@dharma-ai-labs/agent-fabric 0.2.110 → 0.2.112

package/dist/namedSessionService.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedSessionService.test.d.ts","sourceRoot":"","sources":["../src/namedSessionService.test.ts"],"names":[],"mappings":""}

package/dist/namedSessionService.test.js

@@ -0,0 +1,158 @@
+import assert from 'node:assert/strict';
+import { generateKeyPairSync, randomBytes, randomUUID } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { LocalVault } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { signCanonicalObject, validateContract } from '@dharma-ai-labs/agent-fabric-contracts';
+import { namedSessionPaths, namedSessionRequest, readNamedSession, runNamedSessionService, saveNamedSession } from './namedSessionService.js';
+test('durable named registration excludes credentials, grants and foreign shape', async () => {
+    const home = await mkdtemp(join(process.platform === 'darwin' ? '/tmp' : tmpdir(), 'dhr-'));
+    const identity = { organizationId: 'org_test', repositoryBindingId: randomUUID(), workspaceId: randomUUID(),
+        endpointId: randomUUID(), membershipId: randomUUID(), deviceId: randomUUID(), provider: 'codex' };
+    const good = { schema: 'dharma.named-session/v1', name: 'reviewer', bindingId: randomUUID(),
+        identity, maximumCostCents: 100, maximumTurnCostCents: 25, enabled: true };
+    await saveNamedSession(home, good);
+    for (const invalid of [{ ...good, grant: 'private-fixture' }, { ...good, maximumTurnCostCents: 101 },
+        { ...good, identity: { ...identity, credential: 'private-fixture' } },
+        { ...good, identity: { ...identity, membershipId: 'unbound-email' } }]) {
+        await assert.rejects(saveNamedSession(home, invalid), /registration_invalid/);
+        assert.deepEqual(await readNamedSession(home, 'reviewer'), good);
+    }
+    await writeFile(namedSessionPaths(home, 'reviewer').registration, JSON.stringify({ ...good, grant: 'private-fixture' }));
+    await assert.rejects(readNamedSession(home, 'reviewer'), /registration_invalid/);
+});
+test('named session socket paths remain bounded without relaxing identity validation', () => {
+    assert.throws(() => namedSessionPaths('/tmp/' + 'x'.repeat(100), 'reviewer'), /socket_path_too_long/);
+    assert.throws(() => namedSessionPaths('/tmp/dhr', '../foreign'), /name_invalid/);
+    assert.ok(Buffer.byteLength(namedSessionPaths('/tmp/dhr', 'reviewer').socket) <= 103);
+});
+test('named session serializes local work and signed peer questions with per-turn permissions', { skip: process.platform !== 'linux' }, async () => {
+    const home = await mkdtemp(join(tmpdir(), 'dharma-named-'));
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+    const identity = { organizationId: 'org_test', repositoryBindingId: randomUUID(), workspaceId: randomUUID(),
+        endpointId: randomUUID(), membershipId: randomUUID(), deviceId: randomUUID(), provider: 'codex' };
+    const binding = { schema: 'dharma.local-provider-session-binding/v1', ...identity,
+        bindingId: randomUUID(), owner: 'dharma_bridge', sessionId: randomUUID(), workspaceRoot: join(home, 'repo'),
+        createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 3600000).toISOString(), maximumProviderCostCents: 25 };
+    const registration = { schema: 'dharma.named-session/v1', name: 'implementer',
+        bindingId: binding.bindingId, identity, maximumCostCents: 100, maximumTurnCostCents: 25, enabled: true };
+    await mkdir(binding.workspaceRoot);
+    await saveNamedSession(home, registration);
+    assert.deepEqual(await readNamedSession(home, registration.name), registration);
+    const vault = await LocalVault.open({ root: join(home, 'vault'), masterKey: randomBytes(32) });
+    vault.saveProviderSessionBinding(binding);
+    const controller = new AbortController(), turns = [], replies = [];
+    const listeners = new Set();
+    let offered = false, accepted = false, active = 0, maximumActive = 0, closed = false, revision = 0;
+    const questionId = randomUUID(), taskId = randomUUID(), now = new Date();
+    const unsigned = { schema: 'dharma.session-question/v1', questionId, taskId,
+        organizationId: identity.organizationId, repositoryBindingId: identity.repositoryBindingId,
+        source: { workspaceId: randomUUID(), endpointId: randomUUID(), membershipId: randomUUID(), deviceId: randomUUID() },
+        target: { workspaceId: identity.workspaceId, endpointId: identity.endpointId, membershipId: identity.membershipId,
+            deviceId: identity.deviceId, bindingId: binding.bindingId, provider: 'codex' },
+        category: 'code-review', question: 'What is a logical job?',
+        authority: { mode: 'read_only', readPaths: ['.'], network: 'deny', maximumProviderCostCents: 25 },
+        createdAt: now.toISOString(), expiresAt: new Date(now.getTime() + 300000).toISOString(),
+        nonce: randomUUID(), signerKeyVersion: 'test-v1' };
+    const question = { ...unsigned, signature: signCanonicalObject(unsigned, privateKey) };
+    const transport = {
+        onToolCall() { return () => { }; },
+        onNotification(listener) { listeners.add(listener); return () => { listeners.delete(listener); }; },
+        async close() { closed = true; },
+        async request(method, params) {
+            if (method === 'permissionProfile/list')
+                return { data: ['dharma_bridge', 'dharma_work'].map(id => ({ id, allowed: true })) };
+            if (method === 'config/read')
+                return { config: { permissions: {
+                            dharma_bridge: { filesystem: { ':minimal': 'read', ':workspace_roots': { '.': 'read' } }, network: { enabled: false } },
+                            dharma_work: { filesystem: { ':minimal': 'read', ':workspace_roots': { '.': 'write' } }, network: { enabled: false } },
+                        } } };
+            if (method === 'thread/read')
+                return { thread: { id: binding.sessionId, cwd: binding.workspaceRoot, status: { type: 'idle' } } };
+            if (method === 'turn/start') {
+                assert.equal(params.threadId, binding.sessionId);
+                assert.equal(params.approvalPolicy, 'never');
+                turns.push(String(params.permissions));
+                active++;
+                maximumActive = Math.max(maximumActive, active);
+                const turnId = randomUUID();
+                setTimeout(() => {
+                    active--;
+                    for (const listener of listeners)
+                        listener({ method: 'turn/completed', params: { threadId: binding.sessionId,
+                                turn: { id: turnId, status: 'completed', items: [{ type: 'agentMessage', phase: 'final_answer', text: 'One tenant-scoped operation.' }] } } });
+                }, 25);
+                return { turn: { id: turnId } };
+            }
+            throw new Error('unexpected');
+        },
+    };
+    const channelTransport = { async signedPost(route, body) {
+            const value = body;
+            const base = { ok: true, organizationId: identity.organizationId, correlationId: randomUUID() };
+            if (route.endsWith('provider-sessions')) {
+                if (value.action === 'inspect')
+                    return { ...base, registration: null };
+                return { ...base, registration: { bindingId: binding.bindingId, ...identity,
+                        organizationId: undefined, mode: 'bridge_owned', revision: ++revision, state: 'attached',
+                        leaseUntil: new Date(Date.now() + 60000).toISOString(), replay: false } };
+            }
+            if (value.action === 'inbox')
+                return { ...base, result: { offers: offered && !accepted ? [question] : [] } };
+            if (value.action === 'accept')
+                accepted = true;
+            if (value.action === 'reply')
+                replies.push(String(value.answer));
+            return { ...base, result: { questionId, taskId, targetBindingId: binding.bindingId,
+                    state: value.action === 'reply' ? 'answered' : 'accepted', replay: false } };
+        } };
+    // The wire registration deliberately has no organizationId inside the scoped result.
+    const rawPost = channelTransport.signedPost;
+    channelTransport.signedPost = async (route, body) => {
+        const result = await rawPost(route, body);
+        if (result.registration)
+            delete result.registration.organizationId;
+        return result;
+    };
+    const service = runNamedSessionService({ home, registration, vault, signal: controller.signal,
+        openTransport: async () => transport, channelTransport, verifier: { resolvePublicKey: () => publicKey, consume: async () => true },
+        authorizeContent: async () => true, localWriteRoots: ['.'], authorizeLocalWork: async () => true,
+        withActivationBoundary: operation => operation() });
+    try {
+        for (let n = 0; n < 40; n++) {
+            try {
+                await namedSessionRequest(home, 'implementer', { action: 'status' });
+                break;
+            }
+            catch {
+                await new Promise(resolveWait => setTimeout(resolveWait, 10));
+            }
+        }
+        const workId = randomUUID();
+        const first = namedSessionRequest(home, 'implementer', { action: 'work', workId, prompt: 'Run the public tests.' });
+        const second = namedSessionRequest(home, 'implementer', { action: 'work', workId: randomUUID(), prompt: 'Check the correction.' });
+        await Promise.all([first, second]);
+        offered = true;
+        for (let n = 0; n < 150 && !replies.length; n++)
+            await new Promise(resolveWait => setTimeout(resolveWait, 10));
+        assert.equal(replies.length, 1);
+        assert.equal(maximumActive, 1);
+        assert.deepEqual(turns, ['dharma_work', 'dharma_work', 'dharma_bridge']);
+        await assert.rejects(namedSessionRequest(home, 'implementer', { action: 'work', workId, prompt: 'Replay' }), /work_already_recorded/);
+        assert.equal(turns.length, 3);
+        const health = JSON.parse(await readFile(namedSessionPaths(home, 'implementer').health, 'utf8'));
+        assert.equal(health.budget.reservedCents, 75);
+        const completion = JSON.parse((await vault.getBlob(health.lastObservation.completionHash)).toString('utf8'));
+        assert.equal((await validateContract(join(import.meta.dirname, 'schemas'), 'https://schemas.dharma-ai.io/provider-session-completion/v1', completion)).ok, true);
+        assert.equal((await namedSessionRequest(home, 'implementer', { action: 'status' })).sessionId, binding.sessionId);
+    }
+    finally {
+        controller.abort();
+        await service;
+        vault.close();
+    }
+    assert.equal(closed, true);
+});
+//# sourceMappingURL=namedSessionService.test.js.map

package/dist/namedSessionService.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedSessionService.test.js","sourceRoot":"","sources":["../src/namedSessionService.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAoC,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,EAC1E,MAAM,0BAA0B,CAAC;AAElE,IAAI,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;QACzG,UAAU,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAgB,EAAE,CAAC;IAC7G,MAAM,IAAI,GAA6B,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE;QACnH,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE;QAClG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE;QACrE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAmC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC1G,MAAM,CAAC,SAAS,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACzH,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACnF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACtG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yFAAyF,EAC5F,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE;IACjD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC5D,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;QACzG,UAAU,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAgB,EAAE,CAAC;IAC7G,MAAM,OAAO,GAAgC,EAAE,MAAM,EAAE,0CAA0C,EAAE,GAAG,QAAQ;QAC5G,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAC3G,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IAC/H,MAAM,YAAY,GAA6B,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,aAAa;QACrG,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3G,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/E,MAAM,CAAC,SAAS,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/F,KAAK,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,KAAK,GAAa,EAAE,EAAE,OAAO,GAAa,EAAE,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,IAAI,OAAO,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG,CAAC,EAAE,aAAa,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,QAAQ,GAAG,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,UAAU,EAAE,EAAE,MAAM,GAAG,UAAU,EAAE,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM;QACzE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QAC1F,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;QACnH,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY;YAC/G,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;QAChF,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,wBAAwB;QAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,EAAE;QACjG,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QACvF,KAAK,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;IACvF,MAAM,SAAS,GAAG;QAChB,UAAU,KAAK,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QACjC,cAAc,CAAC,QAAkC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7H,KAAK,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAA+B;YAC3D,IAAI,MAAM,KAAK,wBAAwB;gBAAE,OAAO,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9H,IAAI,MAAM,KAAK,aAAa;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE;4BAC5D,aAAa,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;4BACvH,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;yBACvH,EAAE,EAAE,CAAC;YACN,IAAI,MAAM,KAAK,aAAa;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACjI,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;gBACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAClG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;gBAC5B,UAAU,CAAC,GAAG,EAAE;oBACd,MAAM,EAAE,CAAC;oBACT,KAAK,MAAM,QAAQ,IAAI,SAAS;wBAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS;gCAC1G,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnJ,CAAC,EAAE,EAAE,CAAC,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;IACF,MAAM,gBAAgB,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAa;YACtE,MAAM,KAAK,GAAG,IAA+B,CAAC;YAC9C,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC;YAChG,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;gBACvE,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,QAAQ;wBACzE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU;wBACxF,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YAC7G,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS;oBAChF,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjF,CAAC,EAAE,CAAC;IACJ,qFAAqF;IACrF,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC;IAC5C,gBAAgB,CAAC,UAAU,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAA4B,CAAC;QACrE,IAAI,MAAM,CAAC,YAAY;YAAE,OAAQ,MAAM,CAAC,YAAwC,CAAC,cAAc,CAAC;QAChG,OAAO,MAA6C,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QAC3F,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QAClI,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAChG,sBAAsB,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC;gBAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;YACpF,MAAM,CAAC;gBAAC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnI,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/G,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACtI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EACvE,6DAA6D,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpH,CAAC;YAAS,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,OAAO,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC"}

package/dist/namedSessionTrust.d.ts

@@ -0,0 +1,21 @@
+import type { LocalProviderSessionIdentity, LocalVault } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { type DeviceConfig, type SecureSecretStore } from '@dharma-ai-labs/agent-fabric-relay-client';
+export declare function isNamedSessionOwnerReceipt(response: Record<string, unknown>, bindingId: string, identity: LocalProviderSessionIdentity, now?: Date): boolean;
+export declare function createNamedSessionTrust(input: {
+    configPath: string;
+    identity: Pick<DeviceConfig, 'organizationId' | 'deviceId' | 'publicKeyEd25519' | 'hqUrl'>;
+    store?: SecureSecretStore;
+    now?: () => Date;
+}): {
+    resolvePublicKey: (keyVersion: string) => import("crypto").KeyObject | null;
+    refresh(): Promise<DeviceConfig>;
+};
+export declare function renewNamedSessionLifetime(input: {
+    vault: LocalVault;
+    bindingId: string;
+    identity: LocalProviderSessionIdentity;
+    trust: ReturnType<typeof createNamedSessionTrust>;
+    authorize(): Promise<boolean>;
+    now?: () => Date;
+}): Promise<import("@dharma-ai-labs/agent-fabric-local-vault").LocalProviderSessionBinding>;
+//# sourceMappingURL=namedSessionTrust.d.ts.map

package/dist/namedSessionTrust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedSessionTrust.d.ts","sourceRoot":"","sources":["../src/namedSessionTrust.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AACzG,OAAO,EACL,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAG/F,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAC7F,QAAQ,EAAE,4BAA4B,EAAE,GAAG,OAAa,GAAG,OAAO,CAcnE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,UAAU,GAAG,kBAAkB,GAAG,OAAO,CAAC,CAAC;IAC3F,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;;;EA+BA;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,KAAK,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,4BAA4B,CAAC;IAC7E,KAAK,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IAClD,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,2FAWA"}

package/dist/namedSessionTrust.js

@@ -0,0 +1,64 @@
+import { createActionDecisionPublicKeyResolver } from '@dharma-ai-labs/agent-fabric-contracts';
+import { loadDeviceEnrollmentAnchor, recoverDeviceEnrollmentConsistency } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { createSystemSecureStore } from '@dharma-ai-labs/agent-fabric-secure-store';
+export function isNamedSessionOwnerReceipt(response, bindingId, identity, now = new Date()) {
+    const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    const value = response.registration;
+    const fields = ['bindingId', 'workspaceId', 'endpointId', 'repositoryBindingId', 'membershipId', 'deviceId',
+        'provider', 'mode', 'revision', 'state', 'leaseUntil', 'replay'];
+    return Object.keys(response).sort().join(',') === 'correlationId,ok,organizationId,registration'
+        && response.ok === true && response.organizationId === identity.organizationId
+        && typeof response.correlationId === 'string' && uuid.test(response.correlationId)
+        && Boolean(value) && Object.keys(value).sort().join(',') === fields.sort().join(',')
+        && value.bindingId === bindingId && value.mode === 'bridge_owned' && value.state === 'attached'
+        && value.replay === false && Number.isInteger(value.revision) && Number(value.revision) >= 1
+        && Number(value.revision) <= 2147483647 && typeof value.leaseUntil === 'string' && Number.isFinite(Date.parse(value.leaseUntil))
+        && Number.isFinite(now.getTime()) && Date.parse(value.leaseUntil) <= now.getTime() + 120000
+        && Object.entries(identity).filter(([key]) => key !== 'organizationId').every(([key, expected]) => value[key] === expected);
+}
+export function createNamedSessionTrust(input) {
+    const now = input.now ?? (() => new Date());
+    let trusted = null;
+    const resolvePublicKey = version => {
+        const keyset = trusted?.serverSigningKeyset;
+        return keyset ? createActionDecisionPublicKeyResolver(keyset, now())(version) : null;
+    };
+    return {
+        resolvePublicKey,
+        async refresh() {
+            // Clear stale authority even when the protected read or transition fails.
+            trusted = null;
+            const protectedStore = input.store ?? await createSystemSecureStore();
+            const store = { backend: protectedStore.backend,
+                get: account => protectedStore.getFresh ? protectedStore.getFresh(account) : protectedStore.get(account),
+                put: (account, value) => protectedStore.put(account, value), delete: account => protectedStore.delete(account) };
+            const config = await recoverDeviceEnrollmentConsistency({ configPath: input.configPath, store, now: now() });
+            await loadDeviceEnrollmentAnchor({ config, store });
+            if (['organizationId', 'deviceId', 'publicKeyEd25519', 'hqUrl'].some(key => config[key] !== input.identity[key])) {
+                throw new Error('named_session_trust_scope_mismatch');
+            }
+            const keyset = config.serverSigningKeyset;
+            if (!keyset || keyset.organizationId !== config.organizationId
+                || !keyset.keys.some(key => createActionDecisionPublicKeyResolver(keyset, now())(key.keyVersion))) {
+                throw new Error('named_session_trust_invalid_or_expired');
+            }
+            trusted = config;
+            return config;
+        },
+    };
+}
+export async function renewNamedSessionLifetime(input) {
+    await input.trust.refresh();
+    const binding = input.vault.getProviderSessionBinding(input.bindingId, input.identity);
+    if (!binding || binding.owner !== 'dharma_bridge')
+        throw new Error('named_session_binding_unavailable');
+    const now = (input.now ?? (() => new Date()))();
+    if (Date.parse(binding.expiresAt) - now.getTime() >= 86400000)
+        return binding;
+    if (!await input.authorize())
+        throw new Error('named_session_lifetime_not_authorized');
+    // A network wait must not allow an expired or replaced enrollment to authorize renewal.
+    await input.trust.refresh();
+    return input.vault.renewProviderSessionBinding(input.bindingId, input.identity, binding.expiresAt, new Date(now.getTime() + 30 * 86400000).toISOString(), now);
+}
+//# sourceMappingURL=namedSessionTrust.js.map

package/dist/namedSessionTrust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedSessionTrust.js","sourceRoot":"","sources":["../src/namedSessionTrust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAgC,MAAM,wCAAwC,CAAC;AAE7H,OAAO,EAAE,0BAA0B,EAAE,kCAAkC,EAC1B,MAAM,2CAA2C,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAEpF,MAAM,UAAU,0BAA0B,CAAC,QAAiC,EAAE,SAAiB,EAC7F,QAAsC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACxD,MAAM,IAAI,GAAG,4EAA4E,CAAC;IAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAmD,CAAC;IAC3E,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,UAAU;QACzG,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,8CAA8C;WAC3F,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;WAC3E,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;WAC/E,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;WAClF,KAAM,CAAC,SAAS,KAAK,SAAS,IAAI,KAAM,CAAC,IAAI,KAAK,cAAc,IAAI,KAAM,CAAC,KAAK,KAAK,UAAU;WAC/F,KAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,KAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;WAC5F,MAAM,CAAC,KAAM,CAAC,QAAQ,CAAC,IAAI,UAAU,IAAI,OAAO,KAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,UAAU,CAAC,CAAC;WAChI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM;WACzF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,KAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,MAAM,gBAAgB,GAAgD,OAAO,CAAC,EAAE;QAC9E,MAAM,MAAM,GAAG,OAAO,EAAE,mBAAmB,CAAC;QAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,qCAAqC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC,CAAC;IACF,OAAO;QACL,gBAAgB;QAChB,KAAK,CAAC,OAAO;YACX,0EAA0E;YAC1E,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,uBAAuB,EAAE,CAAC;YACtE,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO;gBAChE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;gBACxG,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACnH,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7G,MAAM,0BAA0B,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACzE,MAAM,CAAC,GAAyB,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,GAAkC,CAAC,CAAC,EAAE,CAAC;gBAC5F,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;mBACzD,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,qCAAqC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBACpG,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAChD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9E,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACvF,wFAAwF;IACxF,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAC/F,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC"}

package/dist/namedSessionTrust.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=namedSessionTrust.test.d.ts.map

package/dist/namedSessionTrust.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedSessionTrust.test.d.ts","sourceRoot":"","sources":["../src/namedSessionTrust.test.ts"],"names":[],"mappings":""}

package/dist/namedSessionTrust.test.js

@@ -0,0 +1,178 @@
+import assert from 'node:assert/strict';
+import { generateKeyPairSync, randomBytes } from 'node:crypto';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
+import { LocalVault } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { installTrustedServerSigningKeyset, saveDeviceConfig, saveDeviceEnrollmentAnchor } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { createNamedSessionTrust, isNamedSessionOwnerReceipt, renewNamedSessionLifetime } from './namedSessionTrust.js';
+import { createProviderSessionChannel } from './providerSessionChannel.js';
+const uuid = (n) => `40000000-0000-4000-8000-${String(n).padStart(12, '0')}`;
+async function fixture() {
+    const root = await mkdtemp(join(tmpdir(), 'fabric-session-trust-'));
+    let now = new Date();
+    const first = generateKeyPairSync('ed25519'), second = generateKeyPairSync('ed25519');
+    const firstPublic = first.publicKey.export({ format: 'jwk' }).x;
+    const secondPublic = second.publicKey.export({ format: 'jwk' }).x;
+    const notBefore = new Date(now.getTime() - 60_000).toISOString();
+    const oldExpiry = new Date(now.getTime() + 2 * 86400000).toISOString();
+    const newExpiry = new Date(now.getTime() + 10 * 86400000).toISOString();
+    const initialUnsigned = { schema: 'dharma.server-signing-keyset/v1', organizationId: 'org_test', generation: 1,
+        keys: [{ keyVersion: 'kms/1', publicKeyEd25519: firstPublic, status: 'active', notBefore, notAfter: oldExpiry }],
+        signedByKeyVersion: 'kms/1', issuedAt: now.toISOString(), expiresAt: oldExpiry };
+    const initial = { ...initialUnsigned, signature: signCanonicalObject(initialUnsigned, first.privateKey) };
+    const rotatedUnsigned = { ...initialUnsigned, generation: 2, expiresAt: newExpiry,
+        keys: [{ ...initialUnsigned.keys[0], status: 'overlap' },
+            { keyVersion: 'kms/2', publicKeyEd25519: secondPublic, status: 'active', notBefore, notAfter: newExpiry }] };
+    const rotated = { ...rotatedUnsigned, signature: signCanonicalObject(rotatedUnsigned, first.privateKey) };
+    const values = new Map();
+    const store = { backend: 'linux-secret-service', get: async (key) => values.get(key) ?? null,
+        put: async (key, value) => { values.set(key, value); }, delete: async (key) => { values.delete(key); } };
+    const config = { schema: 'dharma.device-config/v1', hqUrl: 'https://hq.example', relayUrl: 'wss://relay.example',
+        organizationId: 'org_test', deviceId: uuid(5), deviceName: 'test', platform: 'linux',
+        publicKeyEd25519: firstPublic, serverPublicKeyEd25519: firstPublic, serverSigningKeyset: initial, enrolledAt: now.toISOString() };
+    const configPath = join(root, 'device.json');
+    await saveDeviceConfig(configPath, config);
+    await saveDeviceEnrollmentAnchor({ config, store });
+    const trust = createNamedSessionTrust({ configPath, identity: config, store, now: () => now });
+    const vault = await LocalVault.open({ root: join(root, 'vault'), masterKey: randomBytes(32) });
+    const binding = { schema: 'dharma.local-provider-session-binding/v1', owner: 'dharma_bridge',
+        organizationId: config.organizationId, deviceId: config.deviceId, membershipId: uuid(4), repositoryBindingId: uuid(1),
+        workspaceId: uuid(2), endpointId: uuid(3), bindingId: uuid(6), provider: 'codex', sessionId: 'retained-thread',
+        workspaceRoot: root, createdAt: now.toISOString(), expiresAt: oldExpiry, maximumProviderCostCents: 25 };
+    vault.saveProviderSessionBinding(binding);
+    return { root, trust, vault, binding, config, configPath, store, rotated, oldExpiry, newExpiry, second,
+        setTime: (time) => { now = time; }, now: () => now };
+}
+test('protected successor trust is refreshed while running and after original expiry on restart', async () => {
+    const f = await fixture();
+    try {
+        await f.trust.refresh();
+        assert.ok(f.trust.resolvePublicKey('kms/1'));
+        assert.equal(f.trust.resolvePublicKey('kms/2'), null);
+        await installTrustedServerSigningKeyset({ configPath: f.configPath, candidate: f.rotated, store: f.store, now: f.now() });
+        await f.trust.refresh();
+        assert.ok(f.trust.resolvePublicKey('kms/2'));
+        f.setTime(new Date(Date.parse(f.oldExpiry) + 1000));
+        const restarted = createNamedSessionTrust({ configPath: f.configPath, identity: f.config, store: f.store, now: f.now });
+        await restarted.refresh();
+        assert.ok(restarted.resolvePublicKey('kms/2'));
+        assert.equal(restarted.resolvePublicKey('kms/1'), null);
+        await renewNamedSessionLifetime({ vault: f.vault, bindingId: f.binding.bindingId, identity: f.binding,
+            trust: restarted, authorize: async () => true, now: f.now });
+        const renewed = f.vault.getProviderSessionBinding(f.binding.bindingId, f.binding);
+        assert.deepEqual({ ...renewed, expiresAt: f.binding.expiresAt }, f.binding);
+        assert.ok(Date.parse(renewed.expiresAt) > f.now().getTime());
+        assert.equal(f.rotated.keys[0].notAfter, f.oldExpiry);
+    }
+    finally {
+        f.vault.close();
+    }
+});
+test('expired, foreign, unprotected and conflicting trust never renews local authority', async () => {
+    for (const kind of ['expired', 'foreign', 'unprotected', 'deleted_after_cache', 'conflicting']) {
+        const f = await fixture();
+        try {
+            if (kind === 'expired')
+                f.setTime(new Date(Date.parse(f.oldExpiry) + 1));
+            if (kind === 'foreign')
+                await saveDeviceConfig(f.configPath, { ...f.config, organizationId: 'org_foreign' });
+            if (kind === 'unprotected')
+                f.store.get = async () => null;
+            if (kind === 'deleted_after_cache') {
+                await f.trust.refresh();
+                f.store.getFresh = async () => null;
+            }
+            if (kind === 'conflicting')
+                await saveDeviceConfig(f.configPath, { ...f.config, serverSigningKeyset: { ...f.rotated, generation: 1 } });
+            await assert.rejects(renewNamedSessionLifetime({ vault: f.vault, bindingId: f.binding.bindingId, identity: f.binding,
+                trust: f.trust, authorize: async () => true, now: f.now }));
+            assert.deepEqual(f.vault.getProviderSessionBinding(f.binding.bindingId, f.binding), f.binding);
+        }
+        finally {
+            f.vault.close();
+        }
+    }
+});
+test('revoked standing policy and local binding cannot be renewed', async () => {
+    const f = await fixture();
+    try {
+        f.setTime(new Date(Date.parse(f.oldExpiry) - 1000));
+        await assert.rejects(renewNamedSessionLifetime({ vault: f.vault, bindingId: f.binding.bindingId, identity: f.binding,
+            trust: f.trust, authorize: async () => false, now: f.now }), /not_authorized/);
+        f.vault.revokeProviderSessionBinding(f.binding.bindingId, f.binding);
+        await assert.rejects(renewNamedSessionLifetime({ vault: f.vault, bindingId: f.binding.bindingId, identity: f.binding,
+            trust: f.trust, authorize: async () => true, now: f.now }), /binding_unavailable/);
+    }
+    finally {
+        f.vault.close();
+    }
+});
+test('a retained channel consumes successor-signed offers after protected rotation and local deadline renewal', async () => {
+    const f = await fixture();
+    let revision = 0;
+    const signedOffer = () => {
+        const unsigned = { schema: 'dharma.session-question/v1', questionId: uuid(10), taskId: uuid(11),
+            organizationId: f.binding.organizationId, repositoryBindingId: f.binding.repositoryBindingId,
+            source: { workspaceId: uuid(12), endpointId: uuid(13), membershipId: uuid(14), deviceId: uuid(15) },
+            target: { workspaceId: f.binding.workspaceId, endpointId: f.binding.endpointId, membershipId: f.binding.membershipId,
+                deviceId: f.binding.deviceId, bindingId: f.binding.bindingId, provider: f.binding.provider },
+            category: 'code-review', question: 'Is the logical job deduplicated?',
+            authority: { mode: 'read_only', readPaths: ['.'], network: 'deny', maximumProviderCostCents: 25 },
+            createdAt: f.now().toISOString(), expiresAt: new Date(f.now().getTime() + 60_000).toISOString(),
+            nonce: uuid(16), signerKeyVersion: 'kms/2' };
+        return { ...unsigned, signature: signCanonicalObject(unsigned, f.second.privateKey) };
+    };
+    const { schema: _schema, owner: _owner, sessionId: _session, workspaceRoot: _root, createdAt: _created, ...scope } = f.binding;
+    const channel = createProviderSessionChannel({ scope, mode: 'bridge_owned', expectedRevision: 0,
+        assertOwner: async () => Boolean(f.vault.getProviderSessionBinding(f.binding.bindingId, f.binding)),
+        currentExpiresAt: () => f.vault.getProviderSessionBinding(f.binding.bindingId, f.binding)?.expiresAt ?? null,
+        verifier: f.trust, authorizeContent: async () => true, now: f.now,
+        transport: { async signedPost(_route, input) {
+                await f.trust.refresh();
+                const body = input;
+                return body.action === 'inbox'
+                    ? { ok: true, organizationId: f.binding.organizationId, correlationId: uuid(90), result: { offers: [signedOffer()] } }
+                    : { ok: true, organizationId: f.binding.organizationId, correlationId: uuid(90), registration: {
+                            bindingId: f.binding.bindingId, workspaceId: f.binding.workspaceId, endpointId: f.binding.endpointId,
+                            repositoryBindingId: f.binding.repositoryBindingId, membershipId: f.binding.membershipId, deviceId: f.binding.deviceId,
+                            provider: 'codex', mode: 'bridge_owned', revision: ++revision, state: 'attached', replay: false,
+                            leaseUntil: new Date(f.now().getTime() + 60_000).toISOString()
+                        } };
+            } } });
+    try {
+        await channel.attach();
+        await installTrustedServerSigningKeyset({ configPath: f.configPath, candidate: f.rotated, store: f.store, now: f.now() });
+        assert.equal((await channel.inbox())[0]?.signerKeyVersion, 'kms/2');
+        f.setTime(new Date(Date.parse(f.oldExpiry) + 1000));
+        await renewNamedSessionLifetime({ vault: f.vault, bindingId: f.binding.bindingId, identity: f.binding,
+            trust: f.trust, authorize: async () => true, now: f.now });
+        await channel.reconnect();
+        assert.equal((await channel.inbox())[0]?.target.bindingId, f.binding.bindingId);
+    }
+    finally {
+        f.vault.close();
+    }
+});
+test('lifetime renewal requires the exact owner inspect receipt, not an HTTP success or presence assumption', async () => {
+    const f = await fixture();
+    const { schema: _schema, owner: _owner, sessionId: _session, workspaceRoot: _root, createdAt: _created, expiresAt: _expiry, maximumProviderCostCents: _cost, organizationId, ...identity } = f.binding;
+    const receipt = { ok: true, organizationId, correlationId: uuid(90), registration: { ...identity,
+            mode: 'bridge_owned', revision: 5, state: 'attached', leaseUntil: f.now().toISOString(), replay: false } };
+    try {
+        assert.equal(isNamedSessionOwnerReceipt(receipt, f.binding.bindingId, { ...identity, organizationId }), true);
+        for (const change of [{ membershipId: uuid(99) }, { deviceId: uuid(99) }, { repositoryBindingId: uuid(99) },
+            { state: 'detached' }, { mode: 'cooperative' }, { replay: true }, { revision: 0 }, { leaseUntil: 'invalid' },
+            { leaseUntil: new Date(Date.now() + 86400000).toISOString() }, { extra: true }]) {
+            assert.equal(isNamedSessionOwnerReceipt({ ...receipt, registration: { ...receipt.registration, ...change } }, f.binding.bindingId, { ...identity, organizationId }), false);
+        }
+        assert.equal(isNamedSessionOwnerReceipt({ ...receipt, organizationId: 'org_foreign' }, f.binding.bindingId, { ...identity, organizationId }), false);
+        assert.equal(isNamedSessionOwnerReceipt({ ok: true }, f.binding.bindingId, { ...identity, organizationId }), false);
+    }
+    finally {
+        f.vault.close();
+    }
+});
+//# sourceMappingURL=namedSessionTrust.test.js.map

package/dist/namedSessionTrust.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedSessionTrust.test.js","sourceRoot":"","sources":["../src/namedSessionTrust.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAmC,MAAM,wCAAwC,CAAC;AAC9G,OAAO,EAAE,UAAU,EAAoC,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,iCAAiC,EAAE,gBAAgB,EAAE,0BAA0B,EAC3C,MAAM,2CAA2C,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACxH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,2BAA2B,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;AACrF,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,eAAe,GAAG,EAAE,MAAM,EAAE,iCAA0C,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACrH,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,QAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACzH,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,mBAAmB,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1G,MAAM,eAAe,GAAG,EAAE,GAAG,eAAe,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS;QAC/E,IAAI,EAAE,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,SAAkB,EAAE;YAChE,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,QAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC1H,MAAM,OAAO,GAA+B,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,mBAAmB,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IACtI,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QAC3G,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,MAAM,MAAM,GAAiB,EAAE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,qBAAqB;QAC5H,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;QACpF,gBAAgB,EAAE,WAAW,EAAE,sBAAsB,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IACpI,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,0BAA0B,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,uBAAuB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAgC,EAAE,MAAM,EAAE,0CAA0C,EAAE,KAAK,EAAE,eAAe;QACvH,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;QACrH,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB;QAC9G,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IAC1G,KAAK,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM;QACpG,OAAO,EAAE,CAAC,IAAU,EAAE,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,IAAI,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IAC3G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7H,MAAM,iCAAiC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1H,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxH,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACnI,MAAM,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO;YACnG,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAE,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAClG,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,qBAAqB,EAAE,aAAa,CAAU,EAAE,CAAC;QACxG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,SAAS;gBAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzE,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7G,IAAI,IAAI,KAAK,aAAa;gBAAE,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;YAC3D,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;YAAC,CAAC;YACrG,IAAI,IAAI,KAAK,aAAa;gBAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAC7D,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO;gBAClH,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACjG,CAAC;gBAAS,CAAC;YAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IAChC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO;YAClH,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACjF,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO;YAClH,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACvF,CAAC;YAAS,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;IACzH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7F,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB;YAC5F,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;YACnG,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY;gBAClH,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC9F,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,kCAAkC;YACrE,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,EAAE;YACjG,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;YAC/F,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;QAC/C,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACxF,CAAC,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;IAC/H,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;QAC7F,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACnG,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,IAAI,IAAI;QAC5G,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG;QACjE,SAAS,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK;gBACzC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,KAA2B,CAAC;gBACzC,OAAO,IAAI,CAAC,MAAM,KAAK,OAAO;oBAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE;oBACtH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE;4BAC7F,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU;4BACpG,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;4BACtH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK;4BAC/F,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;yBAAE,EAAE,CAAC;YACzE,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,iCAAiC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1H,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO;YACnG,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;IACvH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EACpG,SAAS,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;IACjG,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,QAAQ;YAC9F,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7G,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9G,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;YACzG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YAC5G,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,EAC1G,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EACxG,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACtH,CAAC;YAAS,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC,CAAC,CAAC"}

package/dist/onboardingStage.d.ts

@@ -1,3 +1,3 @@
-export type OnboardingStage = 'local_skill_inventory' | 'first_learning_preview' | 'first_learning_sync' | 'package_snapshot' | 'package_publication' | 'role_registration' | 'native_skill_install' | 'relay_start' | 'autostart' | 'readiness';
+export type OnboardingStage = 'local_skill_inventory' | 'first_learning_preview' | 'first_learning_sync' | 'package_snapshot' | 'package_publication' | 'role_registration' | 'native_skill_install' | 'relay_start' | 'autostart' | 'named_session' | 'readiness';
 export declare function withOnboardingStage<T>(stage: OnboardingStage, workspaceId: string, resumeCommand: string, operation: () => Promise<T>): Promise<T>;
 //# sourceMappingURL=onboardingStage.d.ts.map

package/dist/onboardingStage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboardingStage.d.ts","sourceRoot":"","sources":["../src/onboardingStage.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GACvB,uBAAuB,GACvB,wBAAwB,GACxB,qBAAqB,GACrB,kBAAkB,GAClB,qBAAqB,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,aAAa,GACb,WAAW,GACX,WAAW,CAAC;AAEhB,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAUZ"}
+{"version":3,"file":"onboardingStage.d.ts","sourceRoot":"","sources":["../src/onboardingStage.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GACvB,uBAAuB,GACvB,wBAAwB,GACxB,qBAAqB,GACrB,kBAAkB,GAClB,qBAAqB,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,aAAa,GACb,WAAW,GACX,eAAe,GACf,WAAW,CAAC;AAEhB,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAUZ"}

package/dist/onboardingStage.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboardingStage.js","sourceRoot":"","sources":["../src/onboardingStage.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAsB,EACtB,WAAmB,EACnB,aAAqB,EACrB,SAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,KAAK,MAAM,mBAAmB,WAAW,qBAAqB,aAAa,EAAE,EAC7G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"onboardingStage.js","sourceRoot":"","sources":["../src/onboardingStage.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAsB,EACtB,WAAmB,EACnB,aAAqB,EACrB,SAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,KAAK,MAAM,mBAAmB,WAAW,qBAAqB,aAAa,EAAE,EAC7G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/providerSessionChannel.d.ts

@@ -48,6 +48,7 @@ export declare function createProviderSessionChannel(input: {
     mode: Mode;
     expectedRevision: number;
     assertOwner(): Promise<boolean>;
+    currentExpiresAt?: () => string | null;
     verifier: Pick<SessionQuestionVerifier, 'resolvePublicKey'>;
     authorizeContent(content: string, kind: 'question' | 'answer'): Promise<boolean>;
     now?: () => Date;

package/dist/providerSessionChannel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerSessionChannel.d.ts","sourceRoot":"","sources":["../src/providerSessionChannel.ts"],"names":[],"mappings":"AACA,OAAO,EAAoC,KAAK,mBAAmB,EAAE,KAAK,eAAe,EACvF,KAAK,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,KAAK,IAAI,GAAG,cAAc,GAAG,aAAa,CAAC;AAC3C,KAAK,WAAW,GAAG,sBAAsB,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AACvG,KAAK,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAC5G,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACxF,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AACxE,KAAK,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IACnF,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AACjG,KAAK,KAAK,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC;AACrI,KAAK,WAAW,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAC/E,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;IAC/F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AA0CnH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,SAAS,EAAE;QAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IAC1F,KAAK,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACjE,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;IAC5D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;;;;mBAzDgC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;;mBAFpC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;;mBAFpC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;;mBAFpC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;mBAmLlD;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAA;KAAE;yBAS3G,MAAM,UAAU,MAAM;qBAI1B,KAAK;uBAUH,MAAM,UAAU,MAAM,mBAAmB,MAAM;EAcrE"}
+{"version":3,"file":"providerSessionChannel.d.ts","sourceRoot":"","sources":["../src/providerSessionChannel.ts"],"names":[],"mappings":"AACA,OAAO,EAAoC,KAAK,mBAAmB,EAAE,KAAK,eAAe,EACvF,KAAK,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,KAAK,IAAI,GAAG,cAAc,GAAG,aAAa,CAAC;AAC3C,KAAK,WAAW,GAAG,sBAAsB,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AACvG,KAAK,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAC5G,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACxF,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AACxE,KAAK,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IACnF,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AACjG,KAAK,KAAK,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC;AACrI,KAAK,WAAW,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAC/E,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;IAC/F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AA0CnH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,SAAS,EAAE;QAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IAC1F,KAAK,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACjE,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;IAC5D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;;;;mBA1DgC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;;mBAFpC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;;mBAFpC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;;mBAFpC,MAAM;qBAAe,MAAM;oBAAc,MAAM;6BAAuB,MAAM;sBAC7F,MAAM;kBAAY,MAAM;kBAAY,OAAO;cAAQ,IAAI;kBAAY,MAAM;eAChF,UAAU,GAAG,UAAU;oBAAc,MAAM;gBAAU,OAAO;;;mBAwLlD;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAA;KAAE;yBAS3G,MAAM,UAAU,MAAM;qBAI1B,KAAK;uBAUH,MAAM,UAAU,MAAM,mBAAmB,MAAM;EAcrE"}

package/dist/providerSessionChannel.js

@@ -83,10 +83,13 @@ export function createProviderSessionChannel(input) {
             held = await input.assertOwner();
         }
         catch { /* Unconfirmed ownership cannot authorize another send. */ }
-        if (!held || !Number.isFinite(now().getTime()) || now().getTime() >= Date.parse(scope.expiresAt)) {
+        const expiresAt = input.currentExpiresAt ? input.currentExpiresAt() : scope.expiresAt;
+        if (!held || !expiresAt || !Number.isFinite(Date.parse(expiresAt))
+            || !Number.isFinite(now().getTime()) || now().getTime() >= Date.parse(expiresAt)) {
             closed = true;
             throw new Error('provider_session_channel_owner_lost');
         }
+        scope.expiresAt = expiresAt;
         if (live && (!registration || registration.state !== 'attached' || now().getTime() >= Date.parse(registration.leaseUntil))) {
             throw new Error('provider_session_channel_unavailable');
         }
@@ -195,6 +198,7 @@ export function createProviderSessionChannel(input) {
                 fact(inspected.ok, 'response');
                 const offer = candidate;
                 text(offer.question, 'response');
+                await content(offer.question, 'question');
                 fact(!seen.has(offer.questionId), 'response');
                 seen.add(offer.questionId);
                 offers.push(offer);