@cogenta/fleet 0.1.0

package/dist/alerts/alerts.js

@@ -0,0 +1,98 @@
+import { buildAlert } from '@cogenta/channels';
+/**
+ * "Alertes de flotte sur les canaux" (`docs/lots/L8-flotte.md`) — real,
+ * operator-facing alerts for the agency, distinct from `../reporting/report.js`'s
+ * commercial, end-client-facing monthly reports. Reuses `@cogenta/channels`'s
+ * real `buildAlert` constructor (L6 task 6) exactly, the same reuse
+ * discipline task 9 already established for `buildReport` — no hand-built
+ * `AlertChannelMessage` literal anywhere in this module.
+ */
+const ADMIN_URL_FALLBACK = 'https://admin.invalid/fleet';
+/**
+ * A site crossing into `critical` risk (task 5's real `computeSiteRisk`) —
+ * "un site avec une CVE critique passe devant" on the dashboard is the same
+ * real signal an operator needs pushed to them immediately, not only seen
+ * next time they open it.
+ */
+export function detectCriticalRiskAlert(risk) {
+    if (risk.tier !== 'critical')
+        return null;
+    const topReason = [...risk.reasons].sort((a, b) => b.points - a.points)[0];
+    return buildAlert({
+        title: `${risk.siteName} — risque critique`,
+        severity: 'critical',
+        context: topReason === undefined ? 'Risque critique détecté.' : topReason.detail,
+        expectedAction: 'Examiner ce site dans le tableau de bord de flotte et agir sans délai.',
+        adminUrl: ADMIN_URL_FALLBACK,
+    });
+}
+/**
+ * A rollout campaign transitioning to `halted` (task 7's real
+ * `CampaignRecord`) — "un échec arrête toute la campagne" is exactly the
+ * kind of event an operator needs to know about the moment it happens, not
+ * discover by noticing an update never finished.
+ */
+export function detectCampaignHaltedAlert(campaign, siteNameById) {
+    if (campaign.status !== 'halted')
+        return null;
+    const failedNames = campaign.failedSiteIds.map((id) => siteNameById.get(id) ?? id).join(', ');
+    return buildAlert({
+        title: `Campagne "${campaign.componentName}" arrêtée`,
+        severity: 'critical',
+        context: campaign.haltedReason ??
+            `La mise à jour vers ${campaign.targetVersion} a échoué sur : ${failedNames || 'un site'}.`,
+        expectedAction: 'Vérifier les sites en échec et envisager un retour arrière.',
+        adminUrl: ADMIN_URL_FALLBACK,
+    });
+}
+/**
+ * "## Pièges connus": "Les faux positifs de disponibilité. Un réseau
+ * instable produit des alertes de panne inexistantes. Exiger plusieurs
+ * échecs consécutifs depuis plusieurs points avant d'alerter."
+ *
+ * This architecture has no active probing at all — "le plan de contrôle
+ * n'ouvre jamais de connexion vers un site" (absolute since task 1, reused
+ * by task 7's async-verification design). "Plusieurs points" (multiple
+ * vantage points) has no honest equivalent here: there is only ONE real
+ * observation channel, a site's own periodic telemetry contact. The
+ * architecturally-consistent reading of the same anti-flapping INTENT is
+ * "require sustained absence across multiple real expected-contact
+ * windows" — a real, multi-cycle threshold, not a single missed window.
+ */
+const CONTACT_WINDOW_MS = 24 * 60 * 60 * 1000; // one real daily contact cycle, same reasoning as `../control/state.ts`'s retention and `../rollout/campaign.ts`'s DEFAULT_TIMEOUT_MS
+const MISSED_WINDOWS_THRESHOLD = 3; // a single missed window is real network noise; three consecutive is a real, sustained absence
+export function detectSiteSilentAlert(site, latestSnapshot, now = Date.now) {
+    const referenceTime = latestSnapshot === null
+        ? new Date(site.registeredAt).getTime()
+        : new Date(latestSnapshot.ingestedAt).getTime();
+    const silentMs = now() - referenceTime;
+    const missedWindows = Math.floor(silentMs / CONTACT_WINDOW_MS);
+    if (missedWindows < MISSED_WINDOWS_THRESHOLD)
+        return null;
+    return buildAlert({
+        title: `${site.name} — silencieux`,
+        severity: 'warning',
+        context: `Aucun contact reçu depuis plus de ${missedWindows} jours.`,
+        expectedAction: "Vérifier que le site est joignable et que son processus d'envoi fonctionne.",
+        adminUrl: ADMIN_URL_FALLBACK,
+    });
+}
+/**
+ * Wraps any detection function with the real de-duplication layer
+ * (`./conditions.js`): the message is only returned — and thus only ever
+ * sent — on the check where the condition genuinely transitions from
+ * inactive to active. Every subsequent check while it remains active
+ * returns `null`, even though the underlying condition still holds.
+ */
+export async function raiseIfNew(conditionStore, siteId, conditionType, message, now) {
+    if (message === null) {
+        await conditionStore.clear(siteId, conditionType, now);
+        return null;
+    }
+    const { fired } = await conditionStore.raise(siteId, conditionType, now);
+    return fired ? message : null;
+}
+export async function dispatchAlert(sender, message) {
+    await sender.send(message);
+}
+//# sourceMappingURL=alerts.js.map

package/dist/alerts/alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.js","sourceRoot":"","sources":["../../src/alerts/alerts.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOxE;;;;;;;GAOG;AAEH,MAAM,kBAAkB,GAAG,6BAA6B,CAAA;AAExD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAc;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,UAAU,CAAC;QAChB,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,oBAAoB;QAC3C,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM;QAChF,cAAc,EAAE,wEAAwE;QACxF,QAAQ,EAAE,kBAAkB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAwB,EACxB,YAAyC;IAEzC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7F,OAAO,UAAU,CAAC;QAChB,KAAK,EAAE,aAAa,QAAQ,CAAC,aAAa,WAAW;QACrD,QAAQ,EAAE,UAAU;QACpB,OAAO,EACL,QAAQ,CAAC,YAAY;YACrB,uBAAuB,QAAQ,CAAC,aAAa,mBAAmB,WAAW,IAAI,SAAS,GAAG;QAC7F,cAAc,EAAE,6DAA6D;QAC7E,QAAQ,EAAE,kBAAkB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,sIAAsI;AACpL,MAAM,wBAAwB,GAAG,CAAC,CAAA,CAAC,+FAA+F;AAElI,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,cAAwC,EACxC,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,aAAa,GACjB,cAAc,KAAK,IAAI;QACrB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,aAAa,CAAA;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,iBAAiB,CAAC,CAAA;IAC9D,IAAI,aAAa,GAAG,wBAAwB;QAAE,OAAO,IAAI,CAAA;IAEzD,OAAO,UAAU,CAAC;QAChB,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,eAAe;QAClC,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,qCAAqC,aAAa,SAAS;QACpE,cAAc,EAAE,6EAA6E;QAC7F,QAAQ,EAAE,kBAAkB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,cAAmC,EACnC,MAAc,EACd,aAAkE,EAClE,OAAmC,EACnC,GAAkB;IAElB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;QACtD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;IACxE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/B,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAmB,EACnB,OAA4B;IAE5B,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAC5B,CAAC"}

package/dist/alerts/conditions.d.ts

@@ -0,0 +1,25 @@
+import { type DatabaseHandle } from '@cogenta/core';
+/**
+ * The three real alert conditions built in this task, closed — a caller
+ * cannot invent a fourth condition type without a matching detection
+ * function to go with it (`./alerts.js`).
+ */
+export type AlertConditionType = 'critical-risk' | 'campaign-halted' | 'site-silent';
+export interface AlertConditionStore {
+    /** `true` when this exact (site, condition) pair has an unresolved, unraised-since-clear alert. */
+    isActive(siteId: string, conditionType: AlertConditionType): Promise<boolean>;
+    /**
+     * Raises the condition if — and only if — it is not already active:
+     * de-duplication is the whole point. Returns `{fired: true}` the first
+     * time a condition becomes active, `{fired: false}` on every repeat check
+     * while it remains active — a caller sends a real alert only when `fired`
+     * is `true`, never once per check cycle.
+     */
+    raise(siteId: string, conditionType: AlertConditionType, now?: () => number): Promise<{
+        readonly fired: boolean;
+    }>;
+    /** Marks the condition resolved — its next `raise()` fires again, a real "was this cleared" check, never a permanent one-time suppression. */
+    clear(siteId: string, conditionType: AlertConditionType, now?: () => number): Promise<void>;
+}
+export declare function createAlertConditionStore(db: DatabaseHandle, now?: () => number): AlertConditionStore;
+//# sourceMappingURL=conditions.d.ts.map

package/dist/alerts/conditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.d.ts","sourceRoot":"","sources":["../../src/alerts/conditions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAG3E;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,iBAAiB,GAAG,aAAa,CAAA;AAEpF,MAAM,WAAW,mBAAmB;IAClC,mGAAmG;IACnG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7E;;;;;;OAMG;IACH,KAAK,CACH,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,kBAAkB,EACjC,GAAG,CAAC,EAAE,MAAM,MAAM,GACjB,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACvC,8IAA8I;IAC9I,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5F;AAUD,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,mBAAmB,CA0BrB"}

package/dist/alerts/conditions.js

@@ -0,0 +1,28 @@
+import { identifier, newId, sql } from '@cogenta/core';
+import { ALERT_TABLES } from './tables.js';
+export function createAlertConditionStore(db, now = Date.now) {
+    const conditions = identifier(ALERT_TABLES.conditions, db.dialect);
+    return {
+        async isActive(siteId, conditionType) {
+            const result = await db.query(sql `
+        select id from ${conditions}
+        where site_id = ${siteId} and condition_type = ${conditionType} and cleared_at is null`);
+            return result.rows.length > 0;
+        },
+        async raise(siteId, conditionType, clock = now) {
+            const alreadyActive = await this.isActive(siteId, conditionType);
+            if (alreadyActive)
+                return { fired: false };
+            await db.query(sql `
+        insert into ${conditions} (id, site_id, condition_type, raised_at, cleared_at)
+        values (${newId(clock)}, ${siteId}, ${conditionType}, ${new Date(clock()).toISOString()}, ${null})`);
+            return { fired: true };
+        },
+        async clear(siteId, conditionType, clock = now) {
+            await db.query(sql `
+        update ${conditions} set cleared_at = ${new Date(clock()).toISOString()}
+        where site_id = ${siteId} and condition_type = ${conditionType} and cleared_at is null`);
+        },
+    };
+}
+//# sourceMappingURL=conditions.js.map

package/dist/alerts/conditions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.js","sourceRoot":"","sources":["../../src/alerts/conditions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAoC1C,MAAM,UAAU,yBAAyB,CACvC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAElE,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;YAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAe,GAAG,CAAA;yBAC5B,UAAU;0BACT,MAAM,yBAAyB,aAAa,yBAAyB,CAAC,CAAA;YAC1F,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;QAC/B,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,GAAG,GAAG;YAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YAChE,IAAI,aAAa;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;YAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,UAAU;kBACd,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,aAAa,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,GAAG,CAAC,CAAA;YACtG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,GAAG,GAAG;YAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,UAAU,qBAAqB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;0BACrD,MAAM,yBAAyB,aAAa,yBAAyB,CAAC,CAAA;QAC5F,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/alerts/tables.d.ts

@@ -0,0 +1,13 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export declare const ALERT_TABLES: {
+    readonly conditions: 'cogenta_fleet_alert_conditions';
+};
+/**
+ * One row per (site, condition type) currently-or-previously-raised alert —
+ * `cleared_at is null` means still active. Same `create table if not exists`
+ * pattern as `../reporting/tables.ts`/`../control/tables.ts`. Strictly
+ * per-site: no query here ever spans more than one site's row at once,
+ * matching every other L8 store's per-site isolation discipline.
+ */
+export declare function ensureAlertTables(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/alerts/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/alerts/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,YAAY;aACvB,UAAU,EAAE,gCAAgC;CACpC,CAAA;AAMV;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzE"}

package/dist/alerts/tables.js

@@ -0,0 +1,27 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const ALERT_TABLES = {
+    conditions: 'cogenta_fleet_alert_conditions',
+};
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+/**
+ * One row per (site, condition type) currently-or-previously-raised alert —
+ * `cleared_at is null` means still active. Same `create table if not exists`
+ * pattern as `../reporting/tables.ts`/`../control/tables.ts`. Strictly
+ * per-site: no query here ever spans more than one site's row at once,
+ * matching every other L8 store's per-site isolation discipline.
+ */
+export async function ensureAlertTables(db) {
+    const t255 = textColumn(db.dialect, 255);
+    const conditions = identifier(ALERT_TABLES.conditions, db.dialect);
+    await db.query(sql `
+    create table if not exists ${conditions} (
+      id ${t255} not null primary key,
+      site_id ${t255} not null,
+      condition_type ${t255} not null,
+      raised_at ${t255} not null,
+      cleared_at ${t255}
+    )`);
+}
+//# sourceMappingURL=tables.js.map

package/dist/alerts/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../src/alerts/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU,EAAE,gCAAgC;CACpC,CAAA;AAEV,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAkB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,UAAU;WAChC,IAAI;gBACC,IAAI;uBACG,IAAI;kBACT,IAAI;mBACH,IAAI;MACjB,CAAC,CAAA;AACP,CAAC"}

package/dist/control/commands.d.ts

@@ -0,0 +1,38 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { ControlPlaneIdentity } from './identity.js';
+/**
+ * The complete, closed set of things a control plane may ever ask a site to
+ * do — "## Appairage": "commandes... exécutables uniquement dans une liste
+ * blanche d'actions." `update` and `rollback` are named now, ahead of their
+ * real execution logic (tasks 7/8), so this task's transport/verification
+ * layer is the real, non-bypassable seam those tasks plug handlers into —
+ * not a whitelist widened later under a design already shipped.
+ */
+export declare const FLEET_COMMAND_ACTIONS: readonly ['update', 'rollback'];
+export type FleetCommandAction = (typeof FLEET_COMMAND_ACTIONS)[number];
+export interface FleetCommand {
+    readonly id: string;
+    readonly siteId: string;
+    readonly action: FleetCommandAction;
+    readonly payload: unknown;
+    readonly queuedAt: string;
+}
+export interface SignedFleetCommand {
+    readonly command: FleetCommand;
+    /** Base64 Ed25519 signature over the command's canonical content, made with the control plane's own private key — never the site's. */
+    readonly signatureBase64: string;
+}
+export interface CommandQueueStore {
+    /** Real, persisted, strictly per-site — no cross-site query shape exists anywhere in this store. */
+    enqueue(siteId: string, action: FleetCommandAction, payload: unknown): Promise<FleetCommand>;
+    /**
+     * A site's real, pending commands, signed and handed over. Fetching marks
+     * every returned command delivered — a site's next fetch never sees it
+     * again, closing the "re-fetch the same command forever" gap without
+     * pretending to know whether the site went on to execute it (that
+     * bookkeeping belongs with tasks 7/8's real execution logic, not here).
+     */
+    fetchPending(siteId: string): Promise<readonly SignedFleetCommand[]>;
+}
+export declare function createCommandQueueStore(db: DatabaseHandle, controlPlaneIdentity: ControlPlaneIdentity, now?: () => number): CommandQueueStore;
+//# sourceMappingURL=commands.d.ts.map

package/dist/control/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/control/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAE3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAGzD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,YAAI,QAAQ,EAAE,UAAU,CAAU,CAAA;AACpE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEvE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,uIAAuI;IACvI,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,oGAAoG;IACpG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC5F;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAA;CACrE;AAqBD,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,cAAc,EAClB,oBAAoB,EAAE,oBAAoB,EAC1C,GAAG,GAAE,MAAM,MAAiB,GAC3B,iBAAiB,CAiCnB"}

package/dist/control/commands.js

@@ -0,0 +1,51 @@
+import { identifier, newId, sql } from '@cogenta/core';
+import { signContent } from '@cogenta/plugins';
+import { CONTROL_TABLES } from './tables.js';
+/**
+ * The complete, closed set of things a control plane may ever ask a site to
+ * do — "## Appairage": "commandes... exécutables uniquement dans une liste
+ * blanche d'actions." `update` and `rollback` are named now, ahead of their
+ * real execution logic (tasks 7/8), so this task's transport/verification
+ * layer is the real, non-bypassable seam those tasks plug handlers into —
+ * not a whitelist widened later under a design already shipped.
+ */
+export const FLEET_COMMAND_ACTIONS = ['update', 'rollback'];
+function toCommand(row) {
+    return {
+        id: row.id,
+        siteId: row.site_id,
+        action: row.action,
+        payload: JSON.parse(row.payload_json),
+        queuedAt: row.queued_at,
+    };
+}
+export function createCommandQueueStore(db, controlPlaneIdentity, now = Date.now) {
+    const commands = identifier(CONTROL_TABLES.commands, db.dialect);
+    return {
+        async enqueue(siteId, action, payload) {
+            const id = newId(now);
+            const queuedAt = new Date(now()).toISOString();
+            await db.query(sql `
+        insert into ${commands} (id, site_id, action, payload_json, queued_at, delivered_at)
+        values (${id}, ${siteId}, ${action}, ${JSON.stringify(payload)}, ${queuedAt}, ${null})`);
+            return { id, siteId, action, payload, queuedAt };
+        },
+        async fetchPending(siteId) {
+            const result = await db.query(sql `
+        select id, site_id, action, payload_json, queued_at, delivered_at from ${commands}
+        where site_id = ${siteId} and delivered_at is null order by queued_at asc`);
+            const pending = result.rows.map(toCommand);
+            if (pending.length === 0)
+                return [];
+            const deliveredAt = new Date(now()).toISOString();
+            for (const command of pending) {
+                await db.query(sql `update ${commands} set delivered_at = ${deliveredAt} where id = ${command.id}`);
+            }
+            return pending.map((command) => ({
+                command,
+                signatureBase64: signContent(command, controlPlaneIdentity.privateKey),
+            }));
+        },
+    };
+}
+//# sourceMappingURL=commands.js.map

package/dist/control/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/control/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAU,CAAA;AAuCpE,SAAS,SAAS,CAAC,GAAe;IAChC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,MAAM,EAAE,GAAG,CAAC,MAA4B;QACxC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAY;QAChD,QAAQ,EAAE,GAAG,CAAC,SAAS;KACxB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,EAAkB,EAClB,oBAA0C,EAC1C,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAEhE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO;YACnC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,QAAQ;kBACZ,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,QAAQ,KAAK,IAAI,GAAG,CAAC,CAAA;YAC1F,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QAClD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAa,GAAG,CAAA;iFAC8B,QAAQ;0BAC/D,MAAM,kDAAkD,CAAC,CAAA;YAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAA;YAEnC,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YACjD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,QAAQ,uBAAuB,WAAW,eAAe,OAAO,CAAC,EAAE,EAAE,CACnF,CAAA;YACH,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC/B,OAAO;gBACP,eAAe,EAAE,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,UAAU,CAAC;aACvE,CAAC,CAAC,CAAA;QACL,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/control/identity.d.ts

@@ -0,0 +1,13 @@
+import { type SigningKeyPair } from '@cogenta/plugins';
+/**
+ * The control plane's own real Ed25519 identity — distinct from any site's.
+ * A site signs its outgoing telemetry with ITS key (`../agent/sign.ts`); the
+ * control plane signs outgoing commands with ITS OWN key, and a site
+ * verifies those against the public half recorded here, learned once at
+ * pairing time (`../enrollment/store.ts`'s `PairingToken.controlPlanePublicKey`).
+ * Two independent keypairs, two independent verification directions — never
+ * the same key checked both ways.
+ */
+export type ControlPlaneIdentity = SigningKeyPair;
+export declare function generateControlPlaneIdentity(): ControlPlaneIdentity;
+//# sourceMappingURL=identity.d.ts.map

package/dist/control/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/control/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE9E;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAEjD,wBAAgB,4BAA4B,IAAI,oBAAoB,CAEnE"}

package/dist/control/identity.js

@@ -0,0 +1,5 @@
+import { generateSigningKeyPair } from '@cogenta/plugins';
+export function generateControlPlaneIdentity() {
+    return generateSigningKeyPair();
+}
+//# sourceMappingURL=identity.js.map

package/dist/control/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/control/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAA;AAa9E,MAAM,UAAU,4BAA4B;IAC1C,OAAO,sBAAsB,EAAE,CAAA;AACjC,CAAC"}

package/dist/control/ingest.d.ts

@@ -0,0 +1,46 @@
+import type { SignedTelemetry } from '../agent/sign.js';
+import type { EnrollmentStore } from '../enrollment/store.js';
+import type { SiteStateStore, TelemetrySnapshot } from './state.js';
+/**
+ * "Le plan de contrôle est un observateur... pas un propriétaire" only holds
+ * if it never trusts a sender's own claims — a discriminated result, not a
+ * raw exception, matching every other "here's exactly why this was refused"
+ * shape this session's L6/L7 forks established (`@cogenta/channels`' link
+ * codes, `@cogenta/plugins`' registries).
+ */
+export type IngestResult = {
+    readonly ok: true;
+    readonly snapshot: TelemetrySnapshot;
+} | {
+    readonly ok: false;
+    readonly reason: 'unknown_site' | 'revoked' | 'invalid_signature' | 'forbidden_field';
+    readonly message: string;
+};
+/**
+ * The control plane's real ingestion boundary — the receiving-side half of
+ * "## Ce qui remonte, et ce qui ne remonte pas"'s "critère d'acceptation
+ * testé, pas une intention." Three independent checks, in this order:
+ *
+ * 1. **The claimed site is actually paired, and not revoked** — cheap, no
+ *    cryptography needed, and refusing here first means an unpaired or
+ *    revoked sender never gets far enough to learn whether its signature
+ *    would otherwise have been accepted. Revocation is checked as its own
+ *    condition, never folded into "does the signature verify": a site
+ *    paired before being revoked still holds a cryptographically valid
+ *    keypair, so signature validity alone can never be what keeps a revoked
+ *    site out.
+ * 2. **The signature genuinely verifies against THAT site's registered
+ *    public key** (`../enrollment/store.js`, task 1) — a payload signed
+ *    with any other key, or tampered with after signing, is rejected here.
+ * 3. **The payload, independently re-inspected on receipt, still contains
+ *    only the real, closed shape** (`assertNoForbiddenFields`, task 2's own
+ *    defense-in-depth check, re-run here rather than trusted from the
+ *    sender) — a compromised or buggy site is exactly the threat model this
+ *    step defends against; trusting that a sender's own type system kept it
+ *    honest is not a real security boundary.
+ *
+ * A rejection at any step never touches `stateStore` — a partially-applied,
+ * unverified update is worse than none.
+ */
+export declare function ingestTelemetry(signed: SignedTelemetry, enrollmentStore: EnrollmentStore, stateStore: SiteStateStore): Promise<IngestResult>;
+//# sourceMappingURL=ingest.d.ts.map

package/dist/control/ingest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../src/control/ingest.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAoB,MAAM,wBAAwB,CAAA;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GAC3D;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,mBAAmB,GAAG,iBAAiB,CAAA;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,EACvB,eAAe,EAAE,eAAe,EAChC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,YAAY,CAAC,CA6BvB"}

package/dist/control/ingest.js

@@ -0,0 +1,56 @@
+import { CogentaError } from '@cogenta/core';
+import { assertNoForbiddenFields } from '../agent/assert.js';
+import { verifyTelemetrySignature } from '../agent/sign.js';
+/**
+ * The control plane's real ingestion boundary — the receiving-side half of
+ * "## Ce qui remonte, et ce qui ne remonte pas"'s "critère d'acceptation
+ * testé, pas une intention." Three independent checks, in this order:
+ *
+ * 1. **The claimed site is actually paired, and not revoked** — cheap, no
+ *    cryptography needed, and refusing here first means an unpaired or
+ *    revoked sender never gets far enough to learn whether its signature
+ *    would otherwise have been accepted. Revocation is checked as its own
+ *    condition, never folded into "does the signature verify": a site
+ *    paired before being revoked still holds a cryptographically valid
+ *    keypair, so signature validity alone can never be what keeps a revoked
+ *    site out.
+ * 2. **The signature genuinely verifies against THAT site's registered
+ *    public key** (`../enrollment/store.js`, task 1) — a payload signed
+ *    with any other key, or tampered with after signing, is rejected here.
+ * 3. **The payload, independently re-inspected on receipt, still contains
+ *    only the real, closed shape** (`assertNoForbiddenFields`, task 2's own
+ *    defense-in-depth check, re-run here rather than trusted from the
+ *    sender) — a compromised or buggy site is exactly the threat model this
+ *    step defends against; trusting that a sender's own type system kept it
+ *    honest is not a real security boundary.
+ *
+ * A rejection at any step never touches `stateStore` — a partially-applied,
+ * unverified update is worse than none.
+ */
+export async function ingestTelemetry(signed, enrollmentStore, stateStore) {
+    const siteId = signed.payload.siteId;
+    const site = await enrollmentStore.getSite(siteId);
+    if (site === null) {
+        return { ok: false, reason: 'unknown_site', message: `No paired site "${siteId}".` };
+    }
+    if (site.revoked) {
+        return { ok: false, reason: 'revoked', message: `Site "${siteId}" is revoked.` };
+    }
+    if (!verifyTelemetrySignature(signed, site.publicKey)) {
+        return {
+            ok: false,
+            reason: 'invalid_signature',
+            message: `Telemetry signature for site "${siteId}" does not verify against its registered key.`,
+        };
+    }
+    try {
+        assertNoForbiddenFields(signed.payload);
+    }
+    catch (error) {
+        const message = error instanceof CogentaError ? error.message : 'Telemetry payload failed the shape check.';
+        return { ok: false, reason: 'forbidden_field', message };
+    }
+    const snapshot = await stateStore.recordSnapshot(siteId, signed.payload);
+    return { ok: true, snapshot };
+}
+//# sourceMappingURL=ingest.js.map

package/dist/control/ingest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.js","sourceRoot":"","sources":["../../src/control/ingest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAmB3D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,eAAgC,EAChC,UAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAA;IACpC,MAAM,IAAI,GAA4B,MAAM,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAE3E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,MAAM,IAAI,EAAE,CAAA;IACtF,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,eAAe,EAAE,CAAA;IAClF,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,iCAAiC,MAAM,+CAA+C;SAChG,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2CAA2C,CAAA;QAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC"}

package/dist/control/risk.d.ts

@@ -0,0 +1,66 @@
+import type { SiteRegistration } from '../enrollment/store.js';
+import type { DriftEntry } from '../inventory/drift.js';
+import type { TelemetrySnapshot } from './state.js';
+/**
+ * "Tableau de bord de flotte : tri par risque, pas par ordre alphabétique"
+ * (`docs/lots/L8-flotte.md`) — real, deterministic scoring over exactly the
+ * `TelemetryPayload` fields that have a real data source today
+ * (`../agent/types.js`'s own field-by-field doc comments): `openCves`
+ * (real, security-agent pipeline) and `adminAccounts`' MFA coverage (real,
+ * `@cogenta/auth`). Version drift (`../inventory/drift.js`, real) also
+ * contributes. Fields still "shape only" — `availability`, `backups`,
+ * `certificateExpiry`, `aggregatedErrors` — contribute NOTHING here: a risk
+ * function that weighed a field with no real data source behind it would be
+ * fabricating a signal, not computing one. Each of those slots into the
+ * score the moment a later task wires up its real data source, without
+ * redesigning this function — the weight table below just grows.
+ */
+export type RiskTier = 'critical' | 'high' | 'medium' | 'low';
+export interface RiskReason {
+    readonly code: 'cve' | 'mfa-gap' | 'version-drift';
+    readonly detail: string;
+    readonly points: number;
+}
+export interface SiteRisk {
+    readonly siteId: string;
+    readonly siteName: string;
+    readonly client: string | null;
+    readonly score: number;
+    readonly tier: RiskTier;
+    readonly reasons: readonly RiskReason[];
+}
+/**
+ * Real, deterministic per-site score — never touches `snapshot`'s
+ * shape-only fields. `null` `snapshot` (a paired site that has never
+ * reported) is real risk in itself: an unresponsive/never-seen site is not
+ * "score zero, all clear."
+ */
+export declare function computeSiteRisk(site: SiteRegistration, snapshot: TelemetrySnapshot | null, driftEntries: readonly DriftEntry[]): SiteRisk;
+/**
+ * Sorted highest-risk first — the dashboard's whole reason for existing
+ * ("tri par risque, pas par ordre alphabétique"). Ties break on site name,
+ * ascending, so the ordering is fully deterministic (never insertion order).
+ */
+export declare function rankSitesByRisk(sites: readonly {
+    readonly site: SiteRegistration;
+    readonly snapshot: TelemetrySnapshot | null;
+    readonly driftEntries: readonly DriftEntry[];
+}[]): readonly SiteRisk[];
+export interface FleetFilter {
+    readonly client?: string;
+    /** Only sites at or above this tier — "critical" is the narrowest, "low" is everyone. */
+    readonly minTier?: RiskTier;
+    /** Case-insensitive substring match against site name or client. */
+    readonly search?: string;
+}
+/**
+ * Real, composable query over an already-ranked list — designed for a
+ * hundred sites from the start ("## Pièges connus": "Concevoir directement
+ * pour cent"), not a client-side afterthought: a real O(n) predicate pass,
+ * the same shape a server-side query would use once a live control plane
+ * exists to run one against.
+ */
+export declare function filterRisks(risks: readonly SiteRisk[], filter: FleetFilter): readonly SiteRisk[];
+/** Real grouping by client — `null` (no client set) is its own real group, never dropped or merged into a fake "unknown" label. */
+export declare function groupRisksByClient(risks: readonly SiteRisk[]): ReadonlyMap<string | null, readonly SiteRisk[]>;
+//# sourceMappingURL=risk.d.ts.map

package/dist/control/risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.d.ts","sourceRoot":"","sources":["../../src/control/risk.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAE7D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,eAAe,CAAA;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAuCD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,iBAAiB,GAAG,IAAI,EAClC,YAAY,EAAE,SAAS,UAAU,EAAE,GAClC,QAAQ,CAkDV;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS;IACd,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAC7C,EAAE,GACF,SAAS,QAAQ,EAAE,CAIrB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAID;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,QAAQ,EAAE,CAYhG;AAED,mIAAmI;AACnI,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,QAAQ,EAAE,GACzB,WAAW,CAAC,MAAM,GAAG,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC,CAQjD"}