@cogenta/fleet 0.1.0

package/dist/agent/assert.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Throws if `payload` — already serialized to a plain object, exactly as it
+ * would be before signing and sending — contains any key from the forbidden
+ * list at any depth. Never silently drops the offending field: a payload
+ * that could only be made "safe" by quietly deleting data is not a payload
+ * this function considers safe to send at all.
+ */
+export declare function assertNoForbiddenFields(payload: unknown): void;
+//# sourceMappingURL=assert.d.ts.map

package/dist/agent/assert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert.d.ts","sourceRoot":"","sources":["../../src/agent/assert.ts"],"names":[],"mappings":"AAgDA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAW9D"}

package/dist/agent/assert.js

@@ -0,0 +1,64 @@
+import { CogentaError } from '@cogenta/core';
+/**
+ * "Vérification exhaustive de ce qui sort d'un site" — the security test
+ * `docs/lots/L8-flotte.md` names explicitly. `TelemetryPayload`'s type
+ * already makes the forbidden fields unrepresentable for any caller that
+ * goes through TypeScript's own checking — this function is the
+ * defense-in-depth half: a real, runtime inspection of the object about to
+ * be signed and sent, catching a forbidden key smuggled in past a loosely
+ * typed call site (an unchecked cast, an object spread, a JSON round-trip
+ * from an untyped source) that the type system alone would not stop.
+ */
+const FORBIDDEN_KEYS = [
+    'content',
+    'media',
+    'visitorpii',
+    'visitordata',
+    'apikey',
+    'apikeys',
+    'secret',
+    'secrets',
+    'agentmemory',
+    'memory',
+    'rawlogs',
+    'logs',
+    'log',
+];
+/** Recurses into plain objects and arrays only — a class instance or a function is not what a JSON-serializable telemetry payload should ever contain in the first place. */
+function walk(value, path, hits) {
+    if (value === null || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => {
+            walk(entry, `${path}[${index}]`, hits);
+        });
+        return;
+    }
+    for (const [key, entry] of Object.entries(value)) {
+        const keyPath = path === '' ? key : `${path}.${key}`;
+        if (FORBIDDEN_KEYS.includes(key.toLowerCase())) {
+            hits.push(keyPath);
+        }
+        walk(entry, keyPath, hits);
+    }
+}
+/**
+ * Throws if `payload` — already serialized to a plain object, exactly as it
+ * would be before signing and sending — contains any key from the forbidden
+ * list at any depth. Never silently drops the offending field: a payload
+ * that could only be made "safe" by quietly deleting data is not a payload
+ * this function considers safe to send at all.
+ */
+export function assertNoForbiddenFields(payload) {
+    const hits = [];
+    walk(payload, '', hits);
+    if (hits.length > 0) {
+        throw new CogentaError({
+            code: 'FLEET_TELEMETRY_FORBIDDEN_FIELD',
+            message: `Telemetry payload contains forbidden field(s): ${hits.join(', ')}.`,
+            hint: 'Only the fields named in "## Ce qui remonte" (docs/lots/L8-flotte.md) may leave a site. Remove the offending field before sending.',
+            details: { fields: hits },
+        });
+    }
+}
+//# sourceMappingURL=assert.js.map

package/dist/agent/assert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert.js","sourceRoot":"","sources":["../../src/agent/assert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG;IACrB,SAAS;IACT,OAAO;IACP,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,aAAa;IACb,QAAQ;IACR,SAAS;IACT,MAAM;IACN,KAAK;CACG,CAAA;AAEV,6KAA6K;AAC7K,SAAS,IAAI,CAAC,KAAc,EAAE,IAAY,EAAE,IAAc;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAM;IAEvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;QACpD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAqC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IACvB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,kDAAkD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7E,IAAI,EAAE,oIAAoI;YAC1I,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/agent/build.d.ts

@@ -0,0 +1,21 @@
+import type { SbomEntry } from '@cogenta/agents-builtin';
+import type { CredentialStore, UserStore } from '@cogenta/auth';
+import type { AdminAccountsSummary } from './types.js';
+/**
+ * A SHA-256 hex digest of the site's real SBOM (`buildSbom`,
+ * `@cogenta/agents-builtin`) — reuses the same deterministic, sorted-key
+ * canonicalization `@cogenta/plugins`' signing primitive already relies on
+ * (`canonicalizeContent`), so two sites with the identical dependency set
+ * always fingerprint identically regardless of `package.json` insertion
+ * order.
+ */
+export declare function fingerprintSbom(entries: readonly SbomEntry[]): string;
+/**
+ * Real counts, never identities — `docs/lots/L8-flotte.md`'s own words:
+ * "comptes administrateurs (nombre et état MFA, pas les identités)". Reads
+ * every admin-role user's real credential kinds (`CredentialStore.kinds`)
+ * and counts one as MFA-enabled the moment it has any kind beyond a bare
+ * password — `password` alone is not a second factor.
+ */
+export declare function summarizeAdminAccounts(users: UserStore, credentials: CredentialStore, adminRole?: string): Promise<AdminAccountsSummary>;
+//# sourceMappingURL=build.d.ts.map

package/dist/agent/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/agent/build.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAarE;AAKD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,eAAe,EAC5B,SAAS,SAAU,GAClB,OAAO,CAAC,oBAAoB,CAAC,CAW/B"}

package/dist/agent/build.js

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto';
+import { canonicalizeContent } from '@cogenta/plugins';
+/**
+ * A SHA-256 hex digest of the site's real SBOM (`buildSbom`,
+ * `@cogenta/agents-builtin`) — reuses the same deterministic, sorted-key
+ * canonicalization `@cogenta/plugins`' signing primitive already relies on
+ * (`canonicalizeContent`), so two sites with the identical dependency set
+ * always fingerprint identically regardless of `package.json` insertion
+ * order.
+ */
+export function fingerprintSbom(entries) {
+    // `canonicalizeContent` sorts each object's own keys, but an array's
+    // ELEMENT order is exactly what it was given — `buildSbom`'s own order
+    // follows `Object.entries()` on a plain `dependencies` record, which is
+    // insertion order, not a stable sort. Two sites with the identical
+    // dependency set built from a `package.json`/lockfile whose keys simply
+    // appear in a different order must fingerprint identically, so the
+    // entries are sorted here, by name then ecosystem, before canonicalizing.
+    const sorted = [...entries].sort((a, b) => a.name.localeCompare(b.name) || a.ecosystem.localeCompare(b.ecosystem));
+    const canonical = canonicalizeContent(sorted);
+    return createHash('sha256').update(canonical, 'utf8').digest('hex');
+}
+/** `CredentialStore.kinds()`'s real return values beyond a bare password — `@cogenta/auth`'s own `CREDENTIAL_KINDS` (`'password' | 'totp' | 'webauthn'`), not re-exported publicly, so named here as the literal strings its real API returns. */
+const MFA_KINDS = ['totp', 'webauthn'];
+/**
+ * Real counts, never identities — `docs/lots/L8-flotte.md`'s own words:
+ * "comptes administrateurs (nombre et état MFA, pas les identités)". Reads
+ * every admin-role user's real credential kinds (`CredentialStore.kinds`)
+ * and counts one as MFA-enabled the moment it has any kind beyond a bare
+ * password — `password` alone is not a second factor.
+ */
+export async function summarizeAdminAccounts(users, credentials, adminRole = 'admin') {
+    const all = await users.list();
+    const admins = all.filter((user) => user.roles.includes(adminRole));
+    let mfaEnabledCount = 0;
+    for (const admin of admins) {
+        const kinds = await credentials.kinds(admin.id);
+        if (kinds.some((kind) => MFA_KINDS.includes(kind)))
+            mfaEnabledCount += 1;
+    }
+    return { count: admins.length, mfaEnabledCount };
+}
+//# sourceMappingURL=build.js.map

package/dist/agent/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/agent/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAGtD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAA6B;IAC3D,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,mEAAmE;IACnE,wEAAwE;IACxE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CACjF,CAAA;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED,kPAAkP;AAClP,MAAM,SAAS,GAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAgB,EAChB,WAA4B,EAC5B,SAAS,GAAG,OAAO;IAEnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;IAEnE,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,eAAe,IAAI,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAA;AAClD,CAAC"}

package/dist/agent/commands.d.ts

@@ -0,0 +1,39 @@
+import { type FleetCommand, type FleetCommandAction, type SignedFleetCommand } from '../control/commands.js';
+export type FleetCommandVerification = {
+    readonly ok: true;
+    readonly command: FleetCommand;
+} | {
+    readonly ok: false;
+    readonly reason: 'action_not_whitelisted' | 'invalid_signature';
+};
+/**
+ * The real security boundary "## Appairage" describes: "exécutables
+ * uniquement dans une liste blanche d'actions." Whitelist checked first — a
+ * command naming an action outside `FLEET_COMMAND_ACTIONS` is refused before
+ * its signature is even inspected, since signature validity alone must never
+ * be sufficient to authorize an action this site doesn't recognise at all.
+ * Verifies against the CONTROL PLANE'S public key (`../control/identity.js`,
+ * learned once at pairing — `../enrollment/store.js`'s
+ * `PairingToken.controlPlanePublicKey`), the reverse direction from
+ * `../agent/sign.js`'s telemetry signing, which uses the site's own key.
+ */
+export declare function verifyFleetCommand(signed: SignedFleetCommand, controlPlanePublicKeyBase64: string): FleetCommandVerification;
+export type FleetCommandHandlers = {
+    readonly [K in FleetCommandAction]?: (payload: unknown) => Promise<void>;
+};
+export type FleetCommandDispatchResult = {
+    readonly ok: true;
+    readonly executed: true;
+} | {
+    readonly ok: false;
+    readonly reason: 'action_not_whitelisted' | 'invalid_signature' | 'no_handler_registered';
+};
+/**
+ * Verifies, then — and only then — looks up a real handler for the
+ * command's action. A rejected command never reaches a handler: this is the
+ * one real call site a site deployment should ever use to act on a fleet
+ * command, so "verify, then dispatch" is not something a caller can
+ * accidentally skip by calling a handler directly.
+ */
+export declare function dispatchFleetCommand(signed: SignedFleetCommand, controlPlanePublicKeyBase64: string, handlers: FleetCommandHandlers): Promise<FleetCommandDispatchResult>;
+//# sourceMappingURL=commands.d.ts.map

package/dist/agent/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/agent/commands.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAA;AAE/B,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,GAAG,mBAAmB,CAAA;CAAE,CAAA;AAM3F;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,EAC1B,2BAA2B,EAAE,MAAM,GAClC,wBAAwB,CAW1B;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,CAAC,IAAI,kBAAkB,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC;CACzE,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,uBAAuB,CAAA;CAC1F,CAAA;AAEL;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,kBAAkB,EAC1B,2BAA2B,EAAE,MAAM,EACnC,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CASrC"}

package/dist/agent/commands.js

@@ -0,0 +1,43 @@
+import { verifyContentSignature } from '@cogenta/plugins';
+import { FLEET_COMMAND_ACTIONS, } from '../control/commands.js';
+function isWhitelistedAction(action) {
+    return FLEET_COMMAND_ACTIONS.includes(action);
+}
+/**
+ * The real security boundary "## Appairage" describes: "exécutables
+ * uniquement dans une liste blanche d'actions." Whitelist checked first — a
+ * command naming an action outside `FLEET_COMMAND_ACTIONS` is refused before
+ * its signature is even inspected, since signature validity alone must never
+ * be sufficient to authorize an action this site doesn't recognise at all.
+ * Verifies against the CONTROL PLANE'S public key (`../control/identity.js`,
+ * learned once at pairing — `../enrollment/store.js`'s
+ * `PairingToken.controlPlanePublicKey`), the reverse direction from
+ * `../agent/sign.js`'s telemetry signing, which uses the site's own key.
+ */
+export function verifyFleetCommand(signed, controlPlanePublicKeyBase64) {
+    if (!isWhitelistedAction(signed.command.action)) {
+        return { ok: false, reason: 'action_not_whitelisted' };
+    }
+    const valid = verifyContentSignature(signed.command, signed.signatureBase64, controlPlanePublicKeyBase64);
+    if (!valid)
+        return { ok: false, reason: 'invalid_signature' };
+    return { ok: true, command: signed.command };
+}
+/**
+ * Verifies, then — and only then — looks up a real handler for the
+ * command's action. A rejected command never reaches a handler: this is the
+ * one real call site a site deployment should ever use to act on a fleet
+ * command, so "verify, then dispatch" is not something a caller can
+ * accidentally skip by calling a handler directly.
+ */
+export async function dispatchFleetCommand(signed, controlPlanePublicKeyBase64, handlers) {
+    const verification = verifyFleetCommand(signed, controlPlanePublicKeyBase64);
+    if (!verification.ok)
+        return verification;
+    const handler = handlers[verification.command.action];
+    if (handler === undefined)
+        return { ok: false, reason: 'no_handler_registered' };
+    await handler(verification.command.payload);
+    return { ok: true, executed: true };
+}
+//# sourceMappingURL=commands.js.map

package/dist/agent/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/agent/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EACL,qBAAqB,GAItB,MAAM,wBAAwB,CAAA;AAM/B,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA0B,EAC1B,2BAAmC;IAEnC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAClC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,eAAe,EACtB,2BAA2B,CAC5B,CAAA;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;AAC9C,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAA0B,EAC1B,2BAAmC,EACnC,QAA8B;IAE9B,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAA;IAC5E,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAA;IAEzC,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACrD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;IAEhF,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AACrC,CAAC"}

package/dist/agent/rollback-handler.d.ts

@@ -0,0 +1,28 @@
+import type { InventoryComponentKind } from '../inventory/drift.js';
+/**
+ * The real shape of a `rollback` command's payload, per
+ * `../rollout/rollback.js`'s `triggerRollback` — validated here rather than
+ * trusted, since a command's `payload` field is `unknown` at the type level
+ * until a handler actually inspects it (`../agent/commands.js`'s
+ * `FleetCommandHandlers`).
+ */
+export interface RollbackIntent {
+    readonly componentKind: InventoryComponentKind;
+    readonly componentName: string;
+    readonly targetVersion: string;
+}
+/**
+ * The real, honest scope of this task's site-side rollback handling:
+ * validate the intent a signed, whitelisted `rollback` command carries, then
+ * hand it to a caller-supplied callback — never a claim that this package
+ * itself reverts installed code. No mechanism exists anywhere in this
+ * codebase today to revert a site's installed plugin/theme/CMS code to a
+ * prior version (no package-manager integration, no `@cogenta/plugins`
+ * uninstall/downgrade path) — that is a real, documented gap, not something
+ * papered over with a handler that pretends to act. `recordIntent` is where
+ * a real deployment wires whatever it actually has (an operator alert, a
+ * queued manual task, or — once real reversion infrastructure exists — the
+ * genuine mechanism) without this package inventing one it cannot back.
+ */
+export declare function createRollbackIntentHandler(recordIntent: (intent: RollbackIntent) => Promise<void>): (payload: unknown) => Promise<void>;
+//# sourceMappingURL=rollback-handler.d.ts.map

package/dist/agent/rollback-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-handler.d.ts","sourceRoot":"","sources":["../../src/agent/rollback-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAqCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GACtD,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAKrC"}

package/dist/agent/rollback-handler.js

@@ -0,0 +1,52 @@
+import { CogentaError } from '@cogenta/core';
+const COMPONENT_KINDS = ['cms', 'plugin', 'theme'];
+function parseRollbackPayload(payload) {
+    if (payload === null || typeof payload !== 'object') {
+        throw new CogentaError({
+            code: 'FLEET_ROLLBACK_NO_PRIOR_VERSION',
+            message: 'Rollback command payload is not an object.',
+            hint: 'This indicates a control-plane bug — triggerRollback always sends a real object payload.',
+            details: { payload },
+        });
+    }
+    const record = payload;
+    const { componentKind, componentName, targetVersion } = record;
+    if (typeof componentKind !== 'string' ||
+        !COMPONENT_KINDS.includes(componentKind) ||
+        typeof componentName !== 'string' ||
+        componentName.trim() === '' ||
+        typeof targetVersion !== 'string' ||
+        targetVersion.trim() === '') {
+        throw new CogentaError({
+            code: 'FLEET_ROLLBACK_NO_PRIOR_VERSION',
+            message: 'Rollback command payload is missing or has malformed fields.',
+            hint: 'Expected { componentKind: "cms"|"plugin"|"theme", componentName: string, targetVersion: string }.',
+            details: { payload },
+        });
+    }
+    return {
+        componentKind: componentKind,
+        componentName,
+        targetVersion,
+    };
+}
+/**
+ * The real, honest scope of this task's site-side rollback handling:
+ * validate the intent a signed, whitelisted `rollback` command carries, then
+ * hand it to a caller-supplied callback — never a claim that this package
+ * itself reverts installed code. No mechanism exists anywhere in this
+ * codebase today to revert a site's installed plugin/theme/CMS code to a
+ * prior version (no package-manager integration, no `@cogenta/plugins`
+ * uninstall/downgrade path) — that is a real, documented gap, not something
+ * papered over with a handler that pretends to act. `recordIntent` is where
+ * a real deployment wires whatever it actually has (an operator alert, a
+ * queued manual task, or — once real reversion infrastructure exists — the
+ * genuine mechanism) without this package inventing one it cannot back.
+ */
+export function createRollbackIntentHandler(recordIntent) {
+    return async (payload) => {
+        const intent = parseRollbackPayload(payload);
+        await recordIntent(intent);
+    };
+}
+//# sourceMappingURL=rollback-handler.js.map

package/dist/agent/rollback-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-handler.js","sourceRoot":"","sources":["../../src/agent/rollback-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAgB5C,MAAM,eAAe,GAAsC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;AAErF,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,4CAA4C;YACrD,IAAI,EAAE,0FAA0F;YAChG,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAA;IACjD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,CAAA;IAC9D,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAuC,CAAC;QAClE,OAAO,aAAa,KAAK,QAAQ;QACjC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;QAC3B,OAAO,aAAa,KAAK,QAAQ;QACjC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAC3B,CAAC;QACD,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,8DAA8D;YACvE,IAAI,EAAE,mGAAmG;YACzG,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,aAAuC;QACtD,aAAa;QACb,aAAa;KACd,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAuD;IAEvD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,YAAY,CAAC,MAAM,CAAC,CAAA;IAC5B,CAAC,CAAA;AACH,CAAC"}

package/dist/agent/sign.d.ts

@@ -0,0 +1,18 @@
+import type { TelemetryPayload } from './types.js';
+export interface SignedTelemetry {
+    readonly payload: TelemetryPayload;
+    /** Base64 Ed25519 signature over the payload's canonical content — `@cogenta/plugins`' generalized signing primitive (task 9/12), the same one this project's control-plane pairing already uses (L8 task 1). */
+    readonly signatureBase64: string;
+}
+/**
+ * Signs a telemetry payload with the site's own paired private key
+ * (`@cogenta/fleet`'s enrollment, task 1) before it ever leaves the
+ * process. Runs the real, defense-in-depth forbidden-field check first —
+ * signing a payload does not make an accidentally-forbidden field safe to
+ * send, so this refuses to sign one at all rather than signing something
+ * that then has to be caught later, closer to the network boundary.
+ */
+export declare function signTelemetryPayload(payload: TelemetryPayload, sitePrivateKeyBase64: string): SignedTelemetry;
+/** Verifies a signed telemetry payload against the site's registered public key — the control plane's real half of this primitive (ingestion is task 3's job, not this one's). */
+export declare function verifyTelemetrySignature(signed: SignedTelemetry, sitePublicKeyBase64: string): boolean;
+//# sourceMappingURL=sign.d.ts.map

package/dist/agent/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/agent/sign.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;IAClC,iNAAiN;IACjN,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,oBAAoB,EAAE,MAAM,GAC3B,eAAe,CAGjB;AAED,kLAAkL;AAClL,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAET"}

package/dist/agent/sign.js

@@ -0,0 +1,19 @@
+import { signContent, verifyContentSignature } from '@cogenta/plugins';
+import { assertNoForbiddenFields } from './assert.js';
+/**
+ * Signs a telemetry payload with the site's own paired private key
+ * (`@cogenta/fleet`'s enrollment, task 1) before it ever leaves the
+ * process. Runs the real, defense-in-depth forbidden-field check first —
+ * signing a payload does not make an accidentally-forbidden field safe to
+ * send, so this refuses to sign one at all rather than signing something
+ * that then has to be caught later, closer to the network boundary.
+ */
+export function signTelemetryPayload(payload, sitePrivateKeyBase64) {
+    assertNoForbiddenFields(payload);
+    return { payload, signatureBase64: signContent(payload, sitePrivateKeyBase64) };
+}
+/** Verifies a signed telemetry payload against the site's registered public key — the control plane's real half of this primitive (ingestion is task 3's job, not this one's). */
+export function verifyTelemetrySignature(signed, sitePublicKeyBase64) {
+    return verifyContentSignature(signed.payload, signed.signatureBase64, sitePublicKeyBase64);
+}
+//# sourceMappingURL=sign.js.map

package/dist/agent/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/agent/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AASrD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyB,EACzB,oBAA4B;IAE5B,uBAAuB,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAA;AACjF,CAAC;AAED,kLAAkL;AAClL,MAAM,UAAU,wBAAwB,CACtC,MAAuB,EACvB,mBAA2B;IAE3B,OAAO,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;AAC5F,CAAC"}

package/dist/agent/types.d.ts

@@ -0,0 +1,86 @@
+import type { CruxMetrics, Urgency } from '@cogenta/agents-builtin';
+/**
+ * What a site is allowed to send to the control plane — the closed
+ * enumeration of "## Ce qui remonte, et ce qui ne remonte pas"
+ * (`docs/lots/L8-flotte.md`), and nothing else. No field on this type, or
+ * any type it references, can hold content, media, visitor PII, an API key,
+ * agent memory, or a raw log line — that is a property of the SHAPE, not a
+ * filter applied after the fact: there is no `content`/`media`/`raw`/`logs`
+ * key anywhere on this type for a caller to even attempt to fill in.
+ *
+ * Some fields are wired to a real, existing data source in this codebase
+ * today (see each field's own doc comment); others are a real, honest SHAPE
+ * with no data source built yet — `docs/lots/L8-flotte.md`'s own "remonte"
+ * list names them regardless, and building the shape now means a later
+ * task's real data source slots in without a breaking payload change.
+ */
+export interface TelemetryPayload {
+    readonly siteId: string;
+    readonly collectedAt: string;
+    /** Shape only — no real CMS/plugin/theme version inventory exists anywhere in this codebase yet (`cogenta doctor` reports only the Node runtime version). */
+    readonly installedVersions: InstalledVersions;
+    /**
+     * A SHA-256 hex digest of the site's real SBOM (`buildSbom`,
+     * `@cogenta/agents-builtin`'s security agent) — the fingerprint travels,
+     * never the SBOM's actual dependency list, which would itself be more
+     * detail than "## Ce qui remonte" asks for.
+     */
+    readonly sbomFingerprint: string;
+    /** Real — one entry per open CVE the security agent's real OSV/EPSS pipeline (`assessExploitability`) has assessed for this site's dependencies. */
+    readonly openCves: readonly OpenCveSummary[];
+    /** Real — the performance agent's real, aggregated CrUX field-data metrics (`CruxMetrics`, `@cogenta/agents-builtin`). `null` when no CrUX data exists for this site (not enough real-user traffic — not an error). */
+    readonly coreWebVitalsAggregate: CruxMetrics | null;
+    /** Shape only — no uptime/availability monitoring exists anywhere in this codebase yet. */
+    readonly availability: AvailabilitySummary;
+    /** Shape only — no real backup dump/restore mechanism exists anywhere in this codebase yet (confirmed absent, L9 task 9's own honest CLI scoping). */
+    readonly backups: BackupSummary;
+    /** Shape only, and nullable — no TLS certificate expiry check exists anywhere in this codebase yet. */
+    readonly certificateExpiry: CertificateExpirySummary | null;
+    /**
+     * Real — `count` from `@cogenta/auth`'s real `UserStore.list()` filtered
+     * to admin-role users; `mfaEnabledCount` from `CredentialStore.kinds()`
+     * reporting a real second factor (`totp` or `webauthn`, never `password`
+     * alone) for each. Never an identity — no email, no user id, only counts.
+     */
+    readonly adminAccounts: AdminAccountsSummary;
+    /** Shape only — no structured error-aggregation sink exists anywhere in this codebase yet (the logger is real and structured, but nothing aggregates its output for fleet reporting). */
+    readonly aggregatedErrors: AggregatedErrorsSummary;
+}
+export interface InstalledVersions {
+    readonly cms: string | null;
+    readonly plugins: readonly {
+        readonly name: string;
+        readonly version: string;
+    }[];
+    readonly themes: readonly {
+        readonly name: string;
+        readonly version: string;
+    }[];
+}
+export interface OpenCveSummary {
+    readonly id: string;
+    readonly urgency: Urgency;
+    readonly status: 'open' | 'patched' | 'ignored';
+}
+export interface AvailabilitySummary {
+    /** 0..1 over the reporting window. `null` when no measurement exists yet. */
+    readonly uptimeRatio: number | null;
+}
+export interface BackupSummary {
+    readonly lastBackupAt: string | null;
+    readonly lastResult: 'success' | 'failure' | 'unknown';
+}
+export interface CertificateExpirySummary {
+    readonly domain: string;
+    readonly expiresAt: string;
+}
+export interface AdminAccountsSummary {
+    readonly count: number;
+    readonly mfaEnabledCount: number;
+}
+export interface AggregatedErrorsSummary {
+    readonly count: number;
+    readonly windowStart: string;
+    readonly windowEnd: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/agent/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B,6JAA6J;IAC7J,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAE7C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,oJAAoJ;IACpJ,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;IAE5C,uNAAuN;IACvN,QAAQ,CAAC,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAA;IAEnD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;IAE1C,sJAAsJ;IACtJ,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAE/B,uGAAuG;IACvG,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAE3D;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAE5C,yLAAyL;IACzL,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB,CAAA;CACnD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAChF,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAChF;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CACvD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B"}

package/dist/agent/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/agent/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":""}

package/dist/alerts/alerts.d.ts

@@ -0,0 +1,42 @@
+import { type AlertChannelMessage } from '@cogenta/channels';
+import type { SiteRisk } from '../control/risk.js';
+import type { TelemetrySnapshot } from '../control/state.js';
+import type { SiteRegistration } from '../enrollment/store.js';
+import type { CampaignRecord } from '../rollout/campaign.js';
+import type { AlertConditionStore } from './conditions.js';
+/**
+ * A site crossing into `critical` risk (task 5's real `computeSiteRisk`) —
+ * "un site avec une CVE critique passe devant" on the dashboard is the same
+ * real signal an operator needs pushed to them immediately, not only seen
+ * next time they open it.
+ */
+export declare function detectCriticalRiskAlert(risk: SiteRisk): AlertChannelMessage | null;
+/**
+ * A rollout campaign transitioning to `halted` (task 7's real
+ * `CampaignRecord`) — "un échec arrête toute la campagne" is exactly the
+ * kind of event an operator needs to know about the moment it happens, not
+ * discover by noticing an update never finished.
+ */
+export declare function detectCampaignHaltedAlert(campaign: CampaignRecord, siteNameById: ReadonlyMap<string, string>): AlertChannelMessage | null;
+export declare function detectSiteSilentAlert(site: SiteRegistration, latestSnapshot: TelemetrySnapshot | null, now?: () => number): AlertChannelMessage | null;
+/**
+ * Wraps any detection function with the real de-duplication layer
+ * (`./conditions.js`): the message is only returned — and thus only ever
+ * sent — on the check where the condition genuinely transitions from
+ * inactive to active. Every subsequent check while it remains active
+ * returns `null`, even though the underlying condition still holds.
+ */
+export declare function raiseIfNew(conditionStore: AlertConditionStore, siteId: string, conditionType: 'critical-risk' | 'campaign-halted' | 'site-silent', message: AlertChannelMessage | null, now?: () => number): Promise<AlertChannelMessage | null>;
+/**
+ * The real dispatch integration point — a structural interface, never a
+ * hard dependency on any specific `@cogenta/channels` adapter instance
+ * (matches `../reporting/report.js`'s own boundary: depend on the real
+ * message-CONSTRUCTOR types, never on a live adapter). No live control-plane
+ * deployment exists anywhere in this lot; a real deployment plugs a real
+ * `ChannelAdapter.send` (or a registry's dispatch function) in here.
+ */
+export interface AlertSender {
+    send(message: AlertChannelMessage): Promise<void>;
+}
+export declare function dispatchAlert(sender: AlertSender, message: AlertChannelMessage): Promise<void>;
+//# sourceMappingURL=alerts.d.ts.map

package/dist/alerts/alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/alerts/alerts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAc,MAAM,mBAAmB,CAAA;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAa1D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,GAAG,mBAAmB,GAAG,IAAI,CAUlF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,mBAAmB,GAAG,IAAI,CAY5B;AAmBD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,cAAc,EAAE,iBAAiB,GAAG,IAAI,EACxC,GAAG,GAAE,MAAM,MAAiB,GAC3B,mBAAmB,GAAG,IAAI,CAgB5B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,cAAc,EAAE,mBAAmB,EACnC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,eAAe,GAAG,iBAAiB,GAAG,aAAa,EAClE,OAAO,EAAE,mBAAmB,GAAG,IAAI,EACnC,GAAG,CAAC,EAAE,MAAM,MAAM,GACjB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAOrC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClD;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAEf"}