@iflow-mcp/jkheadley-instar 0.26.2

package/dist/threadline/relay/A2ABridge.js

@@ -0,0 +1,457 @@
+/**
+ * A2ABridge — Translates A2A HTTP requests into Threadline relay messages.
+ *
+ * Enables standard A2A agents to communicate with Threadline agents connected
+ * to the relay. Each public agent gets A2A endpoints automatically.
+ *
+ * Security boundary: The A2A bridge terminates E2E encryption at the
+ * translation boundary. Messages arriving via A2A are re-encrypted for
+ * the target Threadline agent using ephemeral keys.
+ *
+ * Part of Threadline Relay Phase 2.
+ */
+import crypto from 'node:crypto';
+import { MessageEncryptor, deriveX25519PublicKey } from '../client/MessageEncryptor.js';
+import { generateIdentityKeyPair } from '../ThreadlineCrypto.js';
+export class A2ABridgeRateLimiter {
+    config;
+    windows = new Map();
+    constructor(config) {
+        this.config = {
+            requestsPerMinutePerIP: config?.requestsPerMinutePerIP ?? 20,
+            requestsPerHourPerIP: config?.requestsPerHourPerIP ?? 200,
+        };
+    }
+    check(ip) {
+        const now = Date.now();
+        // Per-minute check
+        const minKey = `min:${ip}`;
+        const minEvents = this.cleanAndGet(minKey, now - 60_000);
+        if (minEvents.length >= this.config.requestsPerMinutePerIP) {
+            return { allowed: false, limitType: 'per_ip_minute' };
+        }
+        // Per-hour check
+        const hourKey = `hour:${ip}`;
+        const hourEvents = this.cleanAndGet(hourKey, now - 3_600_000);
+        if (hourEvents.length >= this.config.requestsPerHourPerIP) {
+            return { allowed: false, limitType: 'per_ip_hour' };
+        }
+        return { allowed: true };
+    }
+    record(ip) {
+        const now = Date.now();
+        this.getOrCreate(`min:${ip}`).push(now);
+        this.getOrCreate(`hour:${ip}`).push(now);
+    }
+    reset() {
+        this.windows.clear();
+    }
+    cleanAndGet(key, cutoff) {
+        const events = this.getOrCreate(key);
+        const filtered = events.filter(t => t > cutoff);
+        this.windows.set(key, filtered);
+        return filtered;
+    }
+    getOrCreate(key) {
+        if (!this.windows.has(key)) {
+            this.windows.set(key, []);
+        }
+        return this.windows.get(key);
+    }
+}
+// ── Context ID ↔ Thread ID Mapping ──────────────────────────────────
+class ContextThreadMapper {
+    contextToThread = new Map();
+    threadToContext = new Map();
+    getOrCreateThreadId(contextId) {
+        if (contextId && this.contextToThread.has(contextId)) {
+            return { threadId: this.contextToThread.get(contextId), isNew: false };
+        }
+        const threadId = `a2a-${crypto.randomUUID()}`;
+        const ctx = contextId ?? `ctx-${crypto.randomUUID()}`;
+        this.contextToThread.set(ctx, threadId);
+        this.threadToContext.set(threadId, ctx);
+        return { threadId, isNew: true };
+    }
+    getContextId(threadId) {
+        return this.threadToContext.get(threadId);
+    }
+}
+// ── A2A Bridge Implementation ───────────────────────────────────────
+export class A2ABridge {
+    config;
+    deps;
+    contextMapper = new ContextThreadMapper();
+    pendingTasks = new Map();
+    concurrentTasks = new Map();
+    /** Bridge identity — used to encrypt messages to Threadline agents */
+    bridgeIdentity = generateIdentityKeyPair();
+    bridgeEncryptor;
+    constructor(config, deps) {
+        this.config = {
+            baseUrl: config.baseUrl,
+            responseTimeoutMs: config.responseTimeoutMs ?? 300_000,
+            maxConcurrentTasksPerAgent: config.maxConcurrentTasksPerAgent ?? 3,
+            maxRequestBodySize: config.maxRequestBodySize ?? 65_536,
+        };
+        this.deps = deps;
+        this.bridgeEncryptor = new MessageEncryptor(this.bridgeIdentity.privateKey, this.bridgeIdentity.publicKey);
+    }
+    /**
+     * Handle an HTTP request to the A2A bridge.
+     * Returns true if the request was handled, false if not an A2A route.
+     */
+    async handleRequest(req, res, pathname) {
+        // Parse: /a2a/{agentId}/...
+        const match = pathname.match(/^\/a2a\/([a-f0-9]+)(\/.*)?$/);
+        if (!match)
+            return false;
+        const agentId = match[1];
+        const subpath = match[2] ?? '/';
+        const ip = req.headers['x-forwarded-for']?.split(',')[0]?.trim()
+            ?? req.socket.remoteAddress ?? 'unknown';
+        // Rate limit
+        const rateCheck = this.deps.rateLimiter.check(ip);
+        if (!rateCheck.allowed) {
+            this.sendJsonRpcError(res, null, -32000, 'Rate limited', 429);
+            return true;
+        }
+        // Agent card
+        if (subpath === '/.well-known/agent-card.json' && req.method === 'GET') {
+            this.handleAgentCard(res, agentId);
+            return true;
+        }
+        // Messages
+        if (subpath === '/messages' && req.method === 'POST') {
+            this.deps.rateLimiter.record(ip);
+            await this.handleMessage(req, res, agentId);
+            return true;
+        }
+        // Task status
+        const taskMatch = subpath.match(/^\/tasks\/([^/]+)$/);
+        if (taskMatch && req.method === 'GET') {
+            this.handleTaskStatus(res, taskMatch[1]);
+            return true;
+        }
+        // Task cancel
+        const cancelMatch = subpath.match(/^\/tasks\/([^/]+):cancel$/);
+        if (cancelMatch && req.method === 'POST') {
+            this.handleTaskCancel(res, cancelMatch[1]);
+            return true;
+        }
+        this.sendJsonRpcError(res, null, -32601, 'Method not found', 404);
+        return true;
+    }
+    /**
+     * Handle an agent's response to a pending A2A task.
+     * Called when a Threadline agent sends a message that matches a pending task thread.
+     */
+    handleAgentResponse(envelope) {
+        // Find pending task by thread ID
+        for (const [taskId, task] of this.pendingTasks) {
+            if (task.threadId === envelope.threadId && task.agentId === envelope.from) {
+                clearTimeout(task.timeout);
+                // Decrypt the response (bridge has the keys)
+                let responseText = '[encrypted response]';
+                try {
+                    const agentPresence = this.deps.presence.get(envelope.from);
+                    if (agentPresence) {
+                        const agentPubKey = Buffer.from(agentPresence.publicKey, 'base64');
+                        const agentX25519 = deriveX25519PublicKey(this.bridgeIdentity.privateKey);
+                        // Note: In production, we'd need the agent's X25519 public key
+                        // For now, the bridge can't decrypt the response directly because
+                        // it doesn't have the agent's X25519 key. The response is forwarded as-is.
+                        responseText = envelope.payload; // Base64 ciphertext
+                    }
+                }
+                catch {
+                    // Decryption failed — return raw payload
+                }
+                task.status = 'completed';
+                task.resolve({
+                    id: taskId,
+                    status: 'completed',
+                    artifacts: [{
+                            parts: [{ type: 'text', text: responseText }],
+                        }],
+                });
+                this.pendingTasks.delete(taskId);
+                this.decrementConcurrent(task.agentId);
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Get the bridge's fingerprint (for identifying A2A bridge messages).
+     */
+    get bridgeFingerprint() {
+        return this.bridgeEncryptor.fingerprint;
+    }
+    /**
+     * Destroy the bridge — clean up pending tasks.
+     */
+    destroy() {
+        for (const [, task] of this.pendingTasks) {
+            clearTimeout(task.timeout);
+            task.resolve({
+                id: task.taskId,
+                status: 'failed',
+                error: { code: -32003, message: 'Bridge shutting down' },
+            });
+        }
+        this.pendingTasks.clear();
+        this.concurrentTasks.clear();
+    }
+    // ── Private: Route Handlers ─────────────────────────────────────
+    handleAgentCard(res, agentId) {
+        const entry = this.deps.presence.get(agentId);
+        if (!entry || entry.visibility !== 'public') {
+            this.sendJsonRpcError(res, null, -32001, 'Agent not found', 404);
+            return;
+        }
+        const card = this.generateAgentCard(entry);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(card, null, 2));
+    }
+    async handleMessage(req, res, agentId) {
+        // Check agent exists and is online
+        const entry = this.deps.presence.get(agentId);
+        if (!entry) {
+            this.sendJsonRpcError(res, null, -32001, 'Agent not found or offline', 404);
+            return;
+        }
+        // Check concurrent task limit
+        const concurrent = this.concurrentTasks.get(agentId) ?? 0;
+        if (concurrent >= this.config.maxConcurrentTasksPerAgent) {
+            this.sendJsonRpcError(res, null, -32002, 'Too many concurrent tasks for this agent', 429);
+            return;
+        }
+        // Read body
+        const body = await this.readBody(req);
+        if (!body) {
+            this.sendJsonRpcError(res, null, -32700, 'Parse error: body too large or invalid', 400);
+            return;
+        }
+        let request;
+        try {
+            request = JSON.parse(body);
+        }
+        catch {
+            this.sendJsonRpcError(res, null, -32700, 'Parse error: invalid JSON', 400);
+            return;
+        }
+        if (request.method !== 'message/send') {
+            this.sendJsonRpcError(res, request.id, -32601, `Method not supported: ${request.method}`, 400);
+            return;
+        }
+        const params = request.params;
+        if (!params?.message?.parts?.length) {
+            this.sendJsonRpcError(res, request.id, -32602, 'Missing message.parts', 400);
+            return;
+        }
+        // Extract text from message parts
+        const textParts = params.message.parts
+            .filter(p => p.type === 'text' && p.text)
+            .map(p => p.text);
+        const messageText = textParts.join('\n');
+        if (!messageText) {
+            this.sendJsonRpcError(res, request.id, -32602, 'No text content in message', 400);
+            return;
+        }
+        // Map context ID to thread ID
+        const { threadId, isNew } = this.contextMapper.getOrCreateThreadId(params.contextId);
+        // Create task
+        const taskId = `task-${crypto.randomUUID()}`;
+        // Build encrypted envelope for the Threadline agent
+        const agentPubKey = Buffer.from(entry.publicKey, 'base64');
+        // For the bridge, we need the agent's X25519 public key
+        // Since we derive from Ed25519 private key, and we only have the agent's Ed25519 public key,
+        // we need to compute it differently. We'll use the bridge's own encryptor which
+        // handles the key derivation.
+        const agentX25519Pub = deriveX25519PublicKey(this.bridgeIdentity.privateKey);
+        // This is the bridge's own X25519 public key — the real agent's X25519 pub is not available here.
+        // In practice, the relay would negotiate X25519 keys during auth.
+        // For Phase 2, we send unencrypted content in a structured envelope.
+        const envelope = {
+            from: this.bridgeEncryptor.fingerprint,
+            to: agentId,
+            threadId,
+            messageId: `a2a-${crypto.randomUUID()}`,
+            timestamp: new Date().toISOString(),
+            nonce: crypto.randomBytes(16).toString('base64'),
+            ephemeralPubKey: '', // A2A bridge doesn't use E2E encryption
+            salt: '',
+            // For A2A bridge messages, payload is base64-encoded plaintext JSON
+            // This is the documented security trade-off (Section 6.6)
+            payload: Buffer.from(JSON.stringify({
+                content: messageText,
+                type: 'a2a-message',
+                metadata: {
+                    transport: 'a2a-bridge',
+                    a2aTaskId: taskId,
+                    contextId: params.contextId,
+                    isNewThread: isNew,
+                },
+            })).toString('base64'),
+            signature: '', // A2A bridge messages are not E2E signed
+        };
+        // Register response handler
+        const taskPromise = new Promise((resolve) => {
+            const timeout = setTimeout(() => {
+                this.pendingTasks.delete(taskId);
+                this.decrementConcurrent(agentId);
+                resolve({
+                    id: taskId,
+                    status: 'failed',
+                    error: { code: -32004, message: 'Task timeout' },
+                });
+            }, this.config.responseTimeoutMs);
+            this.pendingTasks.set(taskId, {
+                taskId,
+                agentId,
+                threadId,
+                status: 'submitted',
+                createdAt: Date.now(),
+                timeout,
+                resolve,
+            });
+        });
+        this.incrementConcurrent(agentId);
+        // Forward to agent
+        const sent = this.deps.sendToAgent(agentId, envelope);
+        if (!sent) {
+            const task = this.pendingTasks.get(taskId);
+            if (task) {
+                clearTimeout(task.timeout);
+                this.pendingTasks.delete(taskId);
+            }
+            this.decrementConcurrent(agentId);
+            this.sendJsonRpcError(res, request.id, -32003, 'Failed to deliver to agent', 502);
+            return;
+        }
+        // Wait for response (with timeout)
+        const result = await taskPromise;
+        // Send JSON-RPC response
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            jsonrpc: '2.0',
+            id: request.id,
+            result,
+        }));
+    }
+    handleTaskStatus(res, taskId) {
+        const task = this.pendingTasks.get(taskId);
+        if (!task) {
+            // Task may have completed
+            this.sendJsonRpcError(res, null, -32001, 'Task not found', 404);
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            jsonrpc: '2.0',
+            id: null,
+            result: {
+                id: taskId,
+                status: task.status,
+            },
+        }));
+    }
+    handleTaskCancel(res, taskId) {
+        const task = this.pendingTasks.get(taskId);
+        if (!task) {
+            this.sendJsonRpcError(res, null, -32001, 'Task not found', 404);
+            return;
+        }
+        clearTimeout(task.timeout);
+        task.status = 'canceled';
+        task.resolve({
+            id: taskId,
+            status: 'canceled',
+        });
+        this.pendingTasks.delete(taskId);
+        this.decrementConcurrent(task.agentId);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            jsonrpc: '2.0',
+            id: null,
+            result: { id: taskId, status: 'canceled' },
+        }));
+    }
+    // ── Private: Helpers ────────────────────────────────────────────
+    generateAgentCard(entry) {
+        const skills = (entry.metadata.capabilities ?? []).map(cap => ({
+            id: cap,
+            name: cap.replace(/-/g, ' ').replace(/\b\w/g, c => c.toUpperCase()),
+            description: `${cap} capability via Threadline relay`,
+            inputModes: ['text/plain'],
+            outputModes: ['text/plain'],
+        }));
+        return {
+            name: entry.metadata.name,
+            description: `${entry.metadata.name} — available via Threadline relay`,
+            url: `${this.config.baseUrl}/a2a/${entry.agentId}`,
+            version: entry.metadata.version ?? '1.0.0',
+            capabilities: {
+                streaming: false, // Phase 2: synchronous only
+                pushNotifications: false,
+                stateTransitionHistory: false,
+            },
+            skills: skills.length > 0 ? skills : [{
+                    id: 'conversation',
+                    name: 'Persistent Conversation',
+                    description: 'Engage in a persistent conversation that resumes across sessions',
+                    inputModes: ['text/plain'],
+                    outputModes: ['text/plain'],
+                }],
+            extensions: {
+                threadline: {
+                    version: '1.0.0',
+                    relayId: entry.agentId,
+                    directConnect: this.config.baseUrl.replace(/^http/, 'ws') + '/v1/connect',
+                    transport: 'a2a-bridge',
+                },
+            },
+        };
+    }
+    readBody(req) {
+        return new Promise((resolve) => {
+            const chunks = [];
+            let size = 0;
+            req.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > this.config.maxRequestBodySize) {
+                    resolve(null);
+                    req.destroy();
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            req.on('end', () => {
+                resolve(Buffer.concat(chunks).toString('utf-8'));
+            });
+            req.on('error', () => resolve(null));
+        });
+    }
+    sendJsonRpcError(res, id, code, message, httpStatus = 200) {
+        res.writeHead(httpStatus, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            jsonrpc: '2.0',
+            id,
+            error: { code, message },
+        }));
+    }
+    incrementConcurrent(agentId) {
+        this.concurrentTasks.set(agentId, (this.concurrentTasks.get(agentId) ?? 0) + 1);
+    }
+    decrementConcurrent(agentId) {
+        const current = this.concurrentTasks.get(agentId) ?? 0;
+        if (current <= 1) {
+            this.concurrentTasks.delete(agentId);
+        }
+        else {
+            this.concurrentTasks.set(agentId, current - 1);
+        }
+    }
+}
+//# sourceMappingURL=A2ABridge.js.map

package/dist/threadline/relay/A2ABridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"A2ABridge.js","sourceRoot":"","sources":["../../../src/threadline/relay/A2ABridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAIjC,OAAO,EAAE,gBAAgB,EAAsB,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC5G,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAiFjE,MAAM,OAAO,oBAAoB;IACd,MAAM,CAA2B;IACjC,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvD,YAAY,MAA0C;QACpD,IAAI,CAAC,MAAM,GAAG;YACZ,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,IAAI,EAAE;YAC5D,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,IAAI,GAAG;SAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EAAU;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,mBAAmB;QACnB,MAAM,MAAM,GAAG,OAAO,EAAE,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;QACxD,CAAC;QAED,iBAAiB;QACjB,MAAM,OAAO,GAAG,QAAQ,EAAE,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QACtD,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,WAAW,CAAC,GAAW,EAAE,MAAc;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAChC,CAAC;CACF;AAED,uEAAuE;AAEvE,MAAM,mBAAmB;IACN,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7D,mBAAmB,CAAC,SAA6B;QAC/C,IAAI,SAAS,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,uEAAuE;AAEvE,MAAM,OAAO,SAAS;IACH,MAAM,CAA4B;IAClC,IAAI,CAAgB;IACpB,aAAa,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC1C,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;IACvE,sEAAsE;IACrD,cAAc,GAAG,uBAAuB,EAAE,CAAC;IAC3C,eAAe,CAAmB;IAEnD,YAAY,MAAuB,EAAE,IAAmB;QACtD,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,OAAO;YACtD,0BAA0B,EAAE,MAAM,CAAC,0BAA0B,IAAI,CAAC;YAClE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM;SACxD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,eAAe,GAAG,IAAI,gBAAgB,CACzC,IAAI,CAAC,cAAc,CAAC,UAAU,EAC9B,IAAI,CAAC,cAAc,CAAC,SAAS,CAC9B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB;QAC7E,4BAA4B;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAEhC,MAAM,EAAE,GAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;eACvE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAE3C,aAAa;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,aAAa;QACb,IAAI,OAAO,KAAK,8BAA8B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvE,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,WAAW;QACX,IAAI,OAAO,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACtD,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/D,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAyB;QAC3C,iCAAiC;QACjC,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC1E,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAE3B,6CAA6C;gBAC7C,IAAI,YAAY,GAAG,sBAAsB,CAAC;gBAC1C,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC5D,IAAI,aAAa,EAAE,CAAC;wBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;wBACnE,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;wBAC1E,+DAA+D;wBAC/D,kEAAkE;wBAClE,2EAA2E;wBAC3E,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,oBAAoB;oBACvD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,yCAAyC;gBAC3C,CAAC;gBAED,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC;oBACX,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,WAAW;oBACnB,SAAS,EAAE,CAAC;4BACV,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;yBAC9C,CAAC;iBACH,CAAC,CAAC;gBAEH,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC;gBACX,EAAE,EAAE,IAAI,CAAC,MAAM;gBACf,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,mEAAmE;IAE3D,eAAe,CAAC,GAAmB,EAAE,OAAyB;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,GAAoB,EACpB,GAAmB,EACnB,OAAyB;QAEzB,mCAAmC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC;YACzD,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,YAAY;QACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,yBAAyB,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAGV,CAAC;QAEd,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK;aACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC;QACrB,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAErF,cAAc;QACd,MAAM,MAAM,GAAG,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAE7C,oDAAoD;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3D,wDAAwD;QACxD,6FAA6F;QAC7F,gFAAgF;QAChF,8BAA8B;QAC9B,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7E,kGAAkG;QAClG,kEAAkE;QAClE,qEAAqE;QAErE,MAAM,QAAQ,GAAoB;YAChC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW;YACtC,EAAE,EAAE,OAAO;YACX,QAAQ;YACR,SAAS,EAAE,OAAO,MAAM,CAAC,UAAU,EAAE,EAAE;YACvC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,eAAe,EAAE,EAAE,EAAE,wCAAwC;YAC7D,IAAI,EAAE,EAAE;YACR,oEAAoE;YACpE,0DAA0D;YAC1D,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;gBAClC,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,SAAS,EAAE,YAAY;oBACvB,SAAS,EAAE,MAAM;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,KAAK;iBACnB;aACF,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,SAAS,EAAE,EAAE,EAAE,yCAAyC;SACzD,CAAC;QAEF,4BAA4B;QAC5B,MAAM,WAAW,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,CAAC;oBACN,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE;iBACjD,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAElC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE;gBAC5B,MAAM;gBACN,OAAO;gBACP,QAAQ;gBACR,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO;gBACP,OAAO;aACR,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAElC,mBAAmB;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAEjC,yBAAyB;QACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM;SACP,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,GAAmB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,0BAA0B;YAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,GAAmB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,mEAAmE;IAE3D,iBAAiB,CAAC,KAAoB;QAC5C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,EAAE,EAAE,GAAG;YACP,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,WAAW,EAAE,GAAG,GAAG,kCAAkC;YACrD,UAAU,EAAE,CAAC,YAAY,CAAC;YAC1B,WAAW,EAAE,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YACzB,WAAW,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,mCAAmC;YACtE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,QAAQ,KAAK,CAAC,OAAO,EAAE;YAClD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO;YAC1C,YAAY,EAAE;gBACZ,SAAS,EAAE,KAAK,EAAE,4BAA4B;gBAC9C,iBAAiB,EAAE,KAAK;gBACxB,sBAAsB,EAAE,KAAK;aAC9B;YACD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACpC,EAAE,EAAE,cAAc;oBAClB,IAAI,EAAE,yBAAyB;oBAC/B,WAAW,EAAE,kEAAkE;oBAC/E,UAAU,EAAE,CAAC,YAAY,CAAC;oBAC1B,WAAW,EAAE,CAAC,YAAY,CAAC;iBAC5B,CAAC;YACF,UAAU,EAAE;gBACV,UAAU,EAAE;oBACV,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,aAAa;oBACzE,SAAS,EAAE,YAAY;iBACxB;aACF;SACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,GAAoB;QACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YAEb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,CAAC;oBACd,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CACtB,GAAmB,EACnB,EAA0B,EAC1B,IAAY,EACZ,OAAe,EACf,aAAqB,GAAG;QAExB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,mBAAmB,CAAC,OAAyB;QACnD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IAEO,mBAAmB,CAAC,OAAyB;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}

package/dist/threadline/relay/AbuseDetector.d.ts

@@ -0,0 +1,131 @@
+/**
+ * AbuseDetector — Pattern-based abuse detection for the relay.
+ *
+ * Monitors agent behavior for spam, enumeration, flooding, connection churn,
+ * and oversized payload attempts. Issues temporary bans by agent fingerprint.
+ *
+ * Bans are by agent ID (public key fingerprint), not IP — preventing ban
+ * evasion by IP rotation while avoiding collateral damage to shared IPs.
+ *
+ * Also implements Sybil resistance via progressive rate limiting for new agents.
+ *
+ * Part of Threadline Relay Phase 5.
+ */
+import type { AgentFingerprint } from './types.js';
+export interface AbuseDetectorConfig {
+    spamUniqueRecipientsPerMinute: number;
+    spamBanDurationMs: number;
+    floodingRateMultiplier: number;
+    floodingSustainedMinutes: number;
+    floodingBanDurationMs: number;
+    connectionChurnPerHour: number;
+    connectionChurnBanDurationMs: number;
+    oversizedPayloadWarnings: number;
+    oversizedPayloadBanDurationMs: number;
+    sybilFirstHourLimit: number;
+    sybilSecondHourLimit: number;
+    sybilGraduationMs: number;
+    normalRatePerMinute: number;
+}
+export interface BanInfo {
+    agentId: AgentFingerprint;
+    reason: string;
+    pattern: AbusePattern;
+    bannedAt: string;
+    expiresAt: string;
+    durationMs: number;
+}
+export type AbusePattern = 'spam' | 'enumeration' | 'flooding' | 'connection_churn' | 'oversized_payload';
+export interface AbuseEvent {
+    agentId: AgentFingerprint;
+    pattern: AbusePattern;
+    details: string;
+    timestamp: string;
+}
+export declare class AbuseDetector {
+    private readonly config;
+    private readonly nowFn;
+    /** Active bans by agent ID */
+    private readonly bans;
+    /** Track unique recipients per agent (for spam detection) */
+    private readonly recipientTracker;
+    /** Track message rate per agent per minute (for flooding detection) */
+    private readonly rateTracker;
+    /** Track connection events per agent (for churn detection) */
+    private readonly connectionTracker;
+    /** Track oversized payload warnings per agent */
+    private readonly oversizedWarnings;
+    /** Track when agents first connected (for Sybil resistance) */
+    private readonly firstSeen;
+    /** Track messages sent by new agents (for Sybil limits) */
+    private readonly sybilMessageCounts;
+    /** Event listeners for abuse events */
+    private readonly listeners;
+    /** Timer for periodic cleanup */
+    private cleanupTimer;
+    constructor(config?: Partial<AbuseDetectorConfig>, nowFn?: () => number);
+    /**
+     * Check if an agent is currently banned.
+     */
+    isBanned(agentId: AgentFingerprint): BanInfo | null;
+    /**
+     * Manually ban an agent (admin action).
+     */
+    ban(agentId: AgentFingerprint, reason: string, durationMs: number, pattern?: AbusePattern): BanInfo;
+    /**
+     * Manually unban an agent (admin action).
+     */
+    unban(agentId: AgentFingerprint): boolean;
+    /**
+     * Get all active bans.
+     */
+    getActiveBans(): BanInfo[];
+    /**
+     * Record a message send and check for spam/flooding patterns.
+     * Returns a ban if the agent should be banned, null otherwise.
+     */
+    recordMessage(agentId: AgentFingerprint, recipientId: AgentFingerprint): BanInfo | null;
+    /**
+     * Record a connection event and check for churn.
+     * Returns a ban if the agent should be banned, null otherwise.
+     */
+    recordConnection(agentId: AgentFingerprint): BanInfo | null;
+    /**
+     * Record an oversized payload attempt and check for abuse.
+     * Returns a ban if warnings exceeded, null otherwise.
+     */
+    recordOversizedPayload(agentId: AgentFingerprint): BanInfo | null;
+    /**
+     * Check if a new agent is within its progressive rate limits.
+     * Returns { allowed, remaining, reason } indicating whether the message is allowed.
+     */
+    checkSybilLimit(agentId: AgentFingerprint): {
+        allowed: boolean;
+        remaining: number;
+        reason?: string;
+    };
+    /**
+     * Register a listener for abuse events.
+     */
+    onAbuse(listener: (event: AbuseEvent) => void): void;
+    /**
+     * Get abuse detection statistics.
+     */
+    getStats(): {
+        activeBans: number;
+        trackedAgents: number;
+        newAgents: number;
+    };
+    /**
+     * Clean up expired bans and stale tracking data.
+     */
+    cleanup(): void;
+    /**
+     * Destroy the detector (clear timers).
+     */
+    destroy(): void;
+    private checkSpam;
+    private checkFlooding;
+    private emitEvent;
+}
+//# sourceMappingURL=AbuseDetector.d.ts.map

package/dist/threadline/relay/AbuseDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AbuseDetector.d.ts","sourceRoot":"","sources":["../../../src/threadline/relay/AbuseDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD,MAAM,WAAW,mBAAmB;IAElC,6BAA6B,EAAE,MAAM,CAAC;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAG1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAG9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,4BAA4B,EAAE,MAAM,CAAC;IAGrC,wBAAwB,EAAE,MAAM,CAAC;IACjC,6BAA6B,EAAE,MAAM,CAAC;IAGtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAG1B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,aAAa,GACb,UAAU,GACV,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AA2BD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IAErC,8BAA8B;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAE7D,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiF;IAElH,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;IAErE,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAyC;IAE3E,iDAAiD;IACjD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAuC;IAEzE,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IAEjE,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0E;IAE7G,uCAAuC;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IAEjE,iCAAiC;IACjC,OAAO,CAAC,YAAY,CAA+C;gBAEvD,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,MAAM;IAUvE;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,GAAG,IAAI;IAanD;;OAEG;IACH,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,YAAyB,GAAG,OAAO;IAc/G;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;IAIzC;;OAEG;IACH,aAAa,IAAI,OAAO,EAAE;IAe1B;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,GAAG,OAAO,GAAG,IAAI;IAcvF;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,GAAG,IAAI;IAoC3D;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,GAAG,IAAI;IAqBjE;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAqDpG;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,IAAI;IAMpD;;OAEG;IACH,QAAQ,IAAI;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACnB;IAkBD;;OAEG;IACH,OAAO,IAAI,IAAI;IAqCf;;OAEG;IACH,OAAO,IAAI,IAAI;IAgBf,OAAO,CAAC,SAAS;IA8BjB,OAAO,CAAC,aAAa;IAiCrB,OAAO,CAAC,SAAS;CAelB"}