@dsh-enhanced/assistant-actions 0.1.30

package/lib/broker-cli.js

@@ -0,0 +1,255 @@
+#!/usr/bin/env node
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { requestGitHubBrokerAdmin } from './broker-client.js';
+import { createExternalBrokerCore, normalizeExternalBrokerCoreConfig } from './broker-core.js';
+import { inspectLinuxPeerCredentials, linuxPeerCredentialsAvailable } from './broker-peer-linux.js';
+import { startGitHubBrokerServer } from './broker-server.js';
+const DIGEST = /^[0-9a-f]{64}$/u;
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const STOP_REASONS = new Set(['operator-request', 'security-response', 'maintenance']);
+const REVOKE_REASONS = new Set(['operator-request', 'security-response', 'grant-replaced', 'grant-expired']);
+const FAILURE = 'assistant-actions broker: command failed or invalid arguments\n';
+function plain(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function integer(value, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+}
+function canonicalPath(value) {
+    return typeof value === 'string' && isAbsolute(value) && resolve(value) === value && value !== '/' && !value.includes('\0');
+}
+function exact(input, allowed, required) {
+    if (Object.keys(input).some(key => !allowed.includes(key)) || required.some(key => !Object.hasOwn(input, key)))
+        throw new Error('invalid config');
+}
+async function privateFile(path, mode = 0o600, maximumBytes = 2 * 1024 * 1024) {
+    const currentUid = BigInt(process.getuid?.() ?? -1), currentGid = BigInt(process.getgid?.() ?? -1), parentPath = resolve(path, '..');
+    await safeAncestorChain(parentPath, Number(currentUid), Number(currentGid), true);
+    const [canonicalParent, parent] = await Promise.all([realpath(parentPath), lstat(parentPath, { bigint: true })]);
+    if (canonicalParent !== parentPath || parent.isSymbolicLink() || !parent.isDirectory() || parent.uid !== currentUid || parent.gid !== currentGid || Number(parent.mode & 63n) !== 0)
+        throw new Error('unsafe private file parent');
+    const descriptor = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await descriptor.stat({ bigint: true });
+        if (!before.isFile() || before.nlink !== 1n || before.size > BigInt(maximumBytes) || Number(before.mode & 4095n) !== mode || before.uid !== currentUid || before.gid !== currentGid)
+            throw new Error('unsafe private file');
+        const value = await descriptor.readFile();
+        const [after, linked] = await Promise.all([descriptor.stat({ bigint: true }), lstat(path, { bigint: true })]);
+        if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeNs !== after.mtimeNs || after.dev !== linked.dev || after.ino !== linked.ino || linked.isSymbolicLink())
+            throw new Error('private file changed');
+        return value;
+    }
+    finally {
+        await descriptor.close();
+    }
+}
+async function safeAncestorChain(path, expectedLeafUid, expectedLeafGid, privateLeaf) {
+    let cursor = path, leaf = true;
+    for (;;) {
+        const [canonical, stat] = await Promise.all([realpath(cursor), lstat(cursor, { bigint: true })]);
+        const mode = Number(stat.mode & 4095n), uid = Number(stat.uid), gid = Number(stat.gid);
+        const stickyRoot = uid === 0 && (mode & 0o1000) !== 0 && (mode & 0o022) !== 0;
+        if (canonical !== cursor || stat.isSymbolicLink() || !stat.isDirectory() || !stickyRoot && (mode & 0o022) !== 0
+            || leaf && privateLeaf && (uid !== expectedLeafUid || gid !== expectedLeafGid || (mode & 0o077) !== 0))
+            throw new Error('unsafe path ancestry');
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            return;
+        cursor = parent;
+        leaf = false;
+    }
+}
+function normalizedConfig(value, serve) {
+    if (!plain(value))
+        throw new Error('invalid config');
+    const operator = ['adminSocketPath', 'brokerId', 'minimumBrokerGeneration', 'brokerPublicKeyPath', 'adminKeyId', 'adminPrivateKeyPath', 'adminInstanceId', 'adminGeneration', 'expectedAdminSocketUid', 'expectedAdminSocketGid', 'expectedAdminSocketMode', 'expectedAdminParentUid', 'expectedAdminParentGid', 'expectedAdminParentMode', 'expectedBrokerPeerUid', 'expectedBrokerPeerGid', 'requestTimeoutMs', 'helloTtlMs'];
+    const daemon = ['actionSocketPath', 'adminSocketPath', 'brokerId', 'minimumBrokerGeneration', 'serverPrivateKeyPath', 'clientKeyId', 'clientPublicKeyPath', 'adminKeyId', 'adminPublicKeyPath', 'statePath', 'expectedClientPeerUid', 'expectedClientPeerGid', 'expectedAdminPeerUid', 'expectedAdminPeerGid', 'expectedActionSocketUid', 'expectedActionSocketGid', 'expectedActionParentMode', 'expectedActionSocketMode', 'expectedAdminSocketUid', 'expectedAdminSocketGid', 'expectedAdminParentMode', 'expectedAdminSocketMode', 'maxActionConnections', 'maxAdminConnections', 'maxConcurrentRequests', 'requestTimeoutMs', 'helloTtlMs', 'drainTimeoutMs', 'credentials', 'grants', 'policyEpoch', 'controllerTtlMs', 'credentialMaxBytes'];
+    exact(value, serve ? daemon : operator, serve ? daemon.filter(key => key !== 'controllerTtlMs' && key !== 'credentialMaxBytes') : operator);
+    if (!IDENTIFIER.test(String(value.brokerId)) || !integer(value.minimumBrokerGeneration, 1) || !integer(value.requestTimeoutMs, 1, 300_000) || !integer(value.helloTtlMs, 1, 300_000))
+        throw new Error('invalid config');
+    if (!serve && (!canonicalPath(value.adminSocketPath) || Buffer.byteLength(value.adminSocketPath) > 100 || !canonicalPath(value.brokerPublicKeyPath)
+        || !IDENTIFIER.test(String(value.adminKeyId)) || !canonicalPath(value.adminPrivateKeyPath) || !IDENTIFIER.test(String(value.adminInstanceId)) || !integer(value.adminGeneration, 1)
+        || !integer(value.expectedAdminSocketUid, 0, 0x7fffffff) || !integer(value.expectedAdminSocketGid, 0, 0x7fffffff) || !integer(value.expectedAdminSocketMode, 0, 0o777)
+        || !integer(value.expectedAdminParentUid, 0, 0x7fffffff) || !integer(value.expectedAdminParentGid, 0, 0x7fffffff) || !integer(value.expectedAdminParentMode, 0, 0o777)
+        || !integer(value.expectedBrokerPeerUid, 0, 0x7fffffff) || !integer(value.expectedBrokerPeerGid, 0, 0x7fffffff)))
+        throw new Error('invalid operator config');
+    if (serve && (!canonicalPath(value.serverPrivateKeyPath) || !IDENTIFIER.test(String(value.clientKeyId)) || !canonicalPath(value.clientPublicKeyPath) || !canonicalPath(value.adminPublicKeyPath)
+        || !IDENTIFIER.test(String(value.adminKeyId)) || value.clientKeyId === value.adminKeyId || value.clientPublicKeyPath === value.adminPublicKeyPath
+        || value.serverPrivateKeyPath === value.clientPublicKeyPath || value.serverPrivateKeyPath === value.adminPublicKeyPath
+        || !canonicalPath(value.actionSocketPath) || !canonicalPath(value.adminSocketPath) || value.actionSocketPath === value.adminSocketPath || Buffer.byteLength(value.actionSocketPath) > 100 || Buffer.byteLength(value.adminSocketPath) > 100
+        || !canonicalPath(value.statePath) || !integer(value.expectedClientPeerUid, 0, 0x7fffffff) || !integer(value.expectedClientPeerGid, 0, 0x7fffffff)
+        || !integer(value.expectedAdminPeerUid, 0, 0x7fffffff) || !integer(value.expectedAdminPeerGid, 0, 0x7fffffff)
+        || !integer(value.expectedActionSocketUid, 0, 0x7fffffff) || !integer(value.expectedActionSocketGid, 0, 0x7fffffff) || !integer(value.expectedActionParentMode, 0, 0o777) || !integer(value.expectedActionSocketMode, 0, 0o777)
+        || !integer(value.expectedAdminSocketUid, 0, 0x7fffffff) || !integer(value.expectedAdminSocketGid, 0, 0x7fffffff) || !integer(value.expectedAdminParentMode, 0, 0o777) || !integer(value.expectedAdminSocketMode, 0, 0o777)
+        || !integer(value.maxActionConnections, 1, 1_024) || !integer(value.maxAdminConnections, 1, 64) || !integer(value.maxConcurrentRequests, 1, value.maxActionConnections)
+        || !integer(value.drainTimeoutMs, 1, 300_000) || !Array.isArray(value.credentials) || !Array.isArray(value.grants) || !integer(value.policyEpoch, 0)
+        || value.controllerTtlMs !== undefined && !integer(value.controllerTtlMs, 1_000, 300_000)
+        || value.credentialMaxBytes !== undefined && !integer(value.credentialMaxBytes, 1, 65_536)))
+        throw new Error('invalid serve config');
+    return Object.freeze({ ...value });
+}
+export async function loadBrokerCliConfig(path, serve = false) {
+    if (!canonicalPath(path))
+        throw new Error('invalid config path');
+    const bytes = await privateFile(path);
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        throw new Error('invalid config UTF-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new Error('invalid config JSON');
+    }
+    return normalizedConfig(parsed, serve);
+}
+function positive(value) {
+    if (!value || !/^[1-9][0-9]*$/u.test(value))
+        throw new Error('positive integer required');
+    const result = Number(value);
+    if (!Number.isSafeInteger(result))
+        throw new Error('positive integer required');
+    return result;
+}
+function epoch(value) {
+    if (!value || !/^(?:0|[1-9][0-9]*)$/u.test(value))
+        throw new Error('non-negative integer required');
+    const result = Number(value);
+    if (!Number.isSafeInteger(result))
+        throw new Error('non-negative integer required');
+    return result;
+}
+function adminIntent(command, args, now, timeoutMs) {
+    const deadline = now + timeoutMs;
+    if (!Number.isSafeInteger(deadline))
+        throw new Error('deadline overflow');
+    if (command === 'status' && args.length === 0)
+        return { operation: 'status', body: {}, deadline };
+    if (command === 'stop' && (args.length === 1 || args.length === 2)) {
+        const reason = args[1] ?? 'operator-request';
+        if (!STOP_REASONS.has(reason))
+            throw new Error('invalid stop reason');
+        return { operation: 'stop', body: { expectedControlVersion: epoch(args[0]), drainDeadline: deadline, reason: reason }, deadline };
+    }
+    if (command === 'resume' && args.length === 2)
+        return { operation: 'resume', body: { expectedControlVersion: epoch(args[0]), expectedGeneration: positive(args[1]) }, deadline };
+    if (command === 'revoke' && (args.length === 6 || args.length === 7)) {
+        const reason = args[6] ?? 'operator-request';
+        if (!IDENTIFIER.test(args[1] ?? '') || !DIGEST.test(args[3] ?? '') || !REVOKE_REASONS.has(reason))
+            throw new Error('invalid revoke arguments');
+        return { operation: 'revoke', body: { expectedControlVersion: epoch(args[0]), grantId: args[1], grantRevision: positive(args[2]), grantDigest: args[3], policyEpoch: epoch(args[4]), emergencyEpoch: epoch(args[5]), reason: reason }, deadline };
+    }
+    throw new Error('invalid command');
+}
+async function key(path, kind) {
+    const bytes = await privateFile(path);
+    try {
+        const result = kind === 'private' ? createPrivateKey(bytes) : createPublicKey(bytes);
+        if (result.type !== kind || result.asymmetricKeyType !== 'ed25519')
+            throw new Error('Ed25519 key required');
+        return result;
+    }
+    finally {
+        bytes.fill(0);
+    }
+}
+function safeOutput(response) {
+    return JSON.stringify({ status: response.status, state: response.state, ...(response.error === null ? {} : { error: response.error }) }) + '\n';
+}
+async function admin(command, config, args) {
+    if (!config.adminPrivateKeyPath || !config.adminKeyId || !config.adminInstanceId || !config.adminGeneration)
+        throw new Error('operator credentials required');
+    const [serverPublicKey, adminPrivateKey] = await Promise.all([key(config.brokerPublicKeyPath, 'public'), key(config.adminPrivateKeyPath, 'private')]);
+    const intent = adminIntent(command, args, Date.now(), config.requestTimeoutMs);
+    return await requestGitHubBrokerAdmin({
+        socketPath: config.adminSocketPath, serverPublicKey, timeoutMs: config.requestTimeoutMs, maxHelloTtlMs: config.helloTtlMs, expectedSocketUid: config.expectedAdminSocketUid, expectedSocketGid: config.expectedAdminSocketGid,
+        expectedSocketMode: config.expectedAdminSocketMode, expectedSocketParentUid: config.expectedAdminParentUid, expectedSocketParentGid: config.expectedAdminParentGid, expectedSocketParentMode: config.expectedAdminParentMode,
+        inspectPeerCredentials: inspectLinuxPeerCredentials, expectedBrokerPeerUid: config.expectedBrokerPeerUid, expectedBrokerPeerGid: config.expectedBrokerPeerGid,
+        expectedServerInstanceId: config.brokerId, minimumServerGeneration: config.minimumBrokerGeneration,
+    }, intent, { kind: 'assistant-actions-admin', instanceId: config.adminInstanceId, generation: config.adminGeneration }, config.adminKeyId, adminPrivateKey);
+}
+function productionCore(config) {
+    return createExternalBrokerCore(normalizeExternalBrokerCoreConfig({ instanceId: config.brokerId, statePath: config.statePath, credentials: config.credentials, grants: config.grants, policyEpoch: config.policyEpoch,
+        ...(config.controllerTtlMs === undefined ? {} : { controllerTtlMs: config.controllerTtlMs }),
+        ...(config.credentialMaxBytes === undefined ? {} : { credentialMaxBytes: config.credentialMaxBytes }) }));
+}
+async function serve(config, dependencies) {
+    const createCore = dependencies.createCore ?? productionCore;
+    const available = dependencies.peerCredentialsAvailable?.() ?? (dependencies.peerInspector === undefined && linuxPeerCredentialsAvailable());
+    if (!available && dependencies.peerInspector === undefined)
+        throw new Error('Linux peer credentials unavailable');
+    const peer = dependencies.peerInspector ?? inspectLinuxPeerCredentials;
+    const [serverPrivateKey, clientPublicKey, adminPublicKey] = await Promise.all([key(config.serverPrivateKeyPath, 'private'), key(config.clientPublicKeyPath, 'public'), key(config.adminPublicKeyPath, 'public')]);
+    const serverPublicKey = createPublicKey(serverPrivateKey);
+    if (config.clientKeyId === config.adminKeyId || serverPublicKey.equals(clientPublicKey) || serverPublicKey.equals(adminPublicKey) || clientPublicKey.equals(adminPublicKey))
+        throw new Error('broker signing keys must be distinct');
+    const core = await createCore(config);
+    let server;
+    try {
+        const generation = core.snapshot().generation;
+        if (!integer(generation, config.minimumBrokerGeneration, Number.MAX_SAFE_INTEGER))
+            throw new Error('broker generation regressed');
+        const options = {
+            actionSocketPath: config.actionSocketPath, adminSocketPath: config.adminSocketPath, instanceId: config.brokerId, generation, serverPrivateKey, clientPublicKey, clientKeyId: config.clientKeyId,
+            adminPublicKey, adminKeyId: config.adminKeyId, core, inspectPeerCredentials: peer,
+            expectedClientPeerUid: config.expectedClientPeerUid, expectedClientPeerGid: config.expectedClientPeerGid, expectedAdminPeerUid: config.expectedAdminPeerUid, expectedAdminPeerGid: config.expectedAdminPeerGid,
+            expectedActionSocketUid: config.expectedActionSocketUid, expectedActionSocketGid: config.expectedActionSocketGid, expectedActionParentMode: config.expectedActionParentMode, expectedActionSocketMode: config.expectedActionSocketMode,
+            expectedAdminSocketUid: config.expectedAdminSocketUid, expectedAdminSocketGid: config.expectedAdminSocketGid, expectedAdminParentMode: config.expectedAdminParentMode, expectedAdminSocketMode: config.expectedAdminSocketMode,
+            maxActionConnections: config.maxActionConnections, maxAdminConnections: config.maxAdminConnections, maxConcurrentRequests: config.maxConcurrentRequests,
+            firstByteTimeoutMs: Math.min(2_000, config.requestTimeoutMs), frameTimeoutMs: Math.min(10_000, config.requestTimeoutMs),
+            totalTimeoutMs: config.requestTimeoutMs, helloTtlMs: config.helloTtlMs, drainTimeoutMs: config.drainTimeoutMs,
+        };
+        dependencies.onServerReady?.(options);
+        server = await startGitHubBrokerServer(options);
+    }
+    catch (error) {
+        await Promise.resolve(core.close()).catch(() => undefined);
+        throw error;
+    }
+    await new Promise((resolveServe, rejectServe) => {
+        let stopping = false;
+        const removeSignals = () => { process.off('SIGTERM', onTerm); process.off('SIGINT', onInterrupt); };
+        const stop = (reason) => {
+            if (stopping)
+                return;
+            stopping = true;
+            removeSignals();
+            void server.stop(reason).then(resolveServe, rejectServe);
+        };
+        const onTerm = () => stop('sigterm');
+        const onInterrupt = () => stop('sigint');
+        process.once('SIGTERM', onTerm);
+        process.once('SIGINT', onInterrupt);
+    });
+}
+export async function runBrokerCli(argv, dependencies = {}) {
+    const stdout = dependencies.stdout ?? process.stdout, stderr = dependencies.stderr ?? process.stderr;
+    try {
+        const [command, configPath, ...args] = argv;
+        if (!command || !configPath || !['serve', 'status', 'stop', 'resume', 'revoke'].includes(command))
+            throw new Error('invalid command');
+        const config = await loadBrokerCliConfig(configPath, command === 'serve');
+        if (command === 'serve') {
+            if (args.length !== 0)
+                throw new Error('invalid arguments');
+            await serve(config, dependencies);
+            return 0;
+        }
+        const response = await admin(command, config, args);
+        stdout.write(safeOutput(response));
+        return response.status === 'succeeded' ? 0 : 1;
+    }
+    catch {
+        stderr.write(FAILURE);
+        return 1;
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    process.exitCode = await runBrokerCli(process.argv.slice(2));
+}
+//# sourceMappingURL=broker-cli.js.map

package/lib/broker-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-cli.js","sourceRoot":"","sources":["../src/broker-cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,iCAAiC,EAAsC,MAAM,kBAAkB,CAAA;AAElI,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAA;AAEnG,OAAO,EAAE,uBAAuB,EAAiG,MAAM,oBAAoB,CAAA;AAE3J,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,UAAU,GAAG,sCAAsC,CAAA;AACzD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAA;AACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAA;AAC5G,MAAM,OAAO,GAAG,iEAAiE,CAAA;AAoEjF,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,CAAA;AAClI,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,gBAAgB;IAC7E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,CAAA;AACzG,CAAC;AACD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7H,CAAC;AACD,SAAS,KAAK,CAAC,KAA8B,EAAE,OAA0B,EAAE,QAA2B;IACpG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;AACnJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAI,GAAG,KAAK,EAAE,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACpI,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAA;IACjF,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAChH,IAAI,eAAe,KAAK,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,GAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACrO,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,KAAO,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAC7N,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7G,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACtP,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QAAC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,eAAuB,EAAE,eAAuB,EAAE,WAAoB;IACnH,IAAI,MAAM,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IAC9B,SAAS,CAAC;QACR,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAChG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAO,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxF,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QAC7E,IAAI,SAAS,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eAC1G,IAAI,IAAI,WAAW,IAAI,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,eAAe,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACjJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,OAAM;QAC7B,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,GAAG,KAAK,CAAA;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAc;IACtD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,CAAC,iBAAiB,EAAE,UAAU,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,YAAY,CAAU,CAAA;IACxa,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,aAAa,EAAE,qBAAqB,EAAE,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,CAAU,CAAA;IAC5tB,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,iBAAiB,IAAI,GAAG,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC3I,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACvN,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,mBAAmB,CAAC;WAC9I,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;WAChL,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,KAAK,CAAC;WACnK,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,KAAK,CAAC;WACnK,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC9J,IAAI,KAAK,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;WAC3L,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,kBAAkB;WAC9I,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,kBAAkB;WACnH,CAAC,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,GAAG;WACxO,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,UAAU,CAAC;WAC/I,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,UAAU,CAAC;WAC1G,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,EAAE,KAAK,CAAC;WAC5N,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,KAAK,CAAC;WACxN,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,KAAK,CAAC,oBAA8B,CAAC;WAC9K,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;WACjJ,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC;WACtF,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACtI,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAmD,CAAA;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAK,GAAG,KAAK;IACnE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACvF,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAAC,CAAC;IAC/F,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IACzF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAA;AACf,CAAC;AACD,SAAS,KAAK,CAAC,KAAyB;IACtC,IAAI,CAAC,KAAK,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACnF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAuB,EAAE,GAAW,EAAE,SAAiB;IAC3F,MAAM,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAA;IAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACzE,IAAI,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAA;IACjG,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAA;QAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACrE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAkE,EAAE,EAAE,QAAQ,EAAE,CAAA;IAC/L,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAA;IAChL,IAAI,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAA;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAC9I,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAuF,EAAE,EAAE,QAAQ,EAAE,CAAA;IACtU,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAA0B;IACzD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QACpF,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QAC3G,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,QAA6B;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;AACjJ,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAAe,EAAE,MAAuB,EAAE,IAAuB;IACpF,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC7J,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IACrJ,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC9E,OAAO,MAAM,wBAAwB,CAAC;QACpC,UAAU,EAAE,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,CAAC,sBAAsB;QAC7N,kBAAkB,EAAE,MAAM,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,CAAC,uBAAuB;QAC5N,sBAAsB,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QAC7J,wBAAwB,EAAE,MAAM,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;KACnG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;AAC7J,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,wBAAwB,CAAC,iCAAiC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;QACnN,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5F,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AAC7G,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,MAAyB,EAAE,YAAmC;IACjF,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,cAAc,CAAA;IAC5D,MAAM,SAAS,GAAG,YAAY,CAAC,wBAAwB,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,IAAI,6BAA6B,EAAE,CAAC,CAAA;IAC5I,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,aAAa,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACjH,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,IAAI,2BAA2B,CAAA;IACtE,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACjN,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,UAAU,IAAI,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACpO,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAA;QAC7C,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QACjI,MAAM,OAAO,GAA8B;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/L,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI;YACjF,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YAC9M,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;YACtO,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;YAC9N,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACvJ,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACvH,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;SAC9G,CAAA;QACD,YAAY,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;IAC3F,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;QACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,MAAM,aAAa,GAAG,GAAS,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA,CAAC,CAAC,CAAA;QACxG,MAAM,IAAI,GAAG,CAAC,MAA4B,EAAQ,EAAE;YAClD,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,aAAa,EAAE,CAAA;YACf,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAC1D,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,WAAW,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB,EAAE,eAAsC,EAAE;IAClG,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAA;IACpG,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;QAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACrI,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC,CAAA;QACzE,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,MAA2B,EAAE,YAAY,CAAC,CAAC;YAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QAC1J,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAyB,EAAE,IAAI,CAAC,CAAA;QACtE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,CAAA;IAAC,CAAC;AAC7C,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC"}

package/lib/broker-client.d.ts

@@ -0,0 +1,54 @@
+import { type Socket } from 'node:net';
+import type { KeyObject } from 'node:crypto';
+import { type BrokerAdminEndpoint, type BrokerAdminIntent, type BrokerAdminResponse, type BrokerClientRequest, type BrokerEndpoint, type BrokerRequestIntent, type BrokerServerHello, type BrokerServerResponse } from './broker-protocol.js';
+type KeyInput = KeyObject | string | Buffer;
+export type BrokerDispatchState = 'not-dispatched' | 'post-dispatch-unknown';
+export type BrokerClientErrorCode = 'invalid-config' | 'socket-invalid' | 'socket-changed' | 'connect-failed' | 'timeout' | 'aborted' | 'authorization-rejected' | 'disconnected' | 'protocol-error';
+export declare class BrokerClientError extends Error {
+    readonly code: BrokerClientErrorCode;
+    readonly dispatchState: BrokerDispatchState;
+    readonly retryable = false;
+    constructor(code: BrokerClientErrorCode, dispatchState: BrokerDispatchState, message: string, options?: ErrorOptions);
+    get postDispatchUnknown(): boolean;
+}
+export declare class BrokerPostDispatchUnknownError extends BrokerClientError {
+    constructor(code: BrokerClientErrorCode, message: string, options?: ErrorOptions);
+}
+export interface GitHubBrokerConnectionOptions {
+    socketPath: string;
+    serverPublicKey: KeyInput;
+    timeoutMs?: number;
+    maxHelloTtlMs?: number;
+    expectedSocketUid?: number;
+    expectedSocketGid?: number;
+    expectedSocketMode?: number;
+    expectedSocketParentUid?: number;
+    expectedSocketParentGid?: number;
+    expectedSocketParentMode?: number;
+    inspectPeerCredentials?: (socket: Socket, signal: AbortSignal) => {
+        uid: number;
+        gid: number;
+        pid?: number;
+    } | undefined | Promise<{
+        uid: number;
+        gid: number;
+        pid?: number;
+    } | undefined>;
+    expectedBrokerPeerUid: number;
+    expectedBrokerPeerGid: number;
+    expectedServerInstanceId?: string;
+    minimumServerGeneration?: number;
+}
+export interface GitHubBrokerClientOptions extends GitHubBrokerConnectionOptions {
+    clientPrivateKey: KeyInput;
+    clientKeyId: string;
+    source: Extract<BrokerEndpoint, {
+        kind: 'assistant-actions-host';
+    }>;
+    beforeWrite?: (hello: BrokerServerHello, request: BrokerClientRequest, signal: AbortSignal) => void | Promise<void>;
+}
+export declare function requestGitHubBroker(options: GitHubBrokerClientOptions, intent: BrokerRequestIntent, signal?: AbortSignal): Promise<BrokerServerResponse>;
+/** Signed operator control request over the same one-request UDS transport. */
+export declare function requestGitHubBrokerAdmin(options: GitHubBrokerConnectionOptions, intent: BrokerAdminIntent, source: BrokerAdminEndpoint, adminKeyId: string, adminPrivateKey: KeyInput, signal?: AbortSignal): Promise<BrokerAdminResponse>;
+export {};
+//# sourceMappingURL=broker-client.d.ts.map

package/lib/broker-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.d.ts","sourceRoot":"","sources":["../src/broker-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAA;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,OAAO,EAGL,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,KAAK,oBAAoB,EACvM,MAAM,sBAAsB,CAAA;AAE7B,KAAK,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAA;AAC3C,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,uBAAuB,CAAA;AAC5E,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,wBAAwB,GAAG,cAAc,GAAG,gBAAgB,CAAA;AAEpM,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAA;IAC3C,QAAQ,CAAC,SAAS,SAAQ;gBACd,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;IAMpH,IAAI,mBAAmB,IAAI,OAAO,CAA0D;CAC7F;AAED,qBAAa,8BAA+B,SAAQ,iBAAiB;gBACvD,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CACjF;AAED,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,QAAQ,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IAC1L,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qBAAqB,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC;AACD,MAAM,WAAW,yBAA0B,SAAQ,6BAA6B;IAC9E,gBAAgB,EAAE,QAAQ,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE;QAAE,IAAI,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAA;IACnE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpH;AA4KD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAK9J;AAED,+EAA+E;AAC/E,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,6BAA6B,EACtC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,mBAAmB,EAC3B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,QAAQ,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAK9B"}

package/lib/broker-client.js

@@ -0,0 +1,266 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { createConnection } from 'node:net';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { inspectLinuxPeerCredentials } from './broker-peer-linux.js';
+import { BrokerFrameDecoder, BrokerProtocolError, GITHUB_BROKER_DEFAULT_HELLO_TTL_MS, GITHUB_BROKER_REQUEST_MAX_BYTES, GITHUB_BROKER_RESPONSE_MAX_BYTES, createBrokerAdminRequest, createBrokerClientRequest, encodeBrokerFrame, verifyBrokerAdminResponse, verifyBrokerServerHello, verifyBrokerServerResponse, } from './broker-protocol.js';
+export class BrokerClientError extends Error {
+    code;
+    dispatchState;
+    retryable = false;
+    constructor(code, dispatchState, message, options) {
+        super(`assistant-actions broker client: ${message}`, options);
+        this.name = dispatchState === 'post-dispatch-unknown' ? 'BrokerPostDispatchUnknownError' : 'BrokerClientError';
+        this.code = code;
+        this.dispatchState = dispatchState;
+    }
+    get postDispatchUnknown() { return this.dispatchState === 'post-dispatch-unknown'; }
+}
+export class BrokerPostDispatchUnknownError extends BrokerClientError {
+    constructor(code, message, options) { super(code, 'post-dispatch-unknown', message, options); }
+}
+function fail(code, dispatched, message, cause) {
+    const options = cause === undefined ? undefined : { cause };
+    return dispatched ? new BrokerPostDispatchUnknownError(code, message, options) : new BrokerClientError(code, 'not-dispatched', message, options);
+}
+function integer(value, minimum, maximum) { return typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum && value <= maximum; }
+async function inspectSocket(options) {
+    const path = options.socketPath;
+    if (!isAbsolute(path) || resolve(path) !== path || path === '/')
+        throw fail('invalid-config', false, 'canonical absolute socket path required');
+    const parentPath = dirname(path);
+    let canonical, canonicalParent, stat, after, parent, parentAfter;
+    try {
+        stat = await lstat(path, { bigint: true });
+        parent = await lstat(parentPath, { bigint: true });
+        canonical = await realpath(path);
+        canonicalParent = await realpath(parentPath);
+        after = await lstat(path, { bigint: true });
+        parentAfter = await lstat(parentPath, { bigint: true });
+    }
+    catch (error) {
+        throw fail('socket-invalid', false, 'socket cannot be inspected', error);
+    }
+    if (canonical !== path || stat.isSymbolicLink() || !stat.isSocket() || after.isSymbolicLink() || !after.isSocket()
+        || stat.dev !== after.dev || stat.ino !== after.ino || stat.uid !== after.uid || stat.gid !== after.gid || stat.mode !== after.mode)
+        throw fail('socket-invalid', false, 'socket path must name one stable canonical Unix socket directly');
+    const uid = BigInt(options.expectedSocketUid ?? process.getuid?.() ?? -1);
+    const gid = BigInt(options.expectedSocketGid ?? process.getgid?.() ?? -1);
+    const mode = options.expectedSocketMode ?? 0o600;
+    const parentUid = BigInt(options.expectedSocketParentUid ?? options.expectedSocketUid ?? process.getuid?.() ?? -1);
+    const parentGid = BigInt(options.expectedSocketParentGid ?? options.expectedSocketGid ?? process.getgid?.() ?? -1);
+    const parentMode = options.expectedSocketParentMode ?? 0o700;
+    if (!integer(mode, 0, 0o777) || (mode & 0o007) !== 0 || !integer(parentMode, 0, 0o777) || (parentMode & 0o022) !== 0 || stat.uid !== uid || stat.gid !== gid || Number(stat.mode & 4095n) !== mode
+        || canonicalParent !== parentPath || !parent.isDirectory() || parent.isSymbolicLink() || !parentAfter.isDirectory() || parentAfter.isSymbolicLink()
+        || parent.dev !== parentAfter.dev || parent.ino !== parentAfter.ino || parent.uid !== parentAfter.uid || parent.gid !== parentAfter.gid || parent.mode !== parentAfter.mode
+        || parent.uid !== parentUid || parent.gid !== parentGid || Number(parent.mode & 4095n) !== parentMode)
+        throw fail('socket-invalid', false, 'socket or parent ownership and mode do not match the pinned identity');
+    return { dev: stat.dev, ino: stat.ino, uid: stat.uid, gid: stat.gid, mode: Number(stat.mode & 4095n), parentDev: parent.dev, parentIno: parent.ino, parentUid: parent.uid, parentGid: parent.gid, parentMode: Number(parent.mode & 4095n) };
+}
+async function assertSameSocket(options, before) {
+    let after;
+    try {
+        after = await inspectSocket(options);
+    }
+    catch (error) {
+        throw fail('socket-changed', false, 'socket changed while connecting', error);
+    }
+    if (after.dev !== before.dev || after.ino !== before.ino || after.uid !== before.uid || after.gid !== before.gid || after.mode !== before.mode
+        || after.parentDev !== before.parentDev || after.parentIno !== before.parentIno || after.parentUid !== before.parentUid || after.parentGid !== before.parentGid || after.parentMode !== before.parentMode)
+        throw fail('socket-changed', false, 'socket identity changed while connecting');
+}
+function validateConnectionOptions(options) {
+    if (!isAbsolute(options.socketPath) || resolve(options.socketPath) !== options.socketPath || options.socketPath === '/' || options.socketPath.includes('\0') || Buffer.byteLength(options.socketPath) > 100
+        || !integer(options.timeoutMs ?? 30_000, 1, 300_000) || !integer(options.maxHelloTtlMs ?? GITHUB_BROKER_DEFAULT_HELLO_TTL_MS, 1, 300_000)
+        || options.expectedSocketUid !== undefined && !integer(options.expectedSocketUid, 0, 0x7fffffff)
+        || options.expectedSocketGid !== undefined && !integer(options.expectedSocketGid, 0, 0x7fffffff)
+        || options.expectedSocketMode !== undefined && (!integer(options.expectedSocketMode, 0, 0o777) || (options.expectedSocketMode & 0o007) !== 0)
+        || options.expectedSocketParentUid !== undefined && !integer(options.expectedSocketParentUid, 0, 0x7fffffff)
+        || options.expectedSocketParentGid !== undefined && !integer(options.expectedSocketParentGid, 0, 0x7fffffff)
+        || options.expectedSocketParentMode !== undefined && (!integer(options.expectedSocketParentMode, 0, 0o777) || (options.expectedSocketParentMode & 0o022) !== 0)
+        || options.inspectPeerCredentials !== undefined && typeof options.inspectPeerCredentials !== 'function' || !integer(options.expectedBrokerPeerUid, 0, 0x7fffffff) || !integer(options.expectedBrokerPeerGid, 0, 0x7fffffff)
+        || options.expectedServerInstanceId !== undefined && (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(options.expectedServerInstanceId))
+        || options.minimumServerGeneration !== undefined && !integer(options.minimumServerGeneration, 1, Number.MAX_SAFE_INTEGER))
+        throw fail('invalid-config', false, 'client options are invalid');
+}
+/**
+ * Perform exactly one authenticated request on a fresh Unix-domain connection.
+ * No error is retried. Once the request frame starts writing, every local
+ * failure is conservatively reported as a post-dispatch unknown outcome.
+ */
+async function requestBroker(options, deadline, makeRequest, verifyResponse, beforeWrite, signal) {
+    validateConnectionOptions(options);
+    if (signal?.aborted)
+        throw fail('aborted', false, 'request was aborted before connect', signal.reason);
+    const before = await inspectSocket(options);
+    if (signal?.aborted)
+        throw fail('aborted', false, 'request was aborted before connect', signal.reason);
+    const decoder = new BrokerFrameDecoder(GITHUB_BROKER_RESPONSE_MAX_BYTES, 2);
+    return await new Promise((resolvePromise, rejectPromise) => {
+        let socket;
+        let settled = false, connected = false, requestStarted = false, ended = false;
+        let hello, request, response;
+        const operationController = new AbortController();
+        const timer = setTimeout(() => stop('timeout', 'broker request timed out'), options.timeoutMs ?? 30_000);
+        timer.unref();
+        const cleanup = () => {
+            clearTimeout(timer);
+            operationController.abort(new Error('broker request settled'));
+            signal?.removeEventListener('abort', onAbort);
+            socket?.removeAllListeners();
+            if (!socket?.destroyed)
+                socket?.destroy();
+        };
+        const finish = (value) => { if (!settled) {
+            settled = true;
+            cleanup();
+            resolvePromise(value);
+        } };
+        const stop = (code, message, cause) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            rejectPromise(fail(code, requestStarted, message, cause));
+        };
+        const onAbort = () => stop('aborted', 'broker request was aborted', signal?.reason);
+        const acceptHello = (value) => {
+            try {
+                const verifiedHello = verifyBrokerServerHello(value, options.serverPublicKey, {
+                    ...(options.maxHelloTtlMs === undefined ? {} : { maxTtlMs: options.maxHelloTtlMs }),
+                    ...(options.expectedServerInstanceId === undefined ? {} : { expectedInstanceId: options.expectedServerInstanceId }),
+                    ...(options.minimumServerGeneration === undefined ? {} : { minimumGeneration: options.minimumServerGeneration }),
+                });
+                if (Date.now() >= deadline)
+                    throw new BrokerProtocolError('expired-request', 'request deadline expired');
+                const verifiedRequest = makeRequest(verifiedHello);
+                hello = verifiedHello;
+                request = verifiedRequest;
+                socket.pause();
+                void runBeforeWrite(beforeWrite, verifiedHello, verifiedRequest, operationController.signal).then(() => {
+                    if (settled)
+                        return;
+                    if (signal?.aborted) {
+                        stop('aborted', 'broker request was aborted before dispatch', signal.reason);
+                        return;
+                    }
+                    if (Date.now() >= deadline || Date.now() >= verifiedHello.expiresAt) {
+                        stop('timeout', 'broker request or hello expired before dispatch');
+                        return;
+                    }
+                    let frame;
+                    try {
+                        frame = encodeBrokerFrame(verifiedRequest, GITHUB_BROKER_REQUEST_MAX_BYTES);
+                    }
+                    catch (error) {
+                        stop('protocol-error', 'broker request encoding failed', error);
+                        return;
+                    }
+                    requestStarted = true;
+                    try {
+                        socket.write(frame, error => { if (error)
+                            stop('disconnected', 'request frame write failed', error); });
+                    }
+                    catch (error) {
+                        stop('disconnected', 'request frame write failed', error);
+                        return;
+                    }
+                    socket.resume();
+                }, error => { if (!settled)
+                    stop('authorization-rejected', 'pre-dispatch authorization changed', error); });
+            }
+            catch (error) {
+                stop('protocol-error', 'broker message validation failed', error);
+            }
+        };
+        const onData = (chunk) => {
+            try {
+                const values = decoder.push(chunk);
+                if (!hello) {
+                    if (values.length === 0)
+                        return;
+                    if (values.length !== 1)
+                        throw new BrokerProtocolError('trailing-data', 'broker sent data before receiving a request');
+                    acceptHello(values[0]);
+                    return;
+                }
+                for (const value of values) {
+                    if (response || !request)
+                        throw new BrokerProtocolError('trailing-data', 'unexpected extra broker frame');
+                    response = verifyResponse(value, request, hello);
+                }
+            }
+            catch (error) {
+                stop('protocol-error', 'broker frame validation failed', error);
+            }
+        };
+        const onEnd = () => {
+            ended = true;
+            try {
+                decoder.finish();
+            }
+            catch (error) {
+                stop('protocol-error', 'broker connection ended with an invalid frame', error);
+                return;
+            }
+            if (decoder.frameCount !== 2 || !response) {
+                stop('disconnected', 'broker disconnected before a complete signed response');
+                return;
+            }
+            finish(response);
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        try {
+            socket = createConnection({ path: options.socketPath });
+            // The peer may send immediately after accept. Buffer it until the second
+            // pathname identity check succeeds; no authenticated request is written
+            // while a replacement race is unresolved.
+            socket.pause();
+            socket.on('data', onData);
+            socket.once('error', error => stop(connected ? 'disconnected' : 'connect-failed', connected ? 'broker connection failed' : 'broker connect failed', error));
+            socket.once('end', onEnd);
+            socket.once('close', hadError => { if (!settled && !ended)
+                stop('disconnected', hadError ? 'broker connection closed with an error' : 'broker connection closed without a complete response'); });
+            socket.once('connect', () => {
+                connected = true;
+                const inspectPeer = options.inspectPeerCredentials ?? inspectLinuxPeerCredentials;
+                void Promise.all([assertSameSocket(options, before), Promise.resolve(inspectPeer(socket, operationController.signal))]).then(([, peer]) => {
+                    if (!peer || !integer(peer.uid, 0, 0x7fffffff) || !integer(peer.gid, 0, 0x7fffffff) || peer.pid !== undefined && !integer(peer.pid, 1, 0x7fffffff)
+                        || peer.uid !== options.expectedBrokerPeerUid || peer.gid !== options.expectedBrokerPeerGid) {
+                        stop('socket-changed', 'connected broker peer identity does not match');
+                        return;
+                    }
+                    if (!settled)
+                        socket?.resume();
+                }, error => stop('socket-changed', 'socket or broker peer identity changed while connecting', error));
+            });
+        }
+        catch (error) {
+            stop('connect-failed', 'broker connect failed', error);
+        }
+    });
+}
+async function runBeforeWrite(hook, hello, request, signal) {
+    if (!hook)
+        return;
+    if (signal.aborted)
+        throw signal.reason;
+    const operation = Promise.resolve().then(() => hook(hello, request, signal));
+    operation.catch(() => { });
+    await new Promise((resolveGate, rejectGate) => {
+        const onAbort = () => { signal.removeEventListener('abort', onAbort); rejectGate(signal.reason); };
+        signal.addEventListener('abort', onAbort, { once: true });
+        operation.then(() => { signal.removeEventListener('abort', onAbort); resolveGate(); }, error => { signal.removeEventListener('abort', onAbort); rejectGate(error); });
+    });
+}
+export async function requestGitHubBroker(options, intent, signal) {
+    if (options.source.kind !== 'assistant-actions-host' || !integer(options.source.generation, 1, Number.MAX_SAFE_INTEGER))
+        throw fail('invalid-config', false, 'client identity is invalid');
+    return await requestBroker(options, intent.deadline, hello => createBrokerClientRequest(intent, hello, options.source, options.clientKeyId, options.clientPrivateKey), (value, request, hello) => verifyBrokerServerResponse(value, request, hello, options.serverPublicKey), options.beforeWrite, signal);
+}
+/** Signed operator control request over the same one-request UDS transport. */
+export async function requestGitHubBrokerAdmin(options, intent, source, adminKeyId, adminPrivateKey, signal) {
+    if (source.kind !== 'assistant-actions-admin' || !integer(source.generation, 1, Number.MAX_SAFE_INTEGER))
+        throw fail('invalid-config', false, 'admin identity is invalid');
+    return await requestBroker(options, intent.deadline, hello => createBrokerAdminRequest(intent, hello, source, adminKeyId, adminPrivateKey), (value, request, hello) => verifyBrokerAdminResponse(value, request, hello, options.serverPublicKey), undefined, signal);
+}
+//# sourceMappingURL=broker-client.js.map