@gtc6244/immediacy-daemon 0.2.2 → 0.2.4

package/dist/src/crypto.d.ts

@@ -1,49 +1,28 @@
 /**
- * E2E crypto (slice 5) — keep the Cloudflare edge blind.
+ * Wire codecs — the (de)serialization seam for the envelope transport.
  *
- * Cloudflare terminates TLS and can see plaintext. We additionally seal the
- * envelope `payload` with crypto_box (X25519 + XSalsa20-Poly1305 — NaCl box),
- * wire-compatible with libsodium's `crypto_box_easy` on the Flutter side
- * (sodium_libs). The outer fields (v, id, ts, ws, type) stay clear for routing.
- *
- * On the wire an encrypted payload is: { n: base64(nonce), c: base64(cipher) }.
- *
- * This is IN ADDITION to Cloudflare Access — Access does authn/authz at the
- * edge; the box keeps payload contents private from the edge.
+ * Since the Cloudflare-tunnel cutover (docs/WEBRTC_MIGRATION.md Phase 5) the only
+ * E2E path is the §5.3 session handshake, whose `SecureChannel` seals each frame
+ * with AES-256-GCM. The legacy NaCl `crypto_box` layer (paired to a Cloudflare
+ * Access gate) has been removed. Two codecs remain:
+ *   - clearCodec:   cleartext JSON (local dev, and a socket before it seals).
+ *   - sessionCodec: seals the envelope payload with a handshake SecureChannel.
  */
 import type { Envelope } from "./protocol.js";
-export interface Keypair {
-    publicKey: Buffer;
-    secretKey: Buffer;
-}
-/** Load the daemon keypair, generating + persisting one on first run. */
-export declare function loadOrCreateKeypair(): Promise<Keypair>;
-/** One paired client. `pub` is base64 of its X25519 public key. */
-export interface Peer {
-    pub: string;
-    addedAt: number;
-    label?: string;
-}
-/** True iff `b64` is canonical base64 of a full-length crypto_box public key. */
-export declare function isValidPublicKeyB64(b64: string): boolean;
-/**
- * Every paired client. Reads `peers.json`, migrating a legacy single-peer
- * `peer.json` (and honoring the PEER_PUBLIC_KEY dev override) on first read so
- * an existing pairing keeps working after the multi-device upgrade.
- */
-export declare function loadPeers(): Promise<Peer[]>;
-/**
- * Add a client public key to the paired set (idempotent) and persist. Returns
- * the updated list. Trust-on-first-use: the caller has already cleared the
- * Cloudflare Access gate, which is the shared pairing secret.
- */
-export declare function addPeer(pub: string, label?: string): Promise<Peer[]>;
+import type { SecureChannel } from "./session.js";
 /** Codec abstraction so the server/hub don't care whether crypto is on. */
 export interface Codec {
     encode(env: Envelope): string;
     decode(raw: string): Envelope;
 }
-/** Cleartext codec (slices 1–4 default, and local dev). */
+/** Cleartext codec (local dev, and any socket before it completes a handshake). */
 export declare const clearCodec: Codec;
-/** NaCl-box codec: seals/opens only the `payload` field. */
-export declare function boxCodec(self: Keypair, peerPublicKey: Buffer): Codec;
+/**
+ * Session codec (docs/WEBRTC_MIGRATION.md §5.3). Seals/opens the envelope
+ * `payload` with a `SecureChannel` established by the signed handshake, on a
+ * single ordered socket. On the wire the payload is `{ s: base64(cipher) }`;
+ * the nonce is the channel's per-direction counter (not transmitted), so this
+ * REQUIRES ordered, non-lossy delivery — true for the WS/loopback socket it runs
+ * on.
+ */
+export declare function sessionCodec(channel: SecureChannel): Codec;

package/dist/src/crypto.js

@@ -1,169 +1,53 @@
 /**
- * E2E crypto (slice 5) — keep the Cloudflare edge blind.
+ * Wire codecs — the (de)serialization seam for the envelope transport.
  *
- * Cloudflare terminates TLS and can see plaintext. We additionally seal the
- * envelope `payload` with crypto_box (X25519 + XSalsa20-Poly1305 — NaCl box),
- * wire-compatible with libsodium's `crypto_box_easy` on the Flutter side
- * (sodium_libs). The outer fields (v, id, ts, ws, type) stay clear for routing.
- *
- * On the wire an encrypted payload is: { n: base64(nonce), c: base64(cipher) }.
- *
- * This is IN ADDITION to Cloudflare Access — Access does authn/authz at the
- * edge; the box keeps payload contents private from the edge.
+ * Since the Cloudflare-tunnel cutover (docs/WEBRTC_MIGRATION.md Phase 5) the only
+ * E2E path is the §5.3 session handshake, whose `SecureChannel` seals each frame
+ * with AES-256-GCM. The legacy NaCl `crypto_box` layer (paired to a Cloudflare
+ * Access gate) has been removed. Two codecs remain:
+ *   - clearCodec:   cleartext JSON (local dev, and a socket before it seals).
+ *   - sessionCodec: seals the envelope payload with a handshake SecureChannel.
  */
-import sodium from "sodium-native";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile, chmod } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
 import { ProtocolError } from "./envelope.js";
-const KEYS_FILE = process.env.KEYS_FILE ?? join(homedir(), ".immediacy", "keys.json");
-const PEER_FILE = process.env.PEER_FILE ?? join(homedir(), ".immediacy", "peer.json");
-// Multi-device pairing: the set of every client public key we've paired with,
-// so encryption isn't pinned to one device (the old single PEER_FILE). Each
-// entry is bound to its own socket at connect time (per-socket sealing).
-const PEERS_FILE = process.env.PEERS_FILE ?? join(homedir(), ".immediacy", "peers.json");
-/** Load the daemon keypair, generating + persisting one on first run. */
-export async function loadOrCreateKeypair() {
-    if (existsSync(KEYS_FILE)) {
-        const j = JSON.parse(await readFile(KEYS_FILE, "utf8"));
-        return {
-            publicKey: Buffer.from(j.publicKey, "base64"),
-            secretKey: Buffer.from(j.secretKey, "base64"),
-        };
-    }
-    const publicKey = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES);
-    const secretKey = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES);
-    sodium.crypto_box_keypair(publicKey, secretKey);
-    await mkdir(dirname(KEYS_FILE), { recursive: true });
-    await writeFile(KEYS_FILE, JSON.stringify({
-        publicKey: publicKey.toString("base64"),
-        secretKey: secretKey.toString("base64"),
-    }), "utf8");
-    await chmod(KEYS_FILE, 0o600); // secret key — never world-readable
-    return { publicKey, secretKey };
-}
-/** True iff `b64` is canonical base64 of a full-length crypto_box public key. */
-export function isValidPublicKeyB64(b64) {
-    // Node's Buffer.from(x, "base64") never throws and silently drops invalid
-    // characters, so a decoded-length check alone lets malformed input through.
-    // Require a strict base64 alphabet up front, then confirm the value
-    // round-trips to the exact same canonical string at the expected length.
-    if (typeof b64 !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(b64))
-        return false;
-    const buf = Buffer.from(b64, "base64");
-    return (buf.length === sodium.crypto_box_PUBLICKEYBYTES && buf.toString("base64") === b64);
-}
-/**
- * Every paired client. Reads `peers.json`, migrating a legacy single-peer
- * `peer.json` (and honoring the PEER_PUBLIC_KEY dev override) on first read so
- * an existing pairing keeps working after the multi-device upgrade.
- */
-export async function loadPeers() {
-    const peers = [];
-    const seen = new Set();
-    const push = (pub, label) => {
-        if (!pub || seen.has(pub) || !isValidPublicKeyB64(pub))
-            return;
-        seen.add(pub);
-        peers.push({ pub, addedAt: Date.now(), label });
-    };
-    if (existsSync(PEERS_FILE)) {
-        try {
-            const j = JSON.parse(await readFile(PEERS_FILE, "utf8"));
-            for (const p of j.peers ?? []) {
-                // Validate on the way in too: a corrupted or hand-edited peers.json must
-                // not seed invalid keys into the paired set (matches the push() helper).
-                if (p && typeof p.pub === "string" && !seen.has(p.pub) && isValidPublicKeyB64(p.pub)) {
-                    seen.add(p.pub);
-                    peers.push({ pub: p.pub, addedAt: p.addedAt ?? Date.now(), label: p.label });
-                }
-            }
-        }
-        catch {
-            /* corrupt file — fall through to migration/env seeds */
-        }
-    }
-    else if (existsSync(PEER_FILE)) {
-        // Migrate the legacy single-peer file.
-        try {
-            const j = JSON.parse(await readFile(PEER_FILE, "utf8"));
-            if (j.publicKey)
-                push(j.publicKey, "migrated");
-        }
-        catch {
-            /* ignore */
-        }
-    }
-    if (process.env.PEER_PUBLIC_KEY)
-        push(process.env.PEER_PUBLIC_KEY, "env");
-    return peers;
-}
-// Serializes the peers.json read-modify-write so two devices pairing at the
-// same time can't each read the old file and clobber the other's entry.
-let addChain = Promise.resolve([]);
-/**
- * Add a client public key to the paired set (idempotent) and persist. Returns
- * the updated list. Trust-on-first-use: the caller has already cleared the
- * Cloudflare Access gate, which is the shared pairing secret.
- */
-export function addPeer(pub, label) {
-    addChain = addChain.then(async () => {
-        const peers = await loadPeers();
-        if (!peers.some((p) => p.pub === pub)) {
-            peers.push({ pub, addedAt: Date.now(), label });
-            await mkdir(dirname(PEERS_FILE), { recursive: true });
-            await writeFile(PEERS_FILE, JSON.stringify({ peers }, null, 2), "utf8");
-            await chmod(PEERS_FILE, 0o600);
-        }
-        return peers;
-    });
-    return addChain;
-}
-/** Upper bound for one sealed payload — matches the largest legitimate frame
- * (file contents are truncated daemon-side well below this). */
+/** Upper bound for one sealed payload — matches the largest legitimate frame. */
 const MAX_SEALED_BYTES = 16 * 1024 * 1024;
-/** Cleartext codec (slices 1–4 default, and local dev). */
+/** Cleartext codec (local dev, and any socket before it completes a handshake). */
 export const clearCodec = {
     encode: (env) => JSON.stringify(env),
     decode: (raw) => parseEnvelope(raw),
 };
-/** NaCl-box codec: seals/opens only the `payload` field. */
-export function boxCodec(self, peerPublicKey) {
+/**
+ * Session codec (docs/WEBRTC_MIGRATION.md §5.3). Seals/opens the envelope
+ * `payload` with a `SecureChannel` established by the signed handshake, on a
+ * single ordered socket. On the wire the payload is `{ s: base64(cipher) }`;
+ * the nonce is the channel's per-direction counter (not transmitted), so this
+ * REQUIRES ordered, non-lossy delivery — true for the WS/loopback socket it runs
+ * on.
+ */
+export function sessionCodec(channel) {
     return {
         encode(env) {
             const plaintext = Buffer.from(JSON.stringify(env.payload), "utf8");
-            const nonce = Buffer.alloc(sodium.crypto_box_NONCEBYTES);
-            sodium.randombytes_buf(nonce);
-            const cipher = Buffer.alloc(plaintext.length + sodium.crypto_box_MACBYTES);
-            sodium.crypto_box_easy(cipher, plaintext, nonce, peerPublicKey, self.secretKey);
-            const sealed = {
-                ...env,
-                payload: { n: nonce.toString("base64"), c: cipher.toString("base64") },
-            };
-            return JSON.stringify(sealed);
+            const cipher = channel.seal(plaintext);
+            return JSON.stringify({ ...env, payload: { s: cipher.toString("base64") } });
         },
         decode(raw) {
             const env = parseEnvelope(raw, /*allowSealed*/ true);
             const sealed = env.payload;
-            if (typeof sealed.n !== "string" || typeof sealed.c !== "string") {
-                throw new ProtocolError("not_sealed", "payload is not a sealed box");
-            }
-            const nonce = Buffer.from(sealed.n, "base64");
-            const cipher = Buffer.from(sealed.c, "base64");
-            // Validate sizes before allocating: a short ciphertext would make the
-            // alloc below negative (RangeError), and an oversized frame would
-            // allocate unbounded memory — both should fail as protocol errors.
-            if (nonce.length !== sodium.crypto_box_NONCEBYTES) {
-                throw new ProtocolError("bad_sealed_box", "nonce has the wrong length");
+            if (typeof sealed.s !== "string") {
+                throw new ProtocolError("not_sealed", "payload is not a sealed session frame");
             }
-            if (cipher.length < sodium.crypto_box_MACBYTES || cipher.length > MAX_SEALED_BYTES) {
+            const cipher = Buffer.from(sealed.s, "base64");
+            if (cipher.length > MAX_SEALED_BYTES) {
                 throw new ProtocolError("bad_sealed_box", "ciphertext length out of range");
             }
-            const plaintext = Buffer.alloc(cipher.length - sodium.crypto_box_MACBYTES);
-            const ok = sodium.crypto_box_open_easy(plaintext, cipher, nonce, peerPublicKey, self.secretKey);
-            if (!ok)
-                throw new ProtocolError("decrypt_failed", "box authentication failed");
+            let plaintext;
+            try {
+                plaintext = channel.open(cipher);
+            }
+            catch {
+                throw new ProtocolError("decrypt_failed", "session frame authentication failed");
+            }
             env.payload = JSON.parse(plaintext.toString("utf8"));
             return env;
         },
@@ -183,11 +67,8 @@ function parseEnvelope(raw, allowSealed = false) {
     }
     const e = parsed;
     // `v` is informational (routing + skew detection), NOT a hard compatibility
-    // gate. Version skew is surfaced as a non-fatal heads-up by the client.hello
-    // handshake (server.ts) and the client-side banners, and the field stays clear
-    // for routing (see this module's header). Additive-only bumps like v1→v2 stay
-    // wire-compatible, so decoding must tolerate any positive integer version. A
-    // missing, non-numeric, or non-positive-integer `v` is a malformed frame.
+    // gate. A missing, non-numeric, or non-positive-integer `v` is a malformed
+    // frame; any positive integer decodes (additive-only bumps stay compatible).
     if (!Number.isSafeInteger(e.v) || e.v <= 0) {
         throw new ProtocolError("bad_version", `missing/invalid version ${String(e.v)}`);
     }

package/dist/src/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AACtE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AACtE,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAOxE,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAGrD,CAAC;QACF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC7C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACjE,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,SAAS,CACb,SAAS,EACT,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACxC,CAAC,EACF,MAAM,CACP,CAAC;IACF,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,oCAAoC;IACnE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AASD,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,CACL,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,yBAAyB,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAClF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE;QAC3C,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAuB,CAAC;YAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC9B,yEAAyE;gBACzE,yEAAyE;gBACzE,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAChB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAA2B,CAAC;YAClF,IAAI,CAAC,CAAC,SAAS;gBAAE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,wEAAwE;AACxE,IAAI,QAAQ,GAAoB,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,KAAc;IACjD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;gEACgE;AAChE,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ1C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAU;IAC/B,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;CACpC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,aAAqB;IAC3D,OAAO;QACL,MAAM,CAAC,GAAa;YAClB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3E,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG;gBACb,GAAG,GAAG;gBACN,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aACvE,CAAC;YACF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,GAAW;YAChB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAgD,CAAC;YACpE,IAAI,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/C,sEAAsE;YACtE,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBAClD,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACnF,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3E,MAAM,EAAE,GAAG,MAAM,CAAC,oBAAoB,CACpC,SAAS,EACT,MAAM,EACN,KAAK,EACL,aAAa,EACb,IAAI,CAAC,SAAS,CACf,CAAC;YACF,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;YAChF,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,GAAW,EAAE,WAAW,GAAG,KAAK;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAY,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,aAAa,CACrB,aAAa,EACb,2BAA2B,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,WAAW,CAAC;IACjB,OAAO,MAAkB,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ1C,mFAAmF;AACnF,MAAM,CAAC,MAAM,UAAU,GAAU;IAC/B,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;CACpC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,OAAO;QACL,MAAM,CAAC,GAAa;YAClB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,GAAW;YAChB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAoC,CAAC;YACxD,IAAI,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACrC,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;YACnF,CAAC;YACD,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,GAAW,EAAE,WAAW,GAAG,KAAK;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAY,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,2BAA2B,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,WAAW,CAAC;IACjB,OAAO,MAAkB,CAAC;AAC5B,CAAC"}

package/dist/src/devices.d.ts

@@ -0,0 +1,46 @@
+/**
+ * DeviceTable — the daemon's set of paired devices (§3.2).
+ *
+ * Replaces the legacy `peers.json` (X25519 crypto_box TOFU record). Persisted at
+ * `~/.immediacy/devices.json` (mode 0600). Each entry pins a device's *Ed25519*
+ * public key — the long-term identity the §5.3 session handshake verifies
+ * against. Membership in this table IS authorization: a device whose key is not
+ * present (never paired, or revoked) must fail its next handshake.
+ *
+ * Writes are serialized and land via atomic rename (mirrors
+ * `RendezvousIdentity.persist` / `DaemonIdentity.persist`).
+ */
+/** One paired device. `publicKey` is base64 of its Ed25519 public key. */
+export interface PairedDevice {
+    publicKey: string;
+    label: string;
+    pairedAt: string;
+    lastSeenAt: string;
+}
+export declare class DeviceTable {
+    private devices;
+    /** Serializes read-modify-write so concurrent pairings can't clobber. */
+    private writeChain;
+    /** Load persisted devices, dropping any entry with a non-canonical key. */
+    load(): Promise<void>;
+    /** Every paired device, newest-paired last (insertion order). */
+    list(): PairedDevice[];
+    /** True iff `publicKey` is a currently-paired (non-revoked) device. */
+    has(publicKey: string): boolean;
+    /** The paired device for `publicKey`, or undefined. */
+    get(publicKey: string): PairedDevice | undefined;
+    /**
+     * Pair a device (idempotent). A fresh key is appended; an existing key keeps
+     * its `pairedAt` and only updates the label. Rejects non-canonical Ed25519
+     * keys. Returns the stored entry.
+     */
+    add(publicKey: string, label: string): Promise<PairedDevice>;
+    /**
+     * Revoke a device. Returns true if it was present. The revoked key is gone
+     * from the authorized set, so its next handshake fails (Phase-1 acceptance).
+     */
+    revoke(publicKey: string): Promise<boolean>;
+    /** Update a device's `lastSeenAt` (no-op for unknown keys). */
+    touch(publicKey: string): Promise<void>;
+    private persist;
+}

package/dist/src/devices.js

@@ -0,0 +1,114 @@
+/**
+ * DeviceTable — the daemon's set of paired devices (§3.2).
+ *
+ * Replaces the legacy `peers.json` (X25519 crypto_box TOFU record). Persisted at
+ * `~/.immediacy/devices.json` (mode 0600). Each entry pins a device's *Ed25519*
+ * public key — the long-term identity the §5.3 session handshake verifies
+ * against. Membership in this table IS authorization: a device whose key is not
+ * present (never paired, or revoked) must fail its next handshake.
+ *
+ * Writes are serialized and land via atomic rename (mirrors
+ * `RendezvousIdentity.persist` / `DaemonIdentity.persist`).
+ */
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, writeFile, chmod } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { isValidSignPublicKeyB64 } from "./rendezvous.js";
+const DEVICES_FILE = process.env.DEVICES_FILE ?? join(homedir(), ".immediacy", "devices.json");
+/** A label a malicious/confused client can't blow up to a multi-KB blob. */
+const MAX_LABEL_LEN = 200;
+export class DeviceTable {
+    devices = new Map();
+    /** Serializes read-modify-write so concurrent pairings can't clobber. */
+    writeChain = Promise.resolve();
+    /** Load persisted devices, dropping any entry with a non-canonical key. */
+    async load() {
+        this.devices.clear();
+        if (!existsSync(DEVICES_FILE))
+            return;
+        let stored = {};
+        try {
+            stored = JSON.parse(await readFile(DEVICES_FILE, "utf8"));
+        }
+        catch {
+            return; // corrupt file — start empty rather than crash
+        }
+        for (const d of stored.devices ?? []) {
+            // Validate on the way in: a hand-edited/corrupt file must not seed an
+            // invalid key into the authorized set.
+            if (!d || !isValidSignPublicKeyB64(d.publicKey))
+                continue;
+            const now = new Date().toISOString();
+            this.devices.set(d.publicKey, {
+                publicKey: d.publicKey,
+                label: typeof d.label === "string" ? d.label.slice(0, MAX_LABEL_LEN) : "",
+                pairedAt: typeof d.pairedAt === "string" ? d.pairedAt : now,
+                lastSeenAt: typeof d.lastSeenAt === "string" ? d.lastSeenAt : now,
+            });
+        }
+    }
+    /** Every paired device, newest-paired last (insertion order). */
+    list() {
+        return [...this.devices.values()];
+    }
+    /** True iff `publicKey` is a currently-paired (non-revoked) device. */
+    has(publicKey) {
+        return this.devices.has(publicKey);
+    }
+    /** The paired device for `publicKey`, or undefined. */
+    get(publicKey) {
+        return this.devices.get(publicKey);
+    }
+    /**
+     * Pair a device (idempotent). A fresh key is appended; an existing key keeps
+     * its `pairedAt` and only updates the label. Rejects non-canonical Ed25519
+     * keys. Returns the stored entry.
+     */
+    async add(publicKey, label) {
+        if (!isValidSignPublicKeyB64(publicKey)) {
+            throw new Error("device public key is not a canonical Ed25519 key");
+        }
+        const now = new Date().toISOString();
+        const cleanLabel = (label ?? "").slice(0, MAX_LABEL_LEN);
+        const existing = this.devices.get(publicKey);
+        const entry = existing
+            ? { ...existing, label: cleanLabel, lastSeenAt: now }
+            : { publicKey, label: cleanLabel, pairedAt: now, lastSeenAt: now };
+        this.devices.set(publicKey, entry);
+        await this.persist();
+        return entry;
+    }
+    /**
+     * Revoke a device. Returns true if it was present. The revoked key is gone
+     * from the authorized set, so its next handshake fails (Phase-1 acceptance).
+     */
+    async revoke(publicKey) {
+        const had = this.devices.delete(publicKey);
+        if (had)
+            await this.persist();
+        return had;
+    }
+    /** Update a device's `lastSeenAt` (no-op for unknown keys). */
+    async touch(publicKey) {
+        const entry = this.devices.get(publicKey);
+        if (!entry)
+            return;
+        entry.lastSeenAt = new Date().toISOString();
+        await this.persist();
+    }
+    persist() {
+        const snapshot = JSON.stringify({ devices: [...this.devices.values()] }, null, 2);
+        this.writeChain = this.writeChain
+            .catch(() => { })
+            .then(async () => {
+            await mkdir(dirname(DEVICES_FILE), { recursive: true });
+            const tmp = `${DEVICES_FILE}.${process.pid}.tmp`;
+            await writeFile(tmp, snapshot, "utf8");
+            await chmod(tmp, 0o600); // pins authorization — keep private
+            await rename(tmp, DEVICES_FILE);
+        });
+        return this.writeChain;
+    }
+}
+//# sourceMappingURL=devices.js.map

package/dist/src/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/devices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAE5E,4EAA4E;AAC5E,MAAM,aAAa,GAAG,GAAG,CAAC;AAc1B,MAAM,OAAO,WAAW;IACd,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,yEAAyE;IACjE,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,2EAA2E;IAC3E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO;QACtC,IAAI,MAAM,GAAoB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAoB,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,+CAA+C;QACzD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACrC,sEAAsE;YACtE,uCAAuC;YACvC,IAAI,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;gBAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;gBACzE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG;gBAC3D,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG;aAClE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,uEAAuE;IACvE,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,uDAAuD;IACvD,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,KAAa;QACxC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAiB,QAAQ;YAClC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE;YACrD,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,GAAG;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAEO,OAAO;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAC7B,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAmB,EACxD,IAAI,EACJ,CAAC,CACF,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;aAC9B,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;aACf,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACjD,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,oCAAoC;YAC7D,MAAM,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/src/envelope.d.ts

@@ -1,9 +1,9 @@
 /**
  * Envelope construction + the shared ProtocolError.
  *
- * The (de)serialization seam lives in `crypto.ts` (`clearCodec` / `boxCodec` →
- * `parseEnvelope`), because whether `payload` is cleartext or a sealed NaCl box
- * is a per-socket codec decision. This module only stamps outbound envelopes.
+ * The (de)serialization seam lives in `crypto.ts` (`clearCodec` / `sessionCodec`
+ * → `parseEnvelope`), because whether `payload` is cleartext or sealed by the
+ * session handshake is a per-socket codec decision. This only stamps envelopes.
  */
 import { Envelope, MessageType, PayloadFor } from "./protocol.js";
 /** Build a fully-stamped envelope ready to send. */

package/dist/src/envelope.js

@@ -1,9 +1,9 @@
 /**
  * Envelope construction + the shared ProtocolError.
  *
- * The (de)serialization seam lives in `crypto.ts` (`clearCodec` / `boxCodec` →
- * `parseEnvelope`), because whether `payload` is cleartext or a sealed NaCl box
- * is a per-socket codec decision. This module only stamps outbound envelopes.
+ * The (de)serialization seam lives in `crypto.ts` (`clearCodec` / `sessionCodec`
+ * → `parseEnvelope`), because whether `payload` is cleartext or sealed by the
+ * session handshake is a per-socket codec decision. This only stamps envelopes.
  */
 import { randomUUID } from "node:crypto";
 import { PROTOCOL_VERSION, } from "./protocol.js";

package/dist/src/forward.d.ts

@@ -5,7 +5,7 @@
  * accepts becomes a `forward.open` here. We dial `127.0.0.1:<port>` on the
  * daemon box and pipe bytes in both directions as base64 `forward.data` frames,
  * multiplexed over the one WSS connection by `streamId`. This is a raw TCP
- * bridge (not HTTP-aware), so HTTP, WebSocket HMR, and SSE all pass through
+ * bridge (not HTTP-aware), so HTTP, SocketLike HMR, and SSE all pass through
  * unchanged — the dev server sees an ordinary local client.
  *
  * Streams are per-socket, like the terminal PTY: the reply bytes go back to the
@@ -16,7 +16,7 @@
  * only ports the `isOwned` check confirms belong to the named workspace's
  * worktree (see `ports.ts`). An `open` for any other port is refused immediately.
  */
-import type { WebSocket } from "ws";
+import type { SocketLike } from "./hub.js";
 import type { Hub } from "./hub.js";
 export declare class ForwardManager {
     private hub;
@@ -31,7 +31,7 @@ export declare class ForwardManager {
      * port against the worktree-owned set, dials loopback, and wires both
      * directions. Any failure closes the stream back to the client with a reason.
      */
-    open(client: WebSocket, ws: string, streamId: string, port: number): void;
+    open(client: SocketLike, ws: string, streamId: string, port: number): void;
     /** Pause a stream's source read until its client-bound WS queue drains. */
     private pauseUntilDrained;
     /** A chunk of browser→server bytes for an open stream. */
@@ -39,7 +39,7 @@ export declare class ForwardManager {
     /** The client closed its end; drop the daemon-side socket (no echo back). */
     close(streamId: string): void;
     /** Tear down every stream owned by a socket that just disconnected. */
-    reapClient(client: WebSocket): void;
+    reapClient(client: SocketLike): void;
     /** Refuse before a socket ever existed: just tell the client it's closed. */
     private refuse;
     /**

package/dist/src/forward.js

@@ -5,7 +5,7 @@
  * accepts becomes a `forward.open` here. We dial `127.0.0.1:<port>` on the
  * daemon box and pipe bytes in both directions as base64 `forward.data` frames,
  * multiplexed over the one WSS connection by `streamId`. This is a raw TCP
- * bridge (not HTTP-aware), so HTTP, WebSocket HMR, and SSE all pass through
+ * bridge (not HTTP-aware), so HTTP, SocketLike HMR, and SSE all pass through
  * unchanged — the dev server sees an ordinary local client.
  *
  * Streams are per-socket, like the terminal PTY: the reply bytes go back to the

package/dist/src/forward.js.map

@@ -1 +1 @@
-{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../src/forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,iFAAiF;AACjF,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,uDAAuD;AACvD,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ;AAC3C,2EAA2E;AAC3E,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAWlC,MAAM,OAAO,cAAc;IAIf;IAEA;IALF,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,YACU,GAAQ;IAChB,0EAA0E;IAClE,OAA8C;QAF9C,QAAG,GAAH,GAAG,CAAK;QAER,YAAO,GAAP,OAAO,CAAuC;IACrD,CAAC;IAEJ;;;;OAIG;IACH,IAAI,CAAC,MAAiB,EAAE,EAAU,EAAE,QAAgB,EAAE,IAAY;QAChE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACpD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI,iDAAiD,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,GAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEnC,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACtE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QAEvB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE;gBAC5C,QAAQ;gBACR,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC/B,CAAC,CAAC;YACH,qEAAqE;YACrE,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,MAAM,CAAC,cAAc,GAAG,iBAAiB;gBAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,2EAA2E;IACnE,iBAAiB,CAAC,QAAgB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO;QAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,kCAAkC;YACtE,IAAI,CAAC,CAAC,MAAM,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;gBAChD,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,QAAgB,EAAE,GAAW;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC7C,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,EAAE;gBAC7C,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9E,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,QAAgB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,uEAAuE;IACvE,UAAU,CAAC,MAAiB;QAC1B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,MAAM,CAAC,MAAiB,EAAE,QAAgB,EAAE,KAAa;QAC/D,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,QAAgB,EAAE,KAAc;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE;YACpD,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../src/forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,iFAAiF;AACjF,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,uDAAuD;AACvD,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ;AAC3C,2EAA2E;AAC3E,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAWlC,MAAM,OAAO,cAAc;IAIf;IAEA;IALF,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,YACU,GAAQ;IAChB,0EAA0E;IAClE,OAA8C;QAF9C,QAAG,GAAH,GAAG,CAAK;QAER,YAAO,GAAP,OAAO,CAAuC;IACrD,CAAC;IAEJ;;;;OAIG;IACH,IAAI,CAAC,MAAkB,EAAE,EAAU,EAAE,QAAgB,EAAE,IAAY;QACjE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACpD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI,iDAAiD,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,GAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEnC,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACtE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QAEvB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE;gBAC5C,QAAQ;gBACR,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC/B,CAAC,CAAC;YACH,qEAAqE;YACrE,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,MAAM,CAAC,cAAc,GAAG,iBAAiB;gBAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,2EAA2E;IACnE,iBAAiB,CAAC,QAAgB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO;QAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,kCAAkC;YACtE,IAAI,CAAC,CAAC,MAAM,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;gBAChD,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,QAAgB,EAAE,GAAW;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC7C,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,EAAE;gBAC7C,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9E,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,QAAgB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,uEAAuE;IACvE,UAAU,CAAC,MAAkB;QAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,MAAM,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAa;QAChE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,QAAgB,EAAE,KAAc;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE;YACpD,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;CACF"}