@izagood/avcs 0.13.0 → 0.14.1

package/dist/hub/hubServer.js

@@ -17,8 +17,11 @@ import { computeOid } from "../core/canonical.js";
 import { silentLogger } from "../observe/logger.js";
 import { Metrics } from "../observe/metrics.js";
 import { MATERIALIZER_VERSION } from "../reducer/policy.js";
-/** Wire-protocol version the hub speaks (have/objects/refs gossip). Bumped on breaking changes. */
-export const HUB_PROTOCOL_VERSION = 1;
+import { NonceCache, verifyAuth } from "./transportAuth.js";
+/** Wire-protocol version the hub speaks (have/objects/refs gossip). Bumped on breaking
+ *  changes. v2 adds SSH-style transport auth: write endpoints may require an AVCS-Sig
+ *  Authorization header (read endpoints stay public). */
+export const HUB_PROTOCOL_VERSION = 2;
 const ROLE_WEIGHT = { reader: 0, proposer: 1, reviewer: 2, maintainer: 3, admin: 4 };
 function authRequirement(obj) {
     switch (obj.type) {
@@ -98,6 +101,21 @@ export async function startHub(opts) {
     const gated = opts.gated ?? false;
     const logger = opts.logger ?? silentLogger();
     const metrics = opts.metrics ?? new Metrics();
+    // Transport auth (read-public, write-auth). The default resolver treats the hub's own
+    // membership registry as its authorized_keys: a keyId is accepted iff member:<keyId> is a
+    // live (non-revoked) membership whose actorId matches, and the request signature verifies
+    // against that membership's publicKey — the same key the actor signs objects with.
+    const authRequired = opts.auth?.required ?? false;
+    const resolvePublicKey = opts.auth?.resolvePublicKey ?? (async (keyId) => {
+        const memRef = await store.getRef(`member:${keyId}`);
+        if (!memRef || !(await store.has(memRef)))
+            return null;
+        const m = await store.get(memRef);
+        if (m.revokedAt || m.actorId !== keyId)
+            return null;
+        return m.publicKey;
+    });
+    const authCtx = { required: authRequired, resolve: resolvePublicKey, windowMs: opts.auth?.windowMs, nonceCache: new NonceCache(opts.auth?.windowMs) };
     // E7 operability: per-actor push quota (a rolling-window counter) + an append-only
     // audit log of accepted mutations (provenance beyond the signed object itself).
     const rl = opts.rateLimit;
@@ -135,7 +153,7 @@ export async function startHub(opts) {
             metrics.inc(`hub.status.${Math.floor(res.statusCode / 100)}xx`);
             logger.info("hub.request", { method: req.method, path, status: res.statusCode, ms: Math.round(ms * 100) / 100 });
         });
-        handle(store, req, res, gated, metrics, opts.repoDir, ctx).catch((err) => {
+        handle(store, req, res, gated, metrics, opts.repoDir, ctx, authCtx).catch((err) => {
             // Last-resort guard: never let a handler rejection crash the server.
             metrics.inc("hub.errors");
             logger.error("hub.error", { method: req.method, path, error: String(err?.message ?? err) });
@@ -179,13 +197,38 @@ async function verifyFinalizeSig(store, by, view, newCheckpoint, parentHead, sig
         return false;
     return verifyMessage(m.publicKey, `finalize:${view}:${newCheckpoint}:${parentHead ?? ""}`, s.sig);
 }
+/**
+ * Enforce transport auth on a write request. No-op (returns true) when auth is not
+ * required — a read-public/ungated hub still accepts unsigned writes, leaving object-level
+ * `authorizePush` as the only gate. When required, verifies the AVCS-Sig header over the
+ * exact raw body and sends a 401 on failure. A 401 here ("who are you") is deliberately
+ * distinct from the 403 `authorizePush` returns ("you may not push THIS object").
+ */
+async function enforceTransportAuth(auth, req, res, method, path, rawBody, metrics) {
+    if (!auth.required)
+        return true;
+    const result = await verifyAuth({
+        header: req.headers["authorization"],
+        method, path, body: rawBody,
+        resolvePublicKey: auth.resolve,
+        now: Date.now(),
+        windowMs: auth.windowMs,
+        nonceCache: auth.nonceCache,
+    });
+    if (!result.ok) {
+        metrics.inc("hub.unauthenticated");
+        sendJson(res, 401, { error: result.reason });
+        return false;
+    }
+    return true;
+}
 /** The actor a push is attributed to (for the audit log + quota): the object's signer
  *  field when there is one, else null (the caller falls back to the remote address). */
 function attributedActor(obj) {
     const req = authRequirement(obj);
     return typeof req === "object" ? req.signerId : null;
 }
-async function handle(store, req, res, gated, metrics, repoDir, ops) {
+async function handle(store, req, res, gated, metrics, repoDir, ops, auth) {
     // Parse path only (ignore query); the host is irrelevant for routing.
     const url = new URL(req.url ?? "/", "http://localhost");
     const path = url.pathname;
@@ -198,7 +241,9 @@ async function handle(store, req, res, gated, metrics, repoDir, ops) {
     // GET /version → identify the hub and the gossip protocol/materializer it speaks, so a
     // client can refuse to sync against an incompatible peer.
     if (method === "GET" && path === "/version") {
-        sendJson(res, 200, { name: "avcs-hub", protocol: HUB_PROTOCOL_VERSION, materializer: MATERIALIZER_VERSION, gated });
+        // `auth` advertises that writes require an AVCS-Sig credential so a client can attach
+        // one up front (and an old client gets a clear 401 instead of a silent rejection).
+        sendJson(res, 200, { name: "avcs-hub", protocol: HUB_PROTOCOL_VERSION, materializer: MATERIALIZER_VERSION, gated, auth: auth.required ? "required" : "none" });
         return;
     }
     // GET /metrics → in-process counters/timings snapshot (request counts, status classes,
@@ -259,6 +304,11 @@ async function handle(store, req, res, gated, metrics, repoDir, ops) {
             sendJson(res, 413, { error: String(err.message) });
             return;
         }
+        // Transport auth (SSH-style): on a write-auth hub the request must be signed by a
+        // registered member before we do any work. Verified over the raw body so a captured
+        // header can't be replayed against different content.
+        if (!(await enforceTransportAuth(auth, req, res, "POST", "/objects", raw, metrics)))
+            return;
         let obj;
         try {
             obj = JSON.parse(raw);
@@ -324,6 +374,8 @@ async function handle(store, req, res, gated, metrics, repoDir, ops) {
             sendJson(res, 413, { error: String(err.message) });
             return;
         }
+        if (!(await enforceTransportAuth(auth, req, res, "POST", "/finalize", raw, metrics)))
+            return;
         let body;
         try {
             body = JSON.parse(raw);

package/dist/hub/hubServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"hubServer.js","sourceRoot":"","sources":["../../src/hub/hubServer.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,kFAAkF;AAClF,+EAA+E;AAC/E,EAAE;AACF,iFAAiF;AACjF,iEAAiE;AACjE,gFAAgF;AAChF,EAAE;AACF,4DAA4D;AAE5D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAe,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAM5D,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAStC,MAAM,WAAW,GAA6B,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAe/G,SAAS,eAAe,CAAC,GAAc;IACrC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACxF,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC3F,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC1F,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAChF,KAAK,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAClF,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC7E,KAAK,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/E,KAAK,YAAY,CAAC;QAAC,KAAK,YAAY,CAAC;QAAC,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QACrE,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,KAAkB,EAAE,GAAc;IAC7D,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,2DAA2D,EAAE,CAAC;IAC3H,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,QAAQ,kBAAkB,EAAE,CAAC;IAClH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAa,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAChH,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;IACjI,MAAM,GAAG,GAAI,GAA2B,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAyC,CAAC,CAAC;IAC5E,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IAC9H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gDAAgD;AAEnF,oFAAoF;AACpF,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAI9B;IACC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,kCAAkC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,OAAO,EAAE,CAAC;IAE9C,mFAAmF;IACnF,gFAAgF;IAChF,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC1B,MAAM,QAAQ,GAAG,EAAE,EAAE,QAAQ,IAAI,MAAM,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAW,EAAE;QACrC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,EAAE,GAA4B,EAAiB,EAAE;QAClE,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChH,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACvF,CAAC,CAAC;IACF,MAAM,GAAG,GAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAErC,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC;YAC7D,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACnH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACvE,qEAAqE;YACrE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;;gBAC5E,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAEvC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,OAAO;QACP,KAAK;YACH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;kDAEkD;AAClD,KAAK,UAAU,iBAAiB,CAAC,KAAkB,EAAE,EAAU,EAAE,IAAY,EAAE,aAAqB,EAAE,UAAyB,EAAE,GAAY;IAC3I,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAa,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,IAAI,IAAI,aAAa,IAAI,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC;AAQD;wFACwF;AACxF,SAAS,eAAe,CAAC,GAAc;IACrC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,KAAkB,EAAE,GAAoB,EAAE,GAAmB,EAAE,KAAc,EAAE,OAAgB,EAAE,OAAe,EAAE,GAAW;IACjJ,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,uFAAuF;IACvF,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,uFAAuF;IACvF,0DAA0D;IAC1D,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;QACpH,OAAO;IACT,CAAC;IAED,uFAAuF;IACvF,sFAAsF;IACtF,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,gFAAgF;IAChF,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IAED,sFAAsF;IACtF,yFAAyF;IACzF,wFAAwF;IACxF,uFAAuF;IACvF,sFAAsF;IACtF,sDAAsD;IACtD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,uDAAuD;IACvD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,gFAAgF;QAChF,MAAM,KAAK,GAAG,eAAe,CAAC,GAAgB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,EAAE,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC/B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,kFAAkF;QAClF,gFAAgF;QAChF,mCAAmC;QACnC,MAAM,WAAW,GAAI,GAAiB,CAAC,IAAI,KAAK,WAAW,CAAC;QAC5D,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAgB,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;QACH,CAAC;QACD,kFAAkF;QAClF,sFAAsF;QACtF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAgB,CAAC,CAAC;QAC9C,mFAAmF;QACnF,8EAA8E;QAC9E,mFAAmF;QACnF,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBAC5C,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;gBACxE,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAG,GAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB;QAC/F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,sFAAsF;IACtF,qFAAqF;IACrF,uFAAuF;IACvF,mFAAmF;IACnF,gFAAgF;IAChF,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACzH,IAAI,IAAoG,CAAC;QACzG,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChG,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChI,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK;QAC1J,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7D,mFAAmF;QACnF,iEAAiE;QACjE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"hubServer.js","sourceRoot":"","sources":["../../src/hub/hubServer.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,kFAAkF;AAClF,+EAA+E;AAC/E,EAAE;AACF,iFAAiF;AACjF,iEAAiE;AACjE,gFAAgF;AAChF,EAAE;AACF,4DAA4D;AAE5D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAe,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAA0B,MAAM,oBAAoB,CAAC;AAMpF;;yDAEyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAStC,MAAM,WAAW,GAA6B,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAe/G,SAAS,eAAe,CAAC,GAAc;IACrC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACxF,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC3F,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC1F,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAChF,KAAK,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAClF,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAgB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC7E,KAAK,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAG,GAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/E,KAAK,YAAY,CAAC;QAAC,KAAK,YAAY,CAAC;QAAC,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QACrE,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,KAAkB,EAAE,GAAc;IAC7D,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,2DAA2D,EAAE,CAAC;IAC3H,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,QAAQ,kBAAkB,EAAE,CAAC;IAClH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAa,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAChH,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;IACjI,MAAM,GAAG,GAAI,GAA2B,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAyC,CAAC,CAAC;IAC5E,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IAC9H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gDAAgD;AAEnF,oFAAoF;AACpF,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAU9B;IACC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,kCAAkC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,OAAO,EAAE,CAAC;IAE9C,sFAAsF;IACtF,0FAA0F;IAC1F,0FAA0F;IAC1F,mFAAmF;IACnF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC;IAClD,MAAM,gBAAgB,GAAsB,IAAI,CAAC,IAAI,EAAE,gBAAgB,IAAI,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;QAClG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAa,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO,CAAC,CAAC,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;IAE/J,mFAAmF;IACnF,gFAAgF;IAChF,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC1B,MAAM,QAAQ,GAAG,EAAE,EAAE,QAAQ,IAAI,MAAM,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAW,EAAE;QACrC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,EAAE,GAA4B,EAAiB,EAAE;QAClE,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChH,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACvF,CAAC,CAAC;IACF,MAAM,GAAG,GAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAErC,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC;YAC7D,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACnH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChF,qEAAqE;YACrE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;;gBAC5E,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAEvC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,OAAO;QACP,KAAK;YACH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;kDAEkD;AAClD,KAAK,UAAU,iBAAiB,CAAC,KAAkB,EAAE,EAAU,EAAE,IAAY,EAAE,aAAqB,EAAE,UAAyB,EAAE,GAAY;IAC3I,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAa,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,IAAI,IAAI,aAAa,IAAI,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC;AAgBD;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CAAC,IAAa,EAAE,GAAoB,EAAE,GAAmB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAgB;IAC3J,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;QACpC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;QAC3B,gBAAgB,EAAE,IAAI,CAAC,OAAO;QAC9B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;wFACwF;AACxF,SAAS,eAAe,CAAC,GAAc;IACrC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,KAAkB,EAAE,GAAoB,EAAE,GAAmB,EAAE,KAAc,EAAE,OAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,IAAa;IAChK,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,uFAAuF;IACvF,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,uFAAuF;IACvF,0DAA0D;IAC1D,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,sFAAsF;QACtF,mFAAmF;QACnF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/J,OAAO;IACT,CAAC;IAED,uFAAuF;IACvF,sFAAsF;IACtF,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,gFAAgF;IAChF,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IAED,sFAAsF;IACtF,yFAAyF;IACzF,wFAAwF;IACxF,uFAAuF;IACvF,sFAAsF;IACtF,sDAAsD;IACtD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,uDAAuD;IACvD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,kFAAkF;QAClF,oFAAoF;QACpF,sDAAsD;QACtD,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAAE,OAAO;QAC5F,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,gFAAgF;QAChF,MAAM,KAAK,GAAG,eAAe,CAAC,GAAgB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,EAAE,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC/B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,kFAAkF;QAClF,gFAAgF;QAChF,mCAAmC;QACnC,MAAM,WAAW,GAAI,GAAiB,CAAC,IAAI,KAAK,WAAW,CAAC;QAC5D,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAgB,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;QACH,CAAC;QACD,kFAAkF;QAClF,sFAAsF;QACtF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAgB,CAAC,CAAC;QAC9C,mFAAmF;QACnF,8EAA8E;QAC9E,mFAAmF;QACnF,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBAC5C,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;gBACxE,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAG,GAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB;QAC/F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,sFAAsF;IACtF,qFAAqF;IACrF,uFAAuF;IACvF,mFAAmF;IACnF,gFAAgF;IAChF,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACzH,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAAE,OAAO;QAC7F,IAAI,IAAoG,CAAC;QACzG,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChG,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChI,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK;QAC1J,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7D,mFAAmF;QACnF,iEAAiE;QACjE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/hub/transportAuth.d.ts

@@ -0,0 +1,73 @@
+/** Authorization scheme token. `Authorization: AVCS-Sig keyId="...", ts="...", ...`. */
+export declare const AUTH_SCHEME = "AVCS-Sig";
+/** Default freshness window for a request signature (ms). A request whose `ts` is more
+ *  than this far from the server clock (either direction) is rejected as stale/replayed. */
+export declare const DEFAULT_AUTH_WINDOW_MS = 300000;
+/** The parsed fields of an AVCS-Sig Authorization header. */
+export interface AuthCredential {
+    keyId: string;
+    ts: string;
+    nonce: string;
+    sig: string;
+}
+/**
+ * The exact byte string both sides sign/verify. Binds the signature to the method, the
+ * request target, a timestamp (freshness) and a nonce (replay), plus a hash of the body
+ * so a captured signature cannot be replayed against different content.
+ */
+export declare function canonicalRequest(method: string, path: string, ts: string, nonce: string, body: string): string;
+/** Build an `Authorization: AVCS-Sig …` header value, signing the request with the local
+ *  actor's private key. `body` is the exact request body the client will send (""for none). */
+export declare function buildAuthHeader(args: {
+    keyId: string;
+    privateKey: string;
+    method: string;
+    path: string;
+    body?: string;
+    ts?: string;
+    nonce?: string;
+}): string;
+/** Parse an AVCS-Sig Authorization header. Returns null on any scheme/field mismatch. */
+export declare function parseAuthHeader(header: string | undefined | null): AuthCredential | null;
+/**
+ * A bounded seen-nonce cache for replay protection. Entries expire after `ttlMs` (the
+ * freshness window — a nonce can only be replayed within it anyway) and the map is
+ * capped so a hostile client cannot grow it without bound.
+ */
+export declare class NonceCache {
+    #private;
+    constructor(ttlMs?: number, max?: number);
+    /** Record a nonce; returns false if it was already seen (a replay). */
+    check(nonce: string, now: number): boolean;
+}
+/** Resolve a keyId to its registered public key (PEM), or null if unknown. This is the
+ *  pluggable hook (D3): the default server resolver reads `member:<keyId>`; an embedder
+ *  (e.g. a hosted hub) injects its own user-DB lookup. */
+export type PublicKeyResolver = (keyId: string) => Promise<string | null>;
+export type AuthResult = {
+    ok: true;
+    keyId: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify a request's AVCS-Sig credential. Steps, in order:
+ *  1. parse the header,
+ *  2. reject a stale/future timestamp (outside the freshness window),
+ *  3. reject a replayed nonce,
+ *  4. resolve the keyId to a public key (unknown key → unauthenticated),
+ *  5. verify the signature over the canonical request.
+ * Any failure returns `{ ok: false, reason }` for a 401 body. Success returns the keyId.
+ */
+export declare function verifyAuth(args: {
+    header: string | undefined | null;
+    method: string;
+    path: string;
+    body: string;
+    resolvePublicKey: PublicKeyResolver;
+    now: number;
+    windowMs?: number;
+    nonceCache?: NonceCache;
+}): Promise<AuthResult>;
+//# sourceMappingURL=transportAuth.d.ts.map

package/dist/hub/transportAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportAuth.d.ts","sourceRoot":"","sources":["../../src/hub/transportAuth.ts"],"names":[],"mappings":"AAsBA,wFAAwF;AACxF,eAAO,MAAM,WAAW,aAAa,CAAC;AAEtC;4FAC4F;AAC5F,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAE9C,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9G;AAED;+FAC+F;AAC/F,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAKT;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,cAAc,GAAG,IAAI,CAaxF;AAED;;;;GAIG;AACH,qBAAa,UAAU;;gBAKT,KAAK,GAAE,MAA+B,EAAE,GAAG,SAAU;IAKjE,uEAAuE;IACvE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;CAkB3C;AAED;;0DAE0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE1E,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB"}

package/dist/hub/transportAuth.js

@@ -0,0 +1,127 @@
+// Transport-layer authentication for hub requests (SSH-style public-key auth over HTTP).
+//
+// Unlike `authorizePush` in hubServer.ts — which authenticates individual GOVERNANCE
+// OBJECTS (an operation/decision carries an ed25519 signature over its own oid) — this
+// authenticates the REQUEST/CONNECTION, the way `git clone git@host` proves possession
+// of a key before the server speaks. The model mirrors SSH exactly:
+//
+//   ~/.ssh/id_ed25519        →  the local actor's private key (.avcs/private/<id>.json)
+//   authorized_keys          →  the hub's `member:<keyId>` ref → Membership.publicKey
+//   challenge-response nonce →  a per-request signature over the request itself
+//
+// No secret is transmitted: the client signs a canonical description of the request with
+// its private key, the server verifies against the registered public key. Replay is
+// bounded by a freshness window on the timestamp plus a seen-nonce cache. The two layers
+// are orthogonal and share one keypair: transport auth answers "are you a registered
+// member at all" (failure → 401); object-level `authorizePush` answers "is THIS object
+// validly signed by a sufficiently-privileged role" (failure → 403).
+import { randomBytes } from "node:crypto";
+import { sha256hex } from "../core/canonical.js";
+import { signMessage, verifyMessage } from "../core/identity.js";
+/** Authorization scheme token. `Authorization: AVCS-Sig keyId="...", ts="...", ...`. */
+export const AUTH_SCHEME = "AVCS-Sig";
+/** Default freshness window for a request signature (ms). A request whose `ts` is more
+ *  than this far from the server clock (either direction) is rejected as stale/replayed. */
+export const DEFAULT_AUTH_WINDOW_MS = 300_000; // 5 minutes
+/**
+ * The exact byte string both sides sign/verify. Binds the signature to the method, the
+ * request target, a timestamp (freshness) and a nonce (replay), plus a hash of the body
+ * so a captured signature cannot be replayed against different content.
+ */
+export function canonicalRequest(method, path, ts, nonce, body) {
+    return `${method.toUpperCase()}\n${path}\n${ts}\n${nonce}\n${sha256hex(body)}`;
+}
+/** Build an `Authorization: AVCS-Sig …` header value, signing the request with the local
+ *  actor's private key. `body` is the exact request body the client will send (""for none). */
+export function buildAuthHeader(args) {
+    const ts = args.ts ?? new Date().toISOString();
+    const nonce = args.nonce ?? randomBytes(12).toString("base64url");
+    const sig = signMessage(args.privateKey, canonicalRequest(args.method, args.path, ts, nonce, args.body ?? ""));
+    return `${AUTH_SCHEME} keyId="${args.keyId}", ts="${ts}", nonce="${nonce}", sig="${sig}"`;
+}
+/** Parse an AVCS-Sig Authorization header. Returns null on any scheme/field mismatch. */
+export function parseAuthHeader(header) {
+    if (!header)
+        return null;
+    const trimmed = header.trim();
+    if (!trimmed.startsWith(`${AUTH_SCHEME} `))
+        return null;
+    const rest = trimmed.slice(AUTH_SCHEME.length + 1);
+    const fields = {};
+    // key="value" pairs, comma-separated. Values may contain base64url (no quotes/commas).
+    const re = /(\w+)="([^"]*)"/g;
+    let m;
+    while ((m = re.exec(rest)) !== null)
+        fields[m[1]] = m[2];
+    const { keyId, ts, nonce, sig } = fields;
+    if (!keyId || !ts || !nonce || !sig)
+        return null;
+    return { keyId, ts, nonce, sig };
+}
+/**
+ * A bounded seen-nonce cache for replay protection. Entries expire after `ttlMs` (the
+ * freshness window — a nonce can only be replayed within it anyway) and the map is
+ * capped so a hostile client cannot grow it without bound.
+ */
+export class NonceCache {
+    #seen = new Map(); // nonce → expiry epoch ms
+    #ttlMs;
+    #max;
+    constructor(ttlMs = DEFAULT_AUTH_WINDOW_MS, max = 100_000) {
+        this.#ttlMs = ttlMs;
+        this.#max = max;
+    }
+    /** Record a nonce; returns false if it was already seen (a replay). */
+    check(nonce, now) {
+        this.#evict(now);
+        if (this.#seen.has(nonce))
+            return false;
+        if (this.#seen.size >= this.#max) {
+            // Hard cap reached even after eviction: drop the oldest insertion to stay bounded.
+            const oldest = this.#seen.keys().next().value;
+            if (oldest !== undefined)
+                this.#seen.delete(oldest);
+        }
+        this.#seen.set(nonce, now + this.#ttlMs);
+        return true;
+    }
+    #evict(now) {
+        for (const [n, exp] of this.#seen) {
+            if (exp <= now)
+                this.#seen.delete(n);
+            else
+                break; // Map preserves insertion order; later entries expire no earlier... see note
+        }
+    }
+}
+/**
+ * Verify a request's AVCS-Sig credential. Steps, in order:
+ *  1. parse the header,
+ *  2. reject a stale/future timestamp (outside the freshness window),
+ *  3. reject a replayed nonce,
+ *  4. resolve the keyId to a public key (unknown key → unauthenticated),
+ *  5. verify the signature over the canonical request.
+ * Any failure returns `{ ok: false, reason }` for a 401 body. Success returns the keyId.
+ */
+export async function verifyAuth(args) {
+    const cred = parseAuthHeader(args.header);
+    if (!cred)
+        return { ok: false, reason: "missing or malformed AVCS-Sig Authorization header" };
+    const window = args.windowMs ?? DEFAULT_AUTH_WINDOW_MS;
+    const tsMs = Date.parse(cred.ts);
+    if (!Number.isFinite(tsMs))
+        return { ok: false, reason: "invalid timestamp" };
+    if (Math.abs(args.now - tsMs) > window)
+        return { ok: false, reason: "request timestamp outside freshness window" };
+    if (args.nonceCache && !args.nonceCache.check(cred.nonce, args.now)) {
+        return { ok: false, reason: "nonce already used (replay)" };
+    }
+    const publicKey = await args.resolvePublicKey(cred.keyId);
+    if (!publicKey)
+        return { ok: false, reason: `unknown signing key ${cred.keyId}` };
+    const msg = canonicalRequest(args.method, args.path, cred.ts, cred.nonce, args.body);
+    if (!verifyMessage(publicKey, msg, cred.sig))
+        return { ok: false, reason: "request signature does not verify" };
+    return { ok: true, keyId: cred.keyId };
+}
+//# sourceMappingURL=transportAuth.js.map

package/dist/hub/transportAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportAuth.js","sourceRoot":"","sources":["../../src/hub/transportAuth.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,uFAAuF;AACvF,oEAAoE;AACpE,EAAE;AACF,wFAAwF;AACxF,sFAAsF;AACtF,gFAAgF;AAChF,EAAE;AACF,yFAAyF;AACzF,oFAAoF;AACpF,yFAAyF;AACzF,qFAAqF;AACrF,uFAAuF;AACvF,qEAAqE;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEjE,wFAAwF;AACxF,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAEtC;4FAC4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,CAAC,YAAY;AAU3D;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY,EAAE,EAAU,EAAE,KAAa,EAAE,IAAY;IACpG,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,EAAE,KAAK,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,eAAe,CAAC,IAQ/B;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/G,OAAO,GAAG,WAAW,WAAW,IAAI,CAAC,KAAK,UAAU,EAAE,aAAa,KAAK,WAAW,GAAG,GAAG,CAAC;AAC5F,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,MAAiC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,uFAAuF;IACvF,MAAM,EAAE,GAAG,kBAAkB,CAAC;IAC9B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC3D,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAU;IACrB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,0BAA0B;IAC7D,MAAM,CAAS;IACf,IAAI,CAAS;IAEb,YAAY,QAAgB,sBAAsB,EAAE,GAAG,GAAG,OAAO;QAC/D,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,KAAa,EAAE,GAAW;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,mFAAmF;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;gBAChC,MAAM,CAAC,6EAA6E;QAC3F,CAAC;IACH,CAAC;CACF;AASD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAShC;IACC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IAE9F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAEnH,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAElF,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAEhH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC"}

package/dist/index.d.ts

@@ -8,6 +8,9 @@ export type { FsckReport } from "./store/objectStore.ts";
 export { startHub, HUB_PROTOCOL_VERSION } from "./hub/hubServer.ts";
 export type { HubHandle } from "./hub/hubServer.ts";
 export { pushToHub, pullFromHub, finalizeOnHub } from "./hub/hubClient.ts";
+export type { HubSigner } from "./hub/hubClient.ts";
+export { buildAuthHeader, parseAuthHeader, verifyAuth, canonicalRequest, NonceCache, AUTH_SCHEME, DEFAULT_AUTH_WINDOW_MS } from "./hub/transportAuth.ts";
+export type { AuthCredential, AuthResult, PublicKeyResolver } from "./hub/transportAuth.ts";
 export { Keyring, generateKeypair, signMessage, verifyMessage } from "./core/identity.ts";
 export type { Keypair, KeyRecord, Signature } from "./core/identity.ts";
 export { Logger, consoleLogger, silentLogger } from "./observe/logger.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG1E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC7H,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKjH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGtF,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACzE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG1E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC7H,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKjH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGtF,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACzE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACzJ,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG5F,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -23,6 +23,9 @@ export { ObjectStore, CorruptObjectError } from "./store/objectStore.js";
 // Hub (server + client) — the replication / trust boundary avcshub productionizes
 export { startHub, HUB_PROTOCOL_VERSION } from "./hub/hubServer.js";
 export { pushToHub, pullFromHub, finalizeOnHub } from "./hub/hubClient.js";
+// SSH-style transport auth: embedders (e.g. a hosted hub) inject `resolvePublicKey` into
+// startHub({ auth }); these helpers also let a client build/verify the credential directly.
+export { buildAuthHeader, parseAuthHeader, verifyAuth, canonicalRequest, NonceCache, AUTH_SCHEME, DEFAULT_AUTH_WINDOW_MS } from "./hub/transportAuth.js";
 // Cryptographic actor identity (the app-layer authz backbone)
 export { Keyring, generateKeypair, signMessage, verifyMessage } from "./core/identity.js";
 // Observability seams (avcshub wires these to OTel / a real collector)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,mFAAmF;AACnF,yFAAyF;AACzF,wFAAwF;AACxF,iFAAiF;AAEjF,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,mFAAmF;AACnF,uFAAuF;AACvF,sFAAsF;AACtF,wFAAwF;AACxF,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1E,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG7H,iFAAiF;AACjF,qFAAqF;AACrF,yDAAyD;AACzD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEtF,6BAA6B;AAC7B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGzE,kFAAkF;AAClF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE3E,8DAA8D;AAC9D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG1F,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,mFAAmF;AACnF,yFAAyF;AACzF,wFAAwF;AACxF,iFAAiF;AAEjF,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,mFAAmF;AACnF,uFAAuF;AACvF,sFAAsF;AACtF,wFAAwF;AACxF,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1E,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG7H,iFAAiF;AACjF,qFAAqF;AACrF,yDAAyD;AACzD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEtF,6BAA6B;AAC7B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGzE,kFAAkF;AAClF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE3E,yFAAyF;AACzF,4FAA4F;AAC5F,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGzJ,8DAA8D;AAC9D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG1F,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izagood/avcs",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "type": "module",
   "description": "Agentic Version Control System — an AI-native VCS where intent, session, operation, evidence and decision are first-class objects and code is a materialized projection of an operation graph.",
   "license": "Apache-2.0",