@iflow-mcp/jkheadley-instar 0.26.2

package/dist/threadline/HandshakeManager.js

@@ -0,0 +1,402 @@
+/**
+ * HandshakeManager — Manages the Threadline trust handshake protocol.
+ *
+ * Implements the Ed25519/X25519 cryptographic handshake between agents:
+ * 1. Agent A sends hello (identity pub + ephemeral pub + nonce)
+ * 2. Agent B responds with hello (identity pub + ephemeral pub + nonce + challenge response)
+ * 3. Agent A sends confirm (challenge response)
+ * 4. Both agents derive the shared relay token via HKDF
+ *
+ * Features:
+ * - Glare resolution (Section 7.5.3): lexicographically lower pubkey wins
+ * - Rate limiting: max 5 attempts/minute per agent, block after 10 failures/hour
+ * - Persistent identity keys and relay tokens
+ * - Replay protection via nonce tracking
+ *
+ * Part of Threadline Protocol Phase 3.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { generateIdentityKeyPair, generateEphemeralKeyPair, computeChallengeResponse, verify, ecdh, deriveRelayToken, } from './ThreadlineCrypto.js';
+// ── Constants ────────────────────────────────────────────────────────
+const RATE_LIMIT_WINDOW_MS = 60_000; // 1 minute
+const RATE_LIMIT_MAX_ATTEMPTS = 5; // per minute per agent
+const FAILURE_BLOCK_THRESHOLD = 10; // failures in 1 hour
+const FAILURE_WINDOW_MS = 3600_000; // 1 hour
+const FAILURE_BLOCK_DURATION_MS = 3600_000; // block for 1 hour
+const HANDSHAKE_TIMEOUT_MS = 30_000; // 30 seconds
+const RELAY_TOKEN_INFO = 'threadline-relay-token-v1';
+/**
+ * Build a deterministic salt from two identity public keys.
+ * Both sides will produce the same salt regardless of who is A vs B,
+ * by sorting the keys lexicographically.
+ */
+function buildDeterministicSalt(pubA, pubB) {
+    const hexA = pubA.toString('hex');
+    const hexB = pubB.toString('hex');
+    return hexA < hexB
+        ? Buffer.concat([pubA, pubB])
+        : Buffer.concat([pubB, pubA]);
+}
+// ── HandshakeManager ─────────────────────────────────────────────────
+export class HandshakeManager {
+    stateDir;
+    localAgent;
+    identityKey = null;
+    handshakes = new Map();
+    rateLimits = new Map();
+    relayTokens = {};
+    constructor(stateDir, localAgent) {
+        this.stateDir = path.join(stateDir, 'threadline');
+        this.localAgent = localAgent;
+        this.ensureDirs();
+        this.loadIdentity();
+        this.loadRelayTokens();
+    }
+    // ── Public API ───────────────────────────────────────────────────
+    /**
+     * Initiate a handshake with a target agent.
+     * Generates ephemeral keys and returns a hello payload to send.
+     */
+    initiateHandshake(targetAgent) {
+        const rateCheck = this.checkRateLimit(targetAgent);
+        if (rateCheck)
+            return { error: rateCheck };
+        this.recordAttempt(targetAgent);
+        const identity = this.getOrCreateIdentity();
+        const ephemeral = generateEphemeralKeyPair();
+        const nonce = crypto.randomBytes(32).toString('hex');
+        const state = {
+            agentName: targetAgent,
+            ourIdentityKey: identity,
+            ourEphemeralKey: ephemeral,
+            ourChallenge: nonce,
+            state: 'hello-sent',
+            startedAt: new Date().toISOString(),
+        };
+        this.handshakes.set(targetAgent, state);
+        return {
+            payload: {
+                agent: this.localAgent,
+                identityPub: identity.publicKey.toString('hex'),
+                ephemeralPub: ephemeral.publicKey.toString('hex'),
+                nonce,
+            },
+        };
+    }
+    /**
+     * Handle an incoming hello from another agent.
+     *
+     * If we already sent a hello to this agent (glare), resolve by pubkey ordering:
+     * the agent with the lexicographically lower Ed25519 public key wins (keeps initiator role).
+     *
+     * Returns a hello response payload (with challenge response) or a confirm payload.
+     */
+    handleHello(hello) {
+        const rateCheck = this.checkRateLimit(hello.agent);
+        if (rateCheck)
+            return { error: rateCheck };
+        this.recordAttempt(hello.agent);
+        const theirIdentityPub = Buffer.from(hello.identityPub, 'hex');
+        const theirEphemeralPub = Buffer.from(hello.ephemeralPub, 'hex');
+        const identity = this.getOrCreateIdentity();
+        // Glare resolution: both sides sent hello simultaneously
+        const existing = this.handshakes.get(hello.agent);
+        if (existing && existing.state === 'hello-sent') {
+            const ourPubHex = identity.publicKey.toString('hex');
+            const theirPubHex = hello.identityPub;
+            if (ourPubHex < theirPubHex) {
+                // We win — we keep our initiator role, ignore their hello.
+                // They should process our hello instead.
+                return { error: 'glare: we are the initiator (lower pubkey)' };
+            }
+            // They win — we abandon our hello and process theirs as receiver.
+            this.handshakes.delete(hello.agent);
+        }
+        const ephemeral = generateEphemeralKeyPair();
+        const nonce = crypto.randomBytes(32).toString('hex');
+        // Compute our challenge response to their nonce
+        const challengeResponse = computeChallengeResponse(identity.privateKey, hello.nonce, theirIdentityPub, identity.publicKey, theirEphemeralPub, ephemeral.publicKey);
+        const state = {
+            agentName: hello.agent,
+            ourIdentityKey: identity,
+            ourEphemeralKey: ephemeral,
+            theirIdentityPub,
+            theirEphemeralPub,
+            ourChallenge: nonce,
+            theirChallenge: hello.nonce,
+            state: 'hello-received',
+            startedAt: new Date().toISOString(),
+        };
+        this.handshakes.set(hello.agent, state);
+        return {
+            payload: {
+                agent: this.localAgent,
+                identityPub: identity.publicKey.toString('hex'),
+                ephemeralPub: ephemeral.publicKey.toString('hex'),
+                nonce,
+                challengeResponse: challengeResponse.toString('hex'),
+            },
+        };
+    }
+    /**
+     * Handle an incoming confirm from the agent that responded to our hello.
+     * This is the final step — both sides now derive the relay token.
+     *
+     * Can also handle the hello-response (when we are the initiator and receive
+     * the responder's hello with their challenge response).
+     */
+    handleConfirm(confirm) {
+        const state = this.handshakes.get(confirm.agent);
+        if (!state) {
+            this.recordFailure(confirm.agent);
+            return { error: 'No handshake in progress with this agent' };
+        }
+        // Check timeout
+        const elapsed = Date.now() - new Date(state.startedAt).getTime();
+        if (elapsed > HANDSHAKE_TIMEOUT_MS) {
+            state.state = 'failed';
+            this.handshakes.delete(confirm.agent);
+            this.recordFailure(confirm.agent);
+            return { error: 'Handshake timed out' };
+        }
+        if (!state.theirIdentityPub || !state.theirEphemeralPub) {
+            this.recordFailure(confirm.agent);
+            return { error: 'Handshake state incomplete — missing their keys' };
+        }
+        // Verify their challenge response against our nonce
+        const challengeResponseBuf = Buffer.from(confirm.challengeResponse, 'hex');
+        const expectedHash = crypto.createHash('sha256');
+        expectedHash.update(Buffer.from(state.ourChallenge, 'utf-8'));
+        expectedHash.update(state.ourIdentityKey.publicKey); // identity_pub_A (us as challenger)
+        expectedHash.update(state.theirIdentityPub); // identity_pub_B (them)
+        expectedHash.update(state.ourEphemeralKey.publicKey); // eph_pub_A
+        expectedHash.update(state.theirEphemeralPub); // eph_pub_B
+        const isValid = verify(state.theirIdentityPub, expectedHash.digest(), challengeResponseBuf);
+        if (!isValid) {
+            state.state = 'failed';
+            this.handshakes.delete(confirm.agent);
+            this.recordFailure(confirm.agent);
+            return { error: 'Challenge response verification failed' };
+        }
+        // Derive the relay token via X25519 ECDH + HKDF
+        const sharedSecret = ecdh(state.ourEphemeralKey.privateKey, state.theirEphemeralPub);
+        const salt = buildDeterministicSalt(state.ourIdentityKey.publicKey, state.theirIdentityPub);
+        const relayToken = deriveRelayToken(sharedSecret, salt, RELAY_TOKEN_INFO);
+        state.relayToken = relayToken;
+        state.state = 'confirmed';
+        // Persist the relay token
+        this.relayTokens[confirm.agent] = {
+            token: relayToken.toString('hex'),
+            establishedAt: new Date().toISOString(),
+            theirIdentityPub: state.theirIdentityPub.toString('hex'),
+        };
+        this.saveRelayTokens();
+        this.handshakes.delete(confirm.agent);
+        return { relayToken: relayToken.toString('hex') };
+    }
+    /**
+     * Process the responder's hello (as initiator).
+     * The responder's hello includes their challenge response to our nonce,
+     * plus their own nonce for us to respond to.
+     *
+     * Returns a confirm payload for us to send, plus the derived relay token.
+     */
+    handleHelloResponse(hello) {
+        const state = this.handshakes.get(hello.agent);
+        if (!state || state.state !== 'hello-sent') {
+            return { error: 'No pending hello-sent handshake with this agent' };
+        }
+        if (!hello.challengeResponse) {
+            return { error: 'Hello response missing challenge response' };
+        }
+        const theirIdentityPub = Buffer.from(hello.identityPub, 'hex');
+        const theirEphemeralPub = Buffer.from(hello.ephemeralPub, 'hex');
+        // Verify their challenge response to our nonce
+        // They signed: SHA256(ourNonce || theirIdentityPub || ourIdentityPub || theirEphPub || ourEphPub)
+        // But from their perspective: SHA256(nonce || identityPubA || identityPubB || ephPubA || ephPubB)
+        // where A = us (the hello sender), B = them (the responder)
+        const verifyHash = crypto.createHash('sha256');
+        verifyHash.update(Buffer.from(state.ourChallenge, 'utf-8'));
+        verifyHash.update(state.ourIdentityKey.publicKey); // identity_pub_A (original hello sender)
+        verifyHash.update(theirIdentityPub); // identity_pub_B (responder)
+        verifyHash.update(state.ourEphemeralKey.publicKey); // eph_pub_A
+        verifyHash.update(theirEphemeralPub); // eph_pub_B
+        const challengeResponseBuf = Buffer.from(hello.challengeResponse, 'hex');
+        const isValid = verify(theirIdentityPub, verifyHash.digest(), challengeResponseBuf);
+        if (!isValid) {
+            state.state = 'failed';
+            this.handshakes.delete(hello.agent);
+            this.recordFailure(hello.agent);
+            return { error: 'Challenge response verification failed' };
+        }
+        // Store their keys
+        state.theirIdentityPub = theirIdentityPub;
+        state.theirEphemeralPub = theirEphemeralPub;
+        state.theirChallenge = hello.nonce;
+        // Compute our challenge response to their nonce
+        const ourChallengeResponse = computeChallengeResponse(state.ourIdentityKey.privateKey, hello.nonce, theirIdentityPub, state.ourIdentityKey.publicKey, theirEphemeralPub, state.ourEphemeralKey.publicKey);
+        // Derive the relay token
+        const sharedSecret = ecdh(state.ourEphemeralKey.privateKey, theirEphemeralPub);
+        const salt = buildDeterministicSalt(state.ourIdentityKey.publicKey, theirIdentityPub);
+        const relayToken = deriveRelayToken(sharedSecret, salt, RELAY_TOKEN_INFO);
+        state.relayToken = relayToken;
+        state.state = 'confirmed';
+        // Persist
+        this.relayTokens[hello.agent] = {
+            token: relayToken.toString('hex'),
+            establishedAt: new Date().toISOString(),
+            theirIdentityPub: theirIdentityPub.toString('hex'),
+        };
+        this.saveRelayTokens();
+        this.handshakes.delete(hello.agent);
+        return {
+            confirmPayload: {
+                agent: this.localAgent,
+                challengeResponse: ourChallengeResponse.toString('hex'),
+            },
+            relayToken: relayToken.toString('hex'),
+        };
+    }
+    /**
+     * Get the stored relay token for a paired agent.
+     * Returns hex-encoded token or null if not paired.
+     */
+    getRelayToken(agentName) {
+        return this.relayTokens[agentName]?.token ?? null;
+    }
+    /**
+     * Check if a relay token is valid for a given agent.
+     */
+    validateRelayToken(agentName, token) {
+        const stored = this.relayTokens[agentName]?.token;
+        if (!stored)
+            return false;
+        // Timing-safe comparison
+        const a = Buffer.from(stored, 'hex');
+        const b = Buffer.from(token, 'hex');
+        if (a.length !== b.length)
+            return false;
+        return crypto.timingSafeEqual(a, b);
+    }
+    /**
+     * Check if a handshake is currently in progress with an agent.
+     */
+    isHandshakeInProgress(agentName) {
+        const state = this.handshakes.get(agentName);
+        if (!state)
+            return false;
+        return state.state === 'hello-sent' || state.state === 'hello-received';
+    }
+    /**
+     * Get the local agent's identity public key (hex).
+     */
+    getIdentityPublicKey() {
+        return this.getOrCreateIdentity().publicKey.toString('hex');
+    }
+    /**
+     * List all paired agents with relay tokens.
+     */
+    listPairedAgents() {
+        return Object.entries(this.relayTokens).map(([agent, data]) => ({
+            agent,
+            establishedAt: data.establishedAt,
+        }));
+    }
+    // ── Private: Identity management ──────────────────────────────────
+    getOrCreateIdentity() {
+        if (this.identityKey)
+            return this.identityKey;
+        const identityPath = path.join(this.stateDir, 'identity.json');
+        if (fs.existsSync(identityPath)) {
+            const stored = JSON.parse(fs.readFileSync(identityPath, 'utf-8'));
+            this.identityKey = {
+                publicKey: Buffer.from(stored.publicKey, 'hex'),
+                privateKey: Buffer.from(stored.privateKey, 'hex'),
+            };
+        }
+        else {
+            this.identityKey = generateIdentityKeyPair();
+            const stored = {
+                publicKey: this.identityKey.publicKey.toString('hex'),
+                privateKey: this.identityKey.privateKey.toString('hex'),
+            };
+            fs.writeFileSync(identityPath, JSON.stringify(stored, null, 2));
+        }
+        return this.identityKey;
+    }
+    loadIdentity() {
+        const identityPath = path.join(this.stateDir, 'identity.json');
+        if (fs.existsSync(identityPath)) {
+            try {
+                const stored = JSON.parse(fs.readFileSync(identityPath, 'utf-8'));
+                this.identityKey = {
+                    publicKey: Buffer.from(stored.publicKey, 'hex'),
+                    privateKey: Buffer.from(stored.privateKey, 'hex'),
+                };
+            }
+            catch {
+                // Corrupt identity file — will regenerate
+                this.identityKey = null;
+            }
+        }
+    }
+    // ── Private: Relay token persistence ──────────────────────────────
+    loadRelayTokens() {
+        const tokensPath = path.join(this.stateDir, 'relay-tokens.json');
+        if (fs.existsSync(tokensPath)) {
+            try {
+                this.relayTokens = JSON.parse(fs.readFileSync(tokensPath, 'utf-8'));
+            }
+            catch {
+                this.relayTokens = {};
+            }
+        }
+    }
+    saveRelayTokens() {
+        const tokensPath = path.join(this.stateDir, 'relay-tokens.json');
+        fs.writeFileSync(tokensPath, JSON.stringify(this.relayTokens, null, 2));
+    }
+    // ── Private: Rate limiting ────────────────────────────────────────
+    checkRateLimit(agentName) {
+        const entry = this.rateLimits.get(agentName);
+        if (!entry)
+            return null;
+        const now = Date.now();
+        // Check block
+        if (entry.blockedUntil && now < entry.blockedUntil) {
+            const retryAfter = Math.ceil((entry.blockedUntil - now) / 1000);
+            return `Rate limited: blocked for ${retryAfter}s (too many failures)`;
+        }
+        // Check per-minute rate
+        const recentAttempts = entry.attempts.filter(t => now - t < RATE_LIMIT_WINDOW_MS);
+        if (recentAttempts.length >= RATE_LIMIT_MAX_ATTEMPTS) {
+            return `Rate limited: max ${RATE_LIMIT_MAX_ATTEMPTS} attempts per minute`;
+        }
+        return null;
+    }
+    recordAttempt(agentName) {
+        const entry = this.rateLimits.get(agentName) ?? { attempts: [], failures: 0 };
+        const now = Date.now();
+        entry.attempts = entry.attempts.filter(t => now - t < RATE_LIMIT_WINDOW_MS);
+        entry.attempts.push(now);
+        this.rateLimits.set(agentName, entry);
+    }
+    recordFailure(agentName) {
+        const entry = this.rateLimits.get(agentName) ?? { attempts: [], failures: 0 };
+        entry.failures++;
+        // Reset failure counter if outside the window
+        // (Simplified: we just track total failures and block)
+        if (entry.failures >= FAILURE_BLOCK_THRESHOLD) {
+            entry.blockedUntil = Date.now() + FAILURE_BLOCK_DURATION_MS;
+            entry.failures = 0; // Reset after blocking
+        }
+        this.rateLimits.set(agentName, entry);
+    }
+    // ── Private: Directory setup ──────────────────────────────────────
+    ensureDirs() {
+        fs.mkdirSync(this.stateDir, { recursive: true });
+    }
+}
+//# sourceMappingURL=HandshakeManager.js.map

package/dist/threadline/HandshakeManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandshakeManager.js","sourceRoot":"","sources":["../../src/threadline/HandshakeManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,MAAM,EACN,IAAI,EACJ,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAiD/B,wEAAwE;AAExE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAO,WAAW;AACtD,MAAM,uBAAuB,GAAG,CAAC,CAAC,CAAU,uBAAuB;AACnE,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAS,qBAAqB;AACjE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAS,SAAS;AACrD,MAAM,yBAAyB,GAAG,QAAQ,CAAC,CAAC,mBAAmB;AAC/D,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAQ,aAAa;AAEzD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,IAAI,GAAG,IAAI;QAChB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,wEAAwE;AAExE,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAS;IACjB,UAAU,CAAS;IAC5B,WAAW,GAAmB,IAAI,CAAC;IAC1B,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IACxD,WAAW,GAAsB,EAAE,CAAC;IAE5C,YAAY,QAAgB,EAAE,UAAkB;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,oEAAoE;IAEpE;;;OAGG;IACH,iBAAiB,CAAC,WAAmB;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAE3C,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,KAAK,GAAmB;YAC5B,SAAS,EAAE,WAAW;YACtB,cAAc,EAAE,QAAQ;YACxB,eAAe,EAAE,SAAS;YAC1B,YAAY,EAAE,KAAK;YACnB,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAExC,OAAO;YACL,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,UAAU;gBACtB,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC/C,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjD,KAAK;aACN;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,KAAmB;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAE3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhC,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE5C,yDAAyD;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YAEtC,IAAI,SAAS,GAAG,WAAW,EAAE,CAAC;gBAC5B,2DAA2D;gBAC3D,yCAAyC;gBACzC,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YACjE,CAAC;YACD,kEAAkE;YAClE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,gDAAgD;QAChD,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,QAAQ,CAAC,UAAU,EACnB,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,QAAQ,CAAC,SAAS,EAClB,iBAAiB,EACjB,SAAS,CAAC,SAAS,CACpB,CAAC;QAEF,MAAM,KAAK,GAAmB;YAC5B,SAAS,EAAE,KAAK,CAAC,KAAK;YACtB,cAAc,EAAE,QAAQ;YACxB,eAAe,EAAE,SAAS;YAC1B,gBAAgB;YAChB,iBAAiB;YACjB,YAAY,EAAE,KAAK;YACnB,cAAc,EAAE,KAAK,CAAC,KAAK;YAC3B,KAAK,EAAE,gBAAgB;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAExC,OAAO;YACL,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,UAAU;gBACtB,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC/C,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjD,KAAK;gBACL,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;aACrD;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAAuB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC/D,CAAC;QAED,gBAAgB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACjE,IAAI,OAAO,GAAG,oBAAoB,EAAE,CAAC;YACnC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACxD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QAED,oDAAoD;QACpD,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9D,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAE,oCAAoC;QAC1F,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAU,wBAAwB;QAC9E,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAE,YAAY;QACnE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAU,YAAY;QAEnE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC5F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAE1E,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;QAE1B,0BAA0B;QAC1B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;YAChC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;SACzD,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEtC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAmB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAEjE,+CAA+C;QAC/C,kGAAkG;QAClG,kGAAkG;QAClG,4DAA4D;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5D,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAG,yCAAyC;QAC9F,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAiB,6BAA6B;QAClF,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAG,YAAY;QAClE,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAiB,YAAY;QAElE,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;QAED,mBAAmB;QACnB,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC1C,KAAK,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC5C,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;QAEnC,gDAAgD;QAChD,MAAM,oBAAoB,GAAG,wBAAwB,CACnD,KAAK,CAAC,cAAc,CAAC,UAAU,EAC/B,KAAK,CAAC,KAAK,EACX,gBAAgB,EAChB,KAAK,CAAC,cAAc,CAAC,SAAS,EAC9B,iBAAiB,EACjB,KAAK,CAAC,eAAe,CAAC,SAAS,CAChC,CAAC;QAEF,yBAAyB;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAE1E,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;QAE1B,UAAU;QACV,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;YAC9B,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;SACnD,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpC,OAAO;YACL,cAAc,EAAE;gBACd,KAAK,EAAE,IAAI,CAAC,UAAU;gBACtB,iBAAiB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;aACxD;YACD,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,SAAiB,EAAE,KAAa;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,yBAAyB;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,SAAiB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,KAAK,gBAAgB,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,qEAAqE;IAE7D,mBAAmB;QACzB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAE9C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,MAAM,MAAM,GAAmB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YAClF,IAAI,CAAC,WAAW,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC;gBAC/C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;aAClD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,GAAG,uBAAuB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAmB;gBAC7B,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACrD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;aACxD,CAAC;YACF,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,YAAY;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAmB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;gBAClF,IAAI,CAAC,WAAW,GAAG;oBACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC;oBAC/C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;iBAClD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;gBAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IAE7D,eAAe;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACjE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,qEAAqE;IAE7D,cAAc,CAAC,SAAiB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,cAAc;QACd,IAAI,KAAK,CAAC,YAAY,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO,6BAA6B,UAAU,uBAAuB,CAAC;QACxE,CAAC;QAED,wBAAwB;QACxB,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC;QAClF,IAAI,cAAc,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACrD,OAAO,qBAAqB,uBAAuB,sBAAsB,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC;QAC5E,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC9E,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEjB,8CAA8C;QAC9C,uDAAuD;QACvD,IAAI,KAAK,CAAC,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC9C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,CAAC;YAC5D,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,uBAAuB;QAC7C,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,qEAAqE;IAE7D,UAAU;QAChB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/threadline/InboundMessageGate.d.ts

@@ -0,0 +1,80 @@
+/**
+ * InboundMessageGate — Pre-filter for relay inbound messages.
+ *
+ * Gates on sender identity, trust level, rate limits, payload size, and replay.
+ * Does NOT determine delivery mode — that's AutonomyGate's job.
+ *
+ * Part of PROP-relay-auto-connect.
+ */
+import type { AgentTrustManager, AgentTrustLevel } from './AgentTrustManager.js';
+import type { ThreadlineRouter } from './ThreadlineRouter.js';
+import type { ReceivedMessage } from './client/ThreadlineClient.js';
+export interface InboundGateConfig {
+    /** Max payload size in bytes (default: 64KB) */
+    maxPayloadBytes?: number;
+    /** Per-trust-level rate limits */
+    rateLimits?: Partial<Record<AgentTrustLevel, {
+        probesPerHour: number;
+        messagesPerHour: number;
+        messagesPerDay: number;
+    }>>;
+}
+export interface GateDecision {
+    action: 'pass' | 'block';
+    reason?: string;
+    fingerprint?: string;
+    message?: ReceivedMessage;
+    trustLevel?: AgentTrustLevel;
+}
+export declare class InboundMessageGate {
+    private readonly trustManager;
+    private router;
+    private readonly config;
+    private readonly rateLimiter;
+    private readonly maxPayloadBytes;
+    private cleanupTimer;
+    /** Seen messageId cache for replay protection */
+    private readonly seenMessageIds;
+    private metrics;
+    constructor(trustManager: AgentTrustManager, router: ThreadlineRouter | null, config?: InboundGateConfig);
+    /**
+     * Late-bind the router after server initialization.
+     * The router isn't available at bootstrap time — it's created in server.ts
+     * after the Threadline bootstrap completes.
+     */
+    setRouter(router: ThreadlineRouter): void;
+    /**
+     * Evaluate an inbound relay message.
+     * Returns 'pass' to route to ThreadlineRouter/AutonomyGate,
+     * or 'block' with reason.
+     */
+    evaluate(message: ReceivedMessage): Promise<GateDecision>;
+    /**
+     * Get gate metrics for observability.
+     */
+    getMetrics(): {
+        passed: number;
+        blocked: number;
+        blockedByTrust: number;
+        blockedByRate: number;
+        blockedBySize: number;
+        blockedByReplay: number;
+        probesHandled: number;
+    };
+    /**
+     * Shutdown: cleanup timers.
+     */
+    shutdown(): void;
+    private classifyOperation;
+    private estimatePayloadSize;
+    private getRateLimits;
+    /**
+     * Extract messageId from a ReceivedMessage.
+     */
+    private extractMessageId;
+    /**
+     * Prune expired entries from the seen-messageId cache.
+     */
+    private pruneSeenMessageIds;
+}
+//# sourceMappingURL=InboundMessageGate.d.ts.map

package/dist/threadline/InboundMessageGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InboundMessageGate.d.ts","sourceRoot":"","sources":["../../src/threadline/InboundMessageGate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAIpE,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC3H;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAgFD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAC1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,YAAY,CAA+C;IAEnE,iDAAiD;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAG5D,OAAO,CAAC,OAAO,CAQb;gBAGA,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,MAAM,GAAE,iBAAsB;IAehC;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAIzC;;;;OAIG;IACG,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IAwE/D;;OAEG;IACH,UAAU;;;;;;;;;IAIV;;OAEG;IACH,QAAQ,IAAI,IAAI;IAShB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,aAAa;IAOrB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAQ5B"}