAAO,WAAW;AAClH;AAEA,SAAgB,mBACd,cACA,MACA,QACA,UACA,MACA,MAAM,KAAK,IAAI,GACN;CACT,IAAI,CAAC,QAAQ,YAAY,GAAG,MAAM,IAAI,UAAU,gDAAgD;CAChG,MAAM,YAAY,OAAO,GAAG;CAC5B,OAAO,IAAI,QAAQ;EACjB,gBAAgB;GACf,cAAc;GACd,mBAAmB;GACnB,mBAAmB,UAAU,KAAK,QAAQ,QAAQ,UAAU,WAAW,IAAI;CAC9E,CAAC;AACH;;AAGA,SAAgB,sBAAsB,eAA+C;CACnF,MAAM,YAAY,KAAK,QAAQ,sBAAsB,aAAa,CAAC;CACnE,GAAG,UAAU,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACxD,MAAM,WAAW,IAAI,aAAa,KAAK,KAAK,WAAW,oBAAoB,CAAC;CAC5E,SAAS,KAAK;;;;;;GAMb;CACD,MAAM,gBAAgB,SAAS,QAAQ,uDAAuD;CAC9F,MAAM,SAAS,SAAS,QAAQ,kFAAkF;CAClH,MAAM,QAAQ,SAAS,QAAQ,oDAAoD;CACnF,MAAM,OAAO,SAAS,QAAQ;;;;;GAK7B;CACD,OAAO;EACL,MAAM,SAAS,MAAM,KAAK,IAAI,GAAG;GAC/B,MAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB;GACrD,IAAI,CAAC,UAAU,OAAO;GACtB,SAAS,KAAK,iBAAiB;GAC/B,IAAI;IACF,cAAc,IAAI,GAAG;IACrB,MAAM,WAAW,OAAO,IAAI,UAAU,MAAM,iBAAiB,CAAC,CAAC,YAAY;IAC3E,MAAM,QAAQ,OAAQ,MAAM,IAAI,CAAC,CAAgC,KAAK;IACtE,IAAI,QAAQ,oBAAoB,KAAK,IAAI,QAAQ,kBAAkB;IACnE,SAAS,KAAK,QAAQ;IACtB,OAAO;GACT,SAAS,OAAO;IACd,SAAS,KAAK,UAAU;IACxB,MAAM;GACR;EACF;EACA,aAAa,SAAS,MAAM;CAC9B;AACF;AAEA,SAAgB,kBACd,QACA,SACA,MACA,MAAM,KAAK,IAAI,GACU;CACzB,MAAM,SAAS,QAAQ,QAAQ,IAAI,WAAW;CAC9C,MAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB;CACtD,MAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB;CACrD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc,KAAK,SAAS,GAAG,OAAO,KAAA;CACjF,MAAM,SAAS,OAAO,SAAS;CAC/B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,IAAI,MAAM,MAAM,IAAI,mBAAmB,OAAO,KAAA;CACxF,MAAM,OAAO,OAAO,MAAM,MAAM,cAAc,UAAU,WAAW,MAAM;CACzE,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,WAAW,OAAO,KAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,UAAU,WAAW,IAAI,CAAC;CACnH,MAAM,SAAS,OAAO,KAAK,QAAQ;CACnC,OAAO,OAAO,eAAe,SAAS,cAAc,gBAAgB,QAAQ,QAAQ,IAAI,OAAO,KAAA;AACjG;AAEA,SAAS,WAAW,OAAiD;CACnE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAChF,MAAM,SAAS;CACf,OAAO,QAAQ,OAAO,eAAe,KACnC,QAAQ,OAAO,eAAe,KAC9B,OAAO,OAAO,SAAS,YACvB,OAAO,SAAS,KACd;EACE,iBAAiB,OAAO;EACxB,iBAAiB,OAAO;EACxB,MAAM,OAAO;EACb,SAAS,OAAO;CAClB,IACA,KAAA;AACN;AAEA,SAAgB,yBAAyB,OAAiD;CACxF,OAAO,WAAW,KAAK;AACzB;;AAGA,SAAgB,wBAAwB,SAIH;CACnC,MAAM,SAAS,sBAAsB,QAAQ,aAAa;CAC1D,MAAM,OAAO,QAAQ,SAAS;CAC9B,OAAO;EACL,WAAW,QAAQ,MAAM;EACzB,QAAQ,QAAQ,MAAM,SAAS;GAC7B,MAAM,SAAS,4BAA4B,MAAM;GACjD,IAAI,CAAC,QAAQ,OAAO,QAAQ,MAAM,QAAQ,QAAQ,MAAM,OAAO;GAC/D,MAAM,OAAO,QAAQ,MAAM,MAAM,cAAc,UAAU,WAAW,OAAO,MAAM;GAGjF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,kBAAkB,SAAS,OAAO,SAAS,GAAG,OAAO;GACnF,MAAM,OAAO,KAAK,UAAU;IAC1B,iBAAiB,QAAQ,MAAM;IAC/B,iBAAiB,OAAO;IACxB;IACA;GACF,CAAC;GACD,MAAM,MAAM,IAAI,IAAI,YAAY,KAAK,GAAG;GACxC,KAAU,KAAK;IACb,QAAQ;IACR,SAAS,mBAAmB,OAAO,QAAQ,MAAM,QAAQ,UAAU,IAAI;IACvE;GACF,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;GACxB,OAAO;EACT;EACA,YAAY,MAAM,aAAa,QAAQ,MAAM,UAAU,MAAM,QAAQ;EACrE,cAAc,aAAa,QAAQ,MAAM,YAAY,QAAQ;EAC7D,aAAa,QAAQ,MAAM,MAAM;CACnC;AACF"}