@iflow-mcp/jkheadley-instar 0.26.2

package/dist/threadline/InboundMessageGate.js

@@ -0,0 +1,241 @@
+/**
+ * InboundMessageGate — Pre-filter for relay inbound messages.
+ *
+ * Gates on sender identity, trust level, rate limits, payload size, and replay.
+ * Does NOT determine delivery mode — that's AutonomyGate's job.
+ *
+ * Part of PROP-relay-auto-connect.
+ */
+/** Operations that are probes (don't spawn sessions) */
+const PROBE_OPS = new Set(['ping', 'health']);
+/** Default rate limits per trust level */
+const DEFAULT_RATE_LIMITS = {
+    untrusted: { probesPerHour: 5, messagesPerHour: 0, messagesPerDay: 0 },
+    verified: { probesPerHour: 20, messagesPerHour: 10, messagesPerDay: 50 },
+    trusted: { probesPerHour: 100, messagesPerHour: 50, messagesPerDay: 200 },
+    autonomous: { probesPerHour: 500, messagesPerHour: 500, messagesPerDay: 10_000 },
+};
+const MAX_PAYLOAD_BYTES = 64 * 1024; // 64KB
+/** Seen messageId TTL for replay protection (10 minutes) */
+const SEEN_MESSAGE_TTL_MS = 10 * 60 * 1000;
+class PerSenderRateLimiter {
+    probeWindows = new Map();
+    messageHourWindows = new Map();
+    messageDayWindows = new Map();
+    isProbeRateLimited(fingerprint, limit) {
+        return this.isLimited(this.probeWindows, fingerprint, limit, 60 * 60 * 1000);
+    }
+    isMessageHourLimited(fingerprint, limit) {
+        if (limit <= 0)
+            return true; // 0 = blocked
+        return this.isLimited(this.messageHourWindows, fingerprint, limit, 60 * 60 * 1000);
+    }
+    isMessageDayLimited(fingerprint, limit) {
+        if (limit <= 0)
+            return true;
+        return this.isLimited(this.messageDayWindows, fingerprint, limit, 24 * 60 * 60 * 1000);
+    }
+    isLimited(windows, key, limit, windowMs) {
+        const now = Date.now();
+        let window = windows.get(key);
+        if (!window) {
+            window = { timestamps: [] };
+            windows.set(key, window);
+        }
+        // Prune expired timestamps
+        window.timestamps = window.timestamps.filter(t => now - t < windowMs);
+        if (window.timestamps.length >= limit) {
+            return true;
+        }
+        window.timestamps.push(now);
+        return false;
+    }
+    /**
+     * Evict stale entries to prevent unbounded memory growth.
+     */
+    cleanup(maxAgeMs = 24 * 60 * 60 * 1000) {
+        const now = Date.now();
+        for (const windows of [this.probeWindows, this.messageHourWindows, this.messageDayWindows]) {
+            for (const [key, window] of windows) {
+                window.timestamps = window.timestamps.filter(t => now - t < maxAgeMs);
+                if (window.timestamps.length === 0) {
+                    windows.delete(key);
+                }
+            }
+        }
+    }
+}
+// ── Implementation ───────────────────────────────────────────────────
+export class InboundMessageGate {
+    trustManager;
+    router;
+    config;
+    rateLimiter = new PerSenderRateLimiter();
+    maxPayloadBytes;
+    cleanupTimer = null;
+    /** Seen messageId cache for replay protection */
+    seenMessageIds = new Map();
+    // Metrics
+    metrics = {
+        passed: 0,
+        blocked: 0,
+        blockedByTrust: 0,
+        blockedByRate: 0,
+        blockedBySize: 0,
+        blockedByReplay: 0,
+        probesHandled: 0,
+    };
+    constructor(trustManager, router, config = {}) {
+        this.trustManager = trustManager;
+        this.router = router;
+        this.config = config;
+        this.maxPayloadBytes = config.maxPayloadBytes ?? MAX_PAYLOAD_BYTES;
+        // Periodic cleanup of rate limiter state and seen-messageId cache (every 30 minutes)
+        this.cleanupTimer = setInterval(() => {
+            this.rateLimiter.cleanup();
+            this.pruneSeenMessageIds();
+        }, 30 * 60 * 1000);
+        if (this.cleanupTimer.unref)
+            this.cleanupTimer.unref();
+    }
+    /**
+     * Late-bind the router after server initialization.
+     * The router isn't available at bootstrap time — it's created in server.ts
+     * after the Threadline bootstrap completes.
+     */
+    setRouter(router) {
+        this.router = router;
+    }
+    /**
+     * Evaluate an inbound relay message.
+     * Returns 'pass' to route to ThreadlineRouter/AutonomyGate,
+     * or 'block' with reason.
+     */
+    async evaluate(message) {
+        const fingerprint = message.from;
+        // 0a. Replay protection — check seen-messageId cache
+        const messageId = this.extractMessageId(message);
+        if (messageId && this.seenMessageIds.has(messageId)) {
+            this.metrics.blocked++;
+            this.metrics.blockedByReplay++;
+            return { action: 'block', reason: 'replay_detected', fingerprint };
+        }
+        // 0b. Payload size check
+        const payloadSize = this.estimatePayloadSize(message);
+        if (payloadSize > this.maxPayloadBytes) {
+            this.metrics.blocked++;
+            this.metrics.blockedBySize++;
+            return { action: 'block', reason: 'payload_too_large', fingerprint };
+        }
+        // 1. Determine operation type
+        const opType = this.classifyOperation(message);
+        const isProbe = PROBE_OPS.has(opType);
+        // 2. Trust check (keyed by fingerprint)
+        const trust = this.trustManager.getTrustLevelByFingerprint(fingerprint);
+        const limits = this.getRateLimits(trust);
+        // 3. Handle probes (don't require 'message' permission)
+        if (isProbe) {
+            if (this.rateLimiter.isProbeRateLimited(fingerprint, limits.probesPerHour)) {
+                this.metrics.blocked++;
+                this.metrics.blockedByRate++;
+                return { action: 'block', reason: 'probe_rate_limited', fingerprint };
+            }
+            this.metrics.probesHandled++;
+            // Probes are handled inline — return pass with probe flag
+            return { action: 'pass', message, trustLevel: trust, reason: 'probe' };
+        }
+        // 4. Message permission check
+        const allowedOps = this.trustManager.getAllowedOperationsByFingerprint(fingerprint);
+        if (!allowedOps.includes(opType)) {
+            this.metrics.blocked++;
+            this.metrics.blockedByTrust++;
+            return { action: 'block', reason: 'insufficient_trust', fingerprint };
+        }
+        // 5. Rate limit check (per-sender, trust-level-aware)
+        if (this.rateLimiter.isMessageHourLimited(fingerprint, limits.messagesPerHour)) {
+            this.metrics.blocked++;
+            this.metrics.blockedByRate++;
+            return { action: 'block', reason: 'rate_limited_hourly', fingerprint };
+        }
+        if (this.rateLimiter.isMessageDayLimited(fingerprint, limits.messagesPerDay)) {
+            this.metrics.blocked++;
+            this.metrics.blockedByRate++;
+            return { action: 'block', reason: 'rate_limited_daily', fingerprint };
+        }
+        // 6. Record interaction (debounced)
+        this.trustManager.recordMessageReceivedByFingerprint(fingerprint);
+        // 7. Record messageId for replay protection
+        if (messageId) {
+            this.seenMessageIds.set(messageId, Date.now());
+        }
+        // 8. Pass to ThreadlineRouter -> AutonomyGate handles delivery mode
+        this.metrics.passed++;
+        return { action: 'pass', message, trustLevel: trust };
+    }
+    /**
+     * Get gate metrics for observability.
+     */
+    getMetrics() {
+        return { ...this.metrics };
+    }
+    /**
+     * Shutdown: cleanup timers.
+     */
+    shutdown() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+    }
+    // ── Private ─────────────────────────────────────────────────────
+    classifyOperation(message) {
+        // Check for explicit operation type in content
+        const content = message.content;
+        if (typeof content === 'object' && content !== null && 'type' in content) {
+            return content.type;
+        }
+        // Default: treat as 'message'
+        return 'message';
+    }
+    estimatePayloadSize(message) {
+        try {
+            return Buffer.byteLength(JSON.stringify(message.content), 'utf-8');
+        }
+        catch {
+            return 0;
+        }
+    }
+    getRateLimits(trust) {
+        return {
+            ...DEFAULT_RATE_LIMITS[trust],
+            ...this.config.rateLimits?.[trust],
+        };
+    }
+    /**
+     * Extract messageId from a ReceivedMessage.
+     */
+    extractMessageId(message) {
+        // ReceivedMessage has a messageId field directly
+        if (message.messageId)
+            return message.messageId;
+        // Also check content for a messageId field
+        if (typeof message.content === 'object' && message.content !== null) {
+            const c = message.content;
+            if (typeof c.messageId === 'string')
+                return c.messageId;
+        }
+        return null;
+    }
+    /**
+     * Prune expired entries from the seen-messageId cache.
+     */
+    pruneSeenMessageIds() {
+        const now = Date.now();
+        for (const [id, timestamp] of this.seenMessageIds) {
+            if (now - timestamp > SEEN_MESSAGE_TTL_MS) {
+                this.seenMessageIds.delete(id);
+            }
+        }
+    }
+}
+//# sourceMappingURL=InboundMessageGate.js.map

package/dist/threadline/InboundMessageGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InboundMessageGate.js","sourceRoot":"","sources":["../../src/threadline/InboundMessageGate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuBH,wDAAwD;AACxD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9C,0CAA0C;AAC1C,MAAM,mBAAmB,GAAwG;IAC/H,SAAS,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE;IACtE,QAAQ,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IACxE,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE;IACzE,UAAU,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE;CACjF,CAAC;AAEF,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO;AAE5C,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ3C,MAAM,oBAAoB;IACP,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,kBAAkB,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEnE,kBAAkB,CAAC,WAAmB,EAAE,KAAa;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/E,CAAC;IAED,oBAAoB,CAAC,WAAmB,EAAE,KAAa;QACrD,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,cAAc;QAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACrF,CAAC;IAED,mBAAmB,CAAC,WAAmB,EAAE,KAAa;QACpD,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzF,CAAC;IAEO,SAAS,CAAC,OAAgC,EAAE,GAAW,EAAE,KAAa,EAAE,QAAgB;QAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,2BAA2B;QAC3B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,WAAmB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3F,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;gBACtE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACnC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,wEAAwE;AAExE,MAAM,OAAO,kBAAkB;IACZ,YAAY,CAAoB;IACzC,MAAM,CAA0B;IACvB,MAAM,CAAoB;IAC1B,WAAW,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACzC,eAAe,CAAS;IACjC,YAAY,GAA0C,IAAI,CAAC;IAEnE,iDAAiD;IAChC,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5D,UAAU;IACF,OAAO,GAAG;QAChB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,aAAa,EAAE,CAAC;KACjB,CAAC;IAEF,YACE,YAA+B,EAC/B,MAA+B,EAC/B,SAA4B,EAAE;QAE9B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,iBAAiB,CAAC;QAEnE,qFAAqF;QACrF,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAwB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;QAEjC,qDAAqD;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;QACrE,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;QACvE,CAAC;QAED,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEtC,wCAAwC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAEzC,wDAAwD;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7B,0DAA0D;YAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACzE,CAAC;QAED,8BAA8B;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,iCAAiC,CAAC,WAAW,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACxE,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACxE,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,YAAY,CAAC,kCAAkC,CAAC,WAAW,CAAC,CAAC;QAElE,4CAA4C;QAC5C,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,oEAAoE;QACpE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,mEAAmE;IAE3D,iBAAiB,CAAC,OAAwB;QAChD,+CAA+C;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YACzE,OAAQ,OAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC;QACD,8BAA8B;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,mBAAmB,CAAC,OAAwB;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,KAAsB;QAC1C,OAAO;YACL,GAAG,mBAAmB,CAAC,KAAK,CAAC;YAC7B,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAwB;QAC/C,iDAAiD;QACjD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,SAAS,CAAC;QAChD,2CAA2C;QAC3C,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,OAAO,CAAC,OAA6C,CAAC;YAChE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAClD,IAAI,GAAG,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAAC;gBAC1C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/threadline/InvitationManager.d.ts

@@ -0,0 +1,91 @@
+/**
+ * InvitationManager — Invitation token lifecycle for Threadline trust bootstrap.
+ *
+ * Manages cryptographically random invitation tokens with:
+ * - Optional expiry and max-uses
+ * - HMAC-SHA256 signing with auto-generated server secret
+ * - Single-use and multi-use token support
+ * - Persistent storage to {stateDir}/threadline/invitations.json
+ *
+ * Part of Threadline Protocol Phase 6C.
+ */
+export interface InvitationCreateOptions {
+    /** Human-readable label for the invitation */
+    label?: string;
+    /** Expiry time in milliseconds from now. Omit for no expiry. */
+    expiresInMs?: number;
+    /** Maximum number of uses. Default: 1 (single-use). 0 = unlimited. */
+    maxUses?: number;
+}
+export interface Invitation {
+    /** The token value (hex-encoded random bytes) */
+    token: string;
+    /** HMAC-SHA256 signature of the token */
+    hmac: string;
+    /** Human-readable label */
+    label?: string;
+    /** ISO timestamp when the invitation was created */
+    createdAt: string;
+    /** ISO timestamp when the invitation expires, or null for no expiry */
+    expiresAt: string | null;
+    /** Maximum number of uses (0 = unlimited) */
+    maxUses: number;
+    /** Number of times the token has been consumed */
+    useCount: number;
+    /** Agent identities that have consumed this token */
+    consumedBy: string[];
+    /** Whether the invitation has been manually revoked */
+    revoked: boolean;
+}
+export type InvitationStatus = 'valid' | 'expired' | 'exhausted' | 'revoked' | 'not-found' | 'invalid-hmac';
+export interface InvitationValidateResult {
+    status: InvitationStatus;
+    invitation?: Invitation;
+    reason: string;
+}
+export declare class InvitationManager {
+    private readonly threadlineDir;
+    private readonly invitationsPath;
+    private readonly secretPath;
+    private readonly secret;
+    private invitations;
+    constructor(options: {
+        stateDir: string;
+    });
+    /**
+     * Create a new invitation token.
+     * Returns the full token string (needed for sharing with the invitee).
+     */
+    create(options?: InvitationCreateOptions): string;
+    /**
+     * Validate an invitation token.
+     * Checks existence, HMAC integrity, expiry, use count, and revocation status.
+     */
+    validate(token: string): InvitationValidateResult;
+    /**
+     * Consume an invitation token for a given agent identity.
+     * Single-use tokens are effectively invalidated after first consume.
+     * Returns the validation result (will be 'valid' if consumption succeeded).
+     */
+    consume(token: string, agentIdentity: string): InvitationValidateResult;
+    /**
+     * Manually revoke an invitation token.
+     * Returns true if the token was found and revoked, false if not found.
+     */
+    revoke(token: string): boolean;
+    /**
+     * List all invitation tokens with their current status.
+     */
+    list(): Array<Invitation & {
+        status: InvitationStatus;
+    }>;
+    /**
+     * Force reload invitations from disk.
+     */
+    reload(): void;
+    private computeHmac;
+    private loadOrCreateSecret;
+    private loadInvitations;
+    private save;
+}
+//# sourceMappingURL=InvitationManager.d.ts.map

package/dist/threadline/InvitationManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvitationManager.d.ts","sourceRoot":"","sources":["../../src/threadline/InvitationManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,uBAAuB;IACtC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAC;AAE5G,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,gBAAgB,CAAC;IACzB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAiCD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,WAAW,CAA6B;gBAEpC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE;IAYzC;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,MAAM;IA2BjD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB;IAwDjD;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,wBAAwB;IAwBvE;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAW9B;;OAEG;IACH,IAAI,IAAI,KAAK,CAAC,UAAU,GAAG;QAAE,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC;IASxD;;OAEG;IACH,MAAM,IAAI,IAAI;IAMd,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,IAAI;CAWb"}

package/dist/threadline/InvitationManager.js

@@ -0,0 +1,228 @@
+/**
+ * InvitationManager — Invitation token lifecycle for Threadline trust bootstrap.
+ *
+ * Manages cryptographically random invitation tokens with:
+ * - Optional expiry and max-uses
+ * - HMAC-SHA256 signing with auto-generated server secret
+ * - Single-use and multi-use token support
+ * - Persistent storage to {stateDir}/threadline/invitations.json
+ *
+ * Part of Threadline Protocol Phase 6C.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+// ── Helpers ──────────────────────────────────────────────────────────
+function atomicWrite(filePath, data) {
+    const tmpPath = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    try {
+        fs.writeFileSync(tmpPath, data);
+        fs.renameSync(tmpPath, filePath);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmpPath);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+}
+function safeJsonParse(filePath, fallback) {
+    try {
+        if (!fs.existsSync(filePath))
+            return fallback;
+        return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+// ── Implementation ───────────────────────────────────────────────────
+export class InvitationManager {
+    threadlineDir;
+    invitationsPath;
+    secretPath;
+    secret;
+    invitations;
+    constructor(options) {
+        this.threadlineDir = path.join(options.stateDir, 'threadline');
+        fs.mkdirSync(this.threadlineDir, { recursive: true });
+        this.invitationsPath = path.join(this.threadlineDir, 'invitations.json');
+        this.secretPath = path.join(this.threadlineDir, 'invitation-secret.key');
+        this.secret = this.loadOrCreateSecret();
+        this.invitations = this.loadInvitations();
+    }
+    // ── Token Creation ─────────────────────────────────────────────
+    /**
+     * Create a new invitation token.
+     * Returns the full token string (needed for sharing with the invitee).
+     */
+    create(options) {
+        const token = crypto.randomBytes(32).toString('hex');
+        const hmac = this.computeHmac(token);
+        const now = new Date();
+        const invitation = {
+            token,
+            hmac,
+            label: options?.label,
+            createdAt: now.toISOString(),
+            expiresAt: options?.expiresInMs
+                ? new Date(now.getTime() + options.expiresInMs).toISOString()
+                : null,
+            maxUses: options?.maxUses ?? 1,
+            useCount: 0,
+            consumedBy: [],
+            revoked: false,
+        };
+        this.invitations[token] = invitation;
+        this.save();
+        return token;
+    }
+    // ── Token Validation ───────────────────────────────────────────
+    /**
+     * Validate an invitation token.
+     * Checks existence, HMAC integrity, expiry, use count, and revocation status.
+     */
+    validate(token) {
+        const invitation = this.invitations[token];
+        if (!invitation) {
+            return { status: 'not-found', reason: 'Invitation token not found' };
+        }
+        // Verify HMAC integrity
+        const expectedHmac = this.computeHmac(token);
+        if (!crypto.timingSafeEqual(Buffer.from(invitation.hmac, 'hex'), Buffer.from(expectedHmac, 'hex'))) {
+            return {
+                status: 'invalid-hmac',
+                invitation,
+                reason: 'Invitation token HMAC verification failed — possible tampering',
+            };
+        }
+        // Check revocation
+        if (invitation.revoked) {
+            return {
+                status: 'revoked',
+                invitation,
+                reason: 'Invitation has been revoked',
+            };
+        }
+        // Check expiry
+        if (invitation.expiresAt) {
+            const expiresAt = new Date(invitation.expiresAt).getTime();
+            if (Date.now() > expiresAt) {
+                return {
+                    status: 'expired',
+                    invitation,
+                    reason: `Invitation expired at ${invitation.expiresAt}`,
+                };
+            }
+        }
+        // Check use count (0 = unlimited)
+        if (invitation.maxUses > 0 && invitation.useCount >= invitation.maxUses) {
+            return {
+                status: 'exhausted',
+                invitation,
+                reason: `Invitation has been used ${invitation.useCount}/${invitation.maxUses} times`,
+            };
+        }
+        return {
+            status: 'valid',
+            invitation,
+            reason: 'Invitation is valid',
+        };
+    }
+    // ── Token Consumption ──────────────────────────────────────────
+    /**
+     * Consume an invitation token for a given agent identity.
+     * Single-use tokens are effectively invalidated after first consume.
+     * Returns the validation result (will be 'valid' if consumption succeeded).
+     */
+    consume(token, agentIdentity) {
+        const validation = this.validate(token);
+        if (validation.status !== 'valid') {
+            return validation;
+        }
+        const invitation = this.invitations[token];
+        invitation.useCount++;
+        if (!invitation.consumedBy.includes(agentIdentity)) {
+            invitation.consumedBy.push(agentIdentity);
+        }
+        this.save();
+        return {
+            status: 'valid',
+            invitation,
+            reason: `Invitation consumed by ${agentIdentity} (use ${invitation.useCount}/${invitation.maxUses || 'unlimited'})`,
+        };
+    }
+    // ── Token Revocation ───────────────────────────────────────────
+    /**
+     * Manually revoke an invitation token.
+     * Returns true if the token was found and revoked, false if not found.
+     */
+    revoke(token) {
+        const invitation = this.invitations[token];
+        if (!invitation)
+            return false;
+        invitation.revoked = true;
+        this.save();
+        return true;
+    }
+    // ── Token Listing ──────────────────────────────────────────────
+    /**
+     * List all invitation tokens with their current status.
+     */
+    list() {
+        return Object.values(this.invitations).map(inv => {
+            const validation = this.validate(inv.token);
+            return { ...inv, status: validation.status };
+        });
+    }
+    // ── Persistence ────────────────────────────────────────────────
+    /**
+     * Force reload invitations from disk.
+     */
+    reload() {
+        this.invitations = this.loadInvitations();
+    }
+    // ── Private ────────────────────────────────────────────────────
+    computeHmac(token) {
+        return crypto.createHmac('sha256', this.secret).update(token).digest('hex');
+    }
+    loadOrCreateSecret() {
+        try {
+            if (fs.existsSync(this.secretPath)) {
+                return fs.readFileSync(this.secretPath);
+            }
+        }
+        catch {
+            // Fall through to create new secret
+        }
+        const secret = crypto.randomBytes(32);
+        try {
+            fs.writeFileSync(this.secretPath, secret, { mode: 0o600 });
+        }
+        catch {
+            // If we can't persist, use ephemeral secret (tokens won't survive restart)
+        }
+        return secret;
+    }
+    loadInvitations() {
+        const data = safeJsonParse(this.invitationsPath, {
+            invitations: {},
+            updatedAt: '',
+        });
+        return data.invitations;
+    }
+    save() {
+        try {
+            const data = {
+                invitations: this.invitations,
+                updatedAt: new Date().toISOString(),
+            };
+            atomicWrite(this.invitationsPath, JSON.stringify(data, null, 2));
+        }
+        catch {
+            // Save failure should not break operations
+        }
+    }
+}
+//# sourceMappingURL=InvitationManager.js.map

package/dist/threadline/InvitationManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvitationManager.js","sourceRoot":"","sources":["../../src/threadline/InvitationManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA0C7B,wEAAwE;AAExE,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACxF,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAI,QAAgB,EAAE,QAAW;IACrD,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AASD,wEAAwE;AAExE,MAAM,OAAO,iBAAiB;IACX,aAAa,CAAS;IACtB,eAAe,CAAS;IACxB,UAAU,CAAS;IACnB,MAAM,CAAS;IACxB,WAAW,CAA6B;IAEhD,YAAY,OAA6B;QACvC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IAC5C,CAAC;IAED,kEAAkE;IAElE;;;OAGG;IACH,MAAM,CAAC,OAAiC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,UAAU,GAAe;YAC7B,KAAK;YACL,IAAI;YACJ,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,OAAO,EAAE,WAAW;gBAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;gBAC7D,CAAC,CAAC,IAAI;YACR,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC;YAC9B,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,KAAK;SACf,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QAEZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kEAAkE;IAElE;;;OAGG;IACH,QAAQ,CAAC,KAAa;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QACvE,CAAC;QAED,wBAAwB;QACxB,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACnG,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,UAAU;gBACV,MAAM,EAAE,gEAAgE;aACzE,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,UAAU;gBACV,MAAM,EAAE,6BAA6B;aACtC,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,UAAU;oBACV,MAAM,EAAE,yBAAyB,UAAU,CAAC,SAAS,EAAE;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,UAAU,CAAC,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxE,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,UAAU;gBACV,MAAM,EAAE,4BAA4B,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,QAAQ;aACtF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,OAAO;YACf,UAAU;YACV,MAAM,EAAE,qBAAqB;SAC9B,CAAC;IACJ,CAAC;IAED,kEAAkE;IAElE;;;;OAIG;IACH,OAAO,CAAC,KAAa,EAAE,aAAqB;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExC,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,UAAU,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;QAEZ,OAAO;YACL,MAAM,EAAE,OAAO;YACf,UAAU;YACV,MAAM,EAAE,0BAA0B,aAAa,SAAS,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,IAAI,WAAW,GAAG;SACpH,CAAC;IACJ,CAAC;IAED,kEAAkE;IAElE;;;OAGG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAE9B,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAElE;;OAEG;IACH,IAAI;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAElE;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IAC5C,CAAC;IAED,kEAAkE;IAE1D,WAAW,CAAC,KAAa;QAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,eAAe;QACrB,MAAM,IAAI,GAAG,aAAa,CAAkB,IAAI,CAAC,eAAe,EAAE;YAChE,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,MAAM,IAAI,GAAoB;gBAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;CACF"}