@onsignet/daemon 0.1.0

package/dist/index.js

@@ -0,0 +1,524 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Signet daemon: identity, relay client, HTTP API, audit log, pending approvals,
+ * policies, webhook, attestation/capability verification, key revocation.
+ */
+const node_http_1 = require("node:http");
+const node_path_1 = require("node:path");
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const core_1 = require("@onsignet/core");
+const config_js_1 = require("./config.js");
+const identity_js_1 = require("./identity.js");
+const relay_client_js_1 = require("./relay-client.js");
+const server_js_1 = require("./server.js");
+const audit_log_js_1 = require("./audit-log.js");
+const agent_process_js_1 = require("./agent-process.js");
+const policies_js_1 = require("./policies.js");
+const REVOKED_KEYS_FILE = "revoked-keys.json";
+function notifyWebhook(url, secret, payload) {
+    const body = JSON.stringify(payload);
+    const signature = secret
+        ? (0, node_crypto_1.createHmac)("sha256", secret).update(body).digest("base64")
+        : "";
+    const headers = { "Content-Type": "application/json" };
+    if (signature)
+        headers["X-Signet-Signature"] = signature;
+    fetch(url, { method: "POST", body, headers }).catch(() => { });
+}
+function loadRevokedKeys(dataDir) {
+    const path = (0, node_path_1.join)(dataDir, REVOKED_KEYS_FILE);
+    try {
+        if ((0, node_fs_1.existsSync)(path)) {
+            const data = JSON.parse((0, node_fs_1.readFileSync)(path, "utf8"));
+            return new Set(data);
+        }
+    }
+    catch { /* ignore */ }
+    return new Set();
+}
+function saveRevokedKeys(dataDir, keys) {
+    const path = (0, node_path_1.join)(dataDir, REVOKED_KEYS_FILE);
+    try {
+        (0, node_fs_1.writeFileSync)(path, JSON.stringify(Array.from(keys)));
+    }
+    catch { /* ignore */ }
+}
+async function main() {
+    const config = (0, config_js_1.loadConfig)();
+    (0, identity_js_1.ensureDataDir)(config.dataDir);
+    const identity = (0, identity_js_1.loadOrCreateIdentity)(config.dataDir);
+    const owner = (0, identity_js_1.loadOrCreateOwner)(config.dataDir);
+    const attestation = (0, identity_js_1.createOwnerAttestation)(identity.nodeId, owner.ed25519.secretKey);
+    const capability = (0, core_1.createCapabilityToken)("general", {}, owner.ed25519.secretKey);
+    const ownerPublicKeyBase64 = (0, core_1.encodeBase64)(owner.ed25519.publicKey);
+    const auditLog = new audit_log_js_1.AuditLog(config.dataDir);
+    const messages = [];
+    const pending = new Map();
+    const MAX_MESSAGES = 500;
+    const revokedKeys = loadRevokedKeys(config.dataDir);
+    // ── accepts_from inbound tier filter ──────────────────────────────────
+    // Cached preferences so we don't hit the directory API on every message.
+    const PREFS_CACHE_TTL_MS = 60_000;
+    const TIER_CACHE_TTL_MS = 300_000; // sender tiers change rarely
+    let cachedAcceptsFrom = null;
+    let prefsLastFetched = 0;
+    const senderTierCache = new Map();
+    async function getOwnAcceptsFrom() {
+        const now = Date.now();
+        if (cachedAcceptsFrom !== null && now - prefsLastFetched < PREFS_CACHE_TTL_MS) {
+            return cachedAcceptsFrom;
+        }
+        const dirBase = config.directoryApiUrl ?? config.marketplaceApiUrl;
+        if (!dirBase)
+            return "all";
+        try {
+            const res = await fetch(`${dirBase.replace(/\/$/, "")}/agents/${encodeURIComponent(identity.nodeId)}`, { signal: AbortSignal.timeout(5000) });
+            if (!res.ok)
+                return cachedAcceptsFrom ?? "all";
+            const data = (await res.json());
+            cachedAcceptsFrom = data.communication_preferences?.accepts_from ?? "all";
+            prefsLastFetched = now;
+            return cachedAcceptsFrom;
+        }
+        catch {
+            return cachedAcceptsFrom ?? "all";
+        }
+    }
+    async function getSenderTier(senderNodeId) {
+        const now = Date.now();
+        const cached = senderTierCache.get(senderNodeId);
+        if (cached && now - cached.fetchedAt < TIER_CACHE_TTL_MS)
+            return cached.tier;
+        const dirBase = config.directoryApiUrl ?? config.marketplaceApiUrl;
+        if (!dirBase)
+            return "free";
+        try {
+            const res = await fetch(`${dirBase.replace(/\/$/, "")}/agents/${encodeURIComponent(senderNodeId)}`, { signal: AbortSignal.timeout(5000) });
+            if (!res.ok)
+                return cached?.tier ?? "free";
+            const data = (await res.json());
+            const tier = data.owner_verification_tier ?? "free";
+            senderTierCache.set(senderNodeId, { tier, fetchedAt: now });
+            return tier;
+        }
+        catch {
+            return cached?.tier ?? "free";
+        }
+    }
+    /**
+     * Returns true if the sender's tier satisfies the recipient's accepts_from policy.
+     * Tier hierarchy: business > pro > verified > free
+     */
+    function tierSatisfiesPolicy(senderTier, acceptsFrom) {
+        if (acceptsFrom === "all")
+            return true;
+        if (acceptsFrom === "verified") {
+            return senderTier === "pro" || senderTier === "business";
+        }
+        if (acceptsFrom === "signet_pro") {
+            return senderTier === "pro" || senderTier === "business";
+        }
+        if (acceptsFrom === "signet_business") {
+            return senderTier === "business";
+        }
+        return true;
+    }
+    function getPolicies() {
+        return (0, policies_js_1.loadPolicies)(config.dataDir);
+    }
+    function setPolicies(rules) {
+        (0, policies_js_1.savePolicies)(config.dataDir, rules);
+        auditLog.append({ timestamp: new Date().toISOString(), event: "policy_change" });
+    }
+    function deliverMessage(decrypted) {
+        if (messages.length >= MAX_MESSAGES)
+            messages.shift();
+        messages.push(decrypted);
+        auditLog.append({
+            timestamp: new Date().toISOString(),
+            event: "message_received",
+            messageId: decrypted.id,
+            from: decrypted.from.nodeId,
+            to: identity.nodeId,
+        });
+        if (config.openclawWebhookUrl) {
+            const summary = typeof decrypted.payload.content?.summary === "string"
+                ? decrypted.payload.content.summary
+                : undefined;
+            const payload = {
+                messageId: decrypted.id,
+                from: decrypted.from.nodeId,
+                to: decrypted.to,
+                payloadType: decrypted.payload.type,
+                timestamp: decrypted.timestamp,
+            };
+            if (summary !== undefined)
+                payload.summary = summary;
+            notifyWebhook(config.openclawWebhookUrl, config.openclawWebhookSecret, payload);
+        }
+    }
+    function buildAndSend(to, payload, recipientX25519PublicKeyBase64) {
+        if (!relayClient.isConnected())
+            return null;
+        let recipientX25519;
+        try {
+            recipientX25519 = (0, core_1.decodeBase64)(recipientX25519PublicKeyBase64);
+            if (recipientX25519.length !== 32)
+                return null;
+        }
+        catch {
+            return null;
+        }
+        const wire = (0, core_1.createEnvelope)(identity.ed25519, identity.x25519, to, { type: payload.type, version: "1.0", content: payload.content }, capability, {
+            recipientX25519PublicKey: recipientX25519,
+            ownerAttestation: attestation,
+            ownerPublicKey: ownerPublicKeyBase64,
+        });
+        const ok = relayClient.send(wire);
+        if (!ok)
+            return null;
+        auditLog.append({
+            timestamp: new Date().toISOString(),
+            event: "message_sent",
+            messageId: wire.id,
+            from: identity.nodeId,
+            to,
+        });
+        return wire;
+    }
+    const webChatIncoming = [];
+    const MAX_WEB_CHAT_INCOMING = 100;
+    const relayClient = new relay_client_js_1.RelayClient({
+        relayUrl: config.relayUrl,
+        nodeId: identity.nodeId,
+        ed25519KeyPair: identity.ed25519,
+        onWebChatMessage: (payload) => {
+            if (webChatIncoming.length >= MAX_WEB_CHAT_INCOMING)
+                webChatIncoming.shift();
+            webChatIncoming.push({
+                sessionId: payload.sessionId,
+                visitorAuthLevel: payload.visitorAuthLevel,
+                content: payload.content,
+                receivedAt: new Date().toISOString(),
+            });
+            auditLog.append({
+                timestamp: new Date().toISOString(),
+                event: "message_received",
+                from: "signet_web_chat",
+                to: identity.nodeId,
+            });
+        },
+        onKeyRevocation: (revocation) => {
+            if ((0, core_1.verifyKeyRevocation)(revocation)) {
+                revokedKeys.add(revocation.revokedNodeId);
+                saveRevokedKeys(config.dataDir, revokedKeys);
+                auditLog.append({
+                    timestamp: new Date().toISOString(),
+                    event: "key_revoked",
+                    from: revocation.revokedNodeId,
+                });
+                console.log(`[daemon] Received key revocation for ${revocation.revokedNodeId.slice(0, 20)}… reason=${revocation.reason}`);
+                if (revocation.revokedNodeId === identity.nodeId) {
+                    console.error("[daemon] THIS NODE'S KEY HAS BEEN REVOKED. Shutting down.");
+                    process.exit(1);
+                }
+            }
+        },
+        onMessage: async (wire) => {
+            // Reject messages from revoked keys
+            if (revokedKeys.has(wire.from.nodeId)) {
+                auditLog.append({
+                    timestamp: new Date().toISOString(),
+                    event: "message_rejected_revoked",
+                    messageId: wire.id,
+                    from: wire.from.nodeId,
+                    to: identity.nodeId,
+                });
+                return;
+            }
+            // Verify envelope signature
+            const senderPublicKey = (0, core_1.parseNodeId)(wire.from.nodeId);
+            if (!senderPublicKey)
+                return;
+            if (!(0, core_1.verifyEnvelope)(wire, senderPublicKey))
+                return;
+            // Verify owner attestation if present
+            if (wire.from.ownerAttestation && wire.from.ownerPublicKey) {
+                try {
+                    const ownerPubKey = (0, core_1.decodeBase64)(wire.from.ownerPublicKey);
+                    if (!(0, core_1.verifyOwnerAttestation)(wire.from.nodeId, wire.from.ownerAttestation, ownerPubKey)) {
+                        auditLog.append({
+                            timestamp: new Date().toISOString(),
+                            event: "attestation_invalid",
+                            messageId: wire.id,
+                            from: wire.from.nodeId,
+                        });
+                        // Don't reject — just log. Attestation is informational for now.
+                    }
+                }
+                catch {
+                    // Invalid key format — log but don't reject
+                }
+            }
+            // Verify capability signature if ownerPublicKey is available
+            if (wire.capability?.ownerSignature && wire.from.ownerPublicKey) {
+                try {
+                    const ownerPubKey = (0, core_1.decodeBase64)(wire.from.ownerPublicKey);
+                    if (!(0, core_1.verifyCapabilitySignature)(wire.capability, ownerPubKey)) {
+                        auditLog.append({
+                            timestamp: new Date().toISOString(),
+                            event: "capability_invalid",
+                            messageId: wire.id,
+                            from: wire.from.nodeId,
+                        });
+                        // Log but don't reject — capability verification is defense-in-depth
+                    }
+                }
+                catch {
+                    // Invalid key format
+                }
+            }
+            let decrypted;
+            try {
+                decrypted = (0, core_1.decryptEnvelope)(wire, identity.x25519.secretKey);
+            }
+            catch {
+                return;
+            }
+            const rules = getPolicies();
+            const payloadType = decrypted.payload?.type ?? "general/1";
+            if ((0, policies_js_1.isDenied)(rules, decrypted.from.nodeId, payloadType)) {
+                auditLog.append({
+                    timestamp: new Date().toISOString(),
+                    event: "message_denied",
+                    messageId: wire.id,
+                    from: wire.from.nodeId,
+                    to: identity.nodeId,
+                });
+                return;
+            }
+            // Enforce accepts_from tier preference — check sender's tier against our policy
+            try {
+                const acceptsFrom = await getOwnAcceptsFrom();
+                if (acceptsFrom !== "all") {
+                    const senderTier = await getSenderTier(decrypted.from.nodeId);
+                    if (!tierSatisfiesPolicy(senderTier, acceptsFrom)) {
+                        auditLog.append({
+                            timestamp: new Date().toISOString(),
+                            event: "message_filtered_tier",
+                            messageId: wire.id,
+                            from: wire.from.nodeId,
+                            to: identity.nodeId,
+                        });
+                        return;
+                    }
+                }
+            }
+            catch {
+                // Directory API unreachable — fail open (deliver the message)
+            }
+            if ((0, policies_js_1.shouldRequireApproval)(rules, decrypted.from.nodeId, payloadType)) {
+                pending.set(wire.id, decrypted);
+                return;
+            }
+            deliverMessage(decrypted);
+        },
+        onConnectionChange: (connected) => {
+            auditLog.append({
+                timestamp: new Date().toISOString(),
+                event: connected ? "connection_up" : "connection_down",
+            });
+        },
+    });
+    const relayHttpUrl = config.relayUrl.replace(/^ws/, "http").replace(/\/$/, "");
+    async function discoverAgents() {
+        const res = await fetch(`${relayHttpUrl}/discover`);
+        if (!res.ok)
+            throw new Error(`relay discover: ${res.status}`);
+        const data = (await res.json());
+        const agents = data.agents ?? [];
+        return agents.map((a) => ({ nodeId: a.nodeId }));
+    }
+    function getPending() {
+        return Array.from(pending.values()).map((e) => ({
+            messageId: e.id,
+            from: e.from.nodeId,
+            to: e.to,
+            timestamp: e.timestamp,
+            payload: e.payload,
+            capabilityScope: e.capability?.scope,
+        }));
+    }
+    function approve(messageId) {
+        const decrypted = pending.get(messageId);
+        if (!decrypted)
+            return false;
+        pending.delete(messageId);
+        deliverMessage(decrypted);
+        auditLog.append({
+            timestamp: new Date().toISOString(),
+            event: "message_approved",
+            messageId,
+            from: decrypted.from.nodeId,
+            to: identity.nodeId,
+        });
+        return true;
+    }
+    function deny(messageId, _reason) {
+        const decrypted = pending.get(messageId);
+        if (!decrypted)
+            return false;
+        pending.delete(messageId);
+        auditLog.append({
+            timestamp: new Date().toISOString(),
+            event: "message_denied",
+            messageId,
+            from: decrypted.from.nodeId,
+            to: identity.nodeId,
+        });
+        return true;
+    }
+    /** Revoke this daemon's key. Broadcasts revocation to all peers via relay. */
+    function revokeKey(reason, replacementNodeId) {
+        const revocation = (0, core_1.createKeyRevocation)(identity.nodeId, reason, owner.ed25519.secretKey, owner.ed25519.publicKey, replacementNodeId);
+        const sent = relayClient.sendRaw({ type: "key_revocation", revocation });
+        if (sent) {
+            revokedKeys.add(identity.nodeId);
+            saveRevokedKeys(config.dataDir, revokedKeys);
+            auditLog.append({
+                timestamp: new Date().toISOString(),
+                event: "key_self_revoked",
+                from: identity.nodeId,
+            });
+        }
+        return sent;
+    }
+    const uiPath = [(0, node_path_1.join)(process.cwd(), "public"), (0, node_path_1.join)(process.cwd(), "packages", "daemon", "public")].find((p) => (0, node_fs_1.existsSync)(p));
+    function getConversationHistory(withNodeId, limit = 100) {
+        const { entries } = auditLog.readRecent(5000);
+        const selfId = identity.nodeId;
+        const filtered = entries.filter((e) => (e.event === "message_sent" || e.event === "message_received" || e.event === "message_approved" || e.event === "message_denied") &&
+            ((e.from === withNodeId && e.to === selfId) || (e.from === selfId && e.to === withNodeId)));
+        return filtered.slice(-limit).map((e) => {
+            const out = {
+                timestamp: e.timestamp,
+                event: e.event,
+            };
+            if (e.messageId !== undefined)
+                out.messageId = e.messageId;
+            if (e.from !== undefined)
+                out.from = e.from;
+            if (e.to !== undefined)
+                out.to = e.to;
+            return out;
+        });
+    }
+    let agentRunner = null;
+    if (config.agent?.command) {
+        agentRunner = (0, agent_process_js_1.createAgentProcessRunner)(config.agent);
+    }
+    function rotateKey() {
+        try {
+            const { oldIdentity, newIdentity } = (0, identity_js_1.rotateIdentity)(config.dataDir);
+            // Revoke old key with rotation reason, pointing to replacement
+            revokeKey("rotation", newIdentity.nodeId);
+            auditLog.append({
+                timestamp: new Date().toISOString(),
+                event: "key_rotated",
+                from: oldIdentity.nodeId,
+                to: newIdentity.nodeId,
+            });
+            return { oldNodeId: oldIdentity.nodeId, newNodeId: newIdentity.nodeId };
+        }
+        catch (e) {
+            console.error("[daemon] Key rotation failed:", e instanceof Error ? e.message : e);
+            return null;
+        }
+    }
+    const app = (0, server_js_1.createHttpServer)({
+        nodeId: identity.nodeId,
+        relayUrl: config.relayUrl,
+        x25519PublicKeyBase64: (0, core_1.encodeBase64)(identity.x25519.publicKey),
+        ownerAttestation: true,
+        isConnected: () => relayClient.isConnected(),
+        buildAndSend,
+        getMessages: (limit) => (limit != null ? messages.slice(-limit) : [...messages]),
+        discoverAgents,
+        getPending,
+        approve,
+        deny,
+        getPolicies,
+        setPolicies,
+        getActivity: (limit) => auditLog.readRecent(limit),
+        getConversationHistory,
+        sendWebChatReply: (sessionId, content) => relayClient.sendRaw({ type: "web_chat_out", sessionId, content }),
+        getWebChatIncoming: () => [...webChatIncoming],
+        revokeKey,
+        getRevokedKeys: () => Array.from(revokedKeys),
+        rotateKey,
+        halt: () => shutdown(),
+        ...(agentRunner != null && {
+            getAgentStatus: () => {
+                const s = agentRunner.getStatus();
+                return {
+                    status: s.status,
+                    pid: s.pid,
+                    restartCount: s.restartCount,
+                    lastExitCode: s.lastExitCode,
+                    lastExitSignal: s.lastExitSignal,
+                };
+            },
+        }),
+        ...(uiPath !== undefined && { uiPath }),
+        ...(config.marketplaceApiUrl !== undefined && { marketplaceApiUrl: config.marketplaceApiUrl }),
+        ...(config.directoryApiUrl !== undefined && { directoryApiUrl: config.directoryApiUrl }),
+    });
+    const pidFile = (0, node_path_1.join)(config.dataDir, "signet.pid");
+    try {
+        (0, node_fs_1.writeFileSync)(pidFile, String(process.pid));
+    }
+    catch {
+        // ignore if dataDir not writable
+    }
+    const httpServer = (0, node_http_1.createServer)(app);
+    httpServer.listen(config.httpPort, config.httpHost, () => {
+        console.log(`Signet daemon listening on http://${config.httpHost}:${config.httpPort} (nodeId=${identity.nodeId})`);
+    });
+    relayClient.connect();
+    if (agentRunner != null) {
+        agentRunner.start((err) => {
+            if (err)
+                console.error("[signet] agent process start error:", err.message);
+        });
+    }
+    function shutdown() {
+        try {
+            if ((0, node_fs_1.existsSync)(pidFile))
+                (0, node_fs_1.unlinkSync)(pidFile);
+        }
+        catch {
+            // ignore
+        }
+        if (agentRunner != null) {
+            agentRunner.clearRestartTimeout();
+            agentRunner.stop(() => {
+                relayClient.disconnect();
+                httpServer.close(() => process.exit(0));
+            });
+        }
+        else {
+            relayClient.disconnect();
+            httpServer.close(() => process.exit(0));
+        }
+    }
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+}
+main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA;;;GAGG;AACH,yCAAyC;AACzC,yCAAiC;AACjC,qCAA8E;AAC9E,6CAAyC;AACzC,yCAewB;AACxB,2CAAyC;AACzC,+CAMuB;AACvB,uDAAgD;AAChD,2CAA+C;AAE/C,iDAA0C;AAC1C,yDAA8D;AAC9D,+CAMuB;AAEvB,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,SAAS,aAAa,CACpB,GAAW,EACX,MAA0B,EAC1B,OAAkH;IAElH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,SAAS;QAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IACzD,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAa,CAAC;YAChE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,IAAI,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,IAAiB;IACzD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,IAAA,sBAAU,GAAE,CAAC;IAC5B,IAAA,2BAAa,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,QAAQ,GAAG,IAAA,kCAAoB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAA,+BAAiB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAA,oCAAsB,EAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,IAAA,4BAAqB,EAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjF,MAAM,oBAAoB,GAAG,IAAA,mBAAY,EAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,IAAI,uBAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC;IAEzB,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEpD,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC;IAClC,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,6BAA6B;IAChE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,MAAM,eAAe,GAAG,IAAI,GAAG,EAA+C,CAAC;IAE/E,KAAK,UAAU,iBAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,iBAAiB,KAAK,IAAI,IAAI,GAAG,GAAG,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;YAC9E,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,iBAAiB,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAC7E,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,iBAAiB,IAAI,KAAK,CAAC;YAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8D,CAAC;YAC7F,iBAAiB,GAAG,IAAI,CAAC,yBAAyB,EAAE,YAAY,IAAI,KAAK,CAAC;YAC1E,gBAAgB,GAAG,GAAG,CAAC;YACvB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,IAAI,KAAK,CAAC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,YAAoB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,iBAAiB;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,iBAAiB,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAC1E,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;YAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyC,CAAC;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,IAAI,MAAM,CAAC;YACpD,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,UAAkB,EAAE,WAAmB;QAClE,IAAI,WAAW,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,UAAU,CAAC;QAC3D,CAAC;QACD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,UAAU,CAAC;QAC3D,CAAC;QACD,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;YACtC,OAAO,UAAU,KAAK,UAAU,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,WAAW;QAClB,OAAO,IAAA,0BAAY,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,SAAS,WAAW,CAAC,KAAmB;QACtC,IAAA,0BAAY,EAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,SAAS,cAAc,CAAC,SAAyB;QAC/C,IAAI,QAAQ,CAAC,MAAM,IAAI,YAAY;YAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,SAAS,CAAC,EAAE;YACvB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM;YAC3B,EAAE,EAAE,QAAQ,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,OAAO,GACX,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ;gBACpD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;gBACnC,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,OAAO,GAA8G;gBACzH,SAAS,EAAE,SAAS,CAAC,EAAE;gBACvB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM;gBAC3B,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B,CAAC;YACF,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;YACrD,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CACnB,EAAU,EACV,OAA2D,EAC3D,8BAAsC;QAEtC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,eAA2B,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,IAAA,mBAAY,EAAC,8BAA8B,CAAC,CAAC;YAC/D,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,qBAAc,EACzB,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,MAAM,EACf,EAAE,EACF,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAChE,UAAU,EACV;YACE,wBAAwB,EAAE,eAAe;YACzC,gBAAgB,EAAE,WAAW;YAC7B,cAAc,EAAE,oBAAoB;SACrC,CACF,CAAC;QAEF,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,QAAQ,CAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,IAAI,EAAE,QAAQ,CAAC,MAAM;YACrB,EAAE;SACH,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAiG,EAAE,CAAC;IACzH,MAAM,qBAAqB,GAAG,GAAG,CAAC;IAElC,MAAM,WAAW,GAAG,IAAI,6BAAW,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,cAAc,EAAE,QAAQ,CAAC,OAAO;QAChC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;YAC5B,IAAI,eAAe,CAAC,MAAM,IAAI,qBAAqB;gBAAE,eAAe,CAAC,KAAK,EAAE,CAAC;YAC7E,eAAe,CAAC,IAAI,CAAC;gBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,iBAAiB;gBACvB,EAAE,EAAE,QAAQ,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;QACD,eAAe,EAAE,CAAC,UAAyB,EAAE,EAAE;YAC7C,IAAI,IAAA,0BAAmB,EAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBAC1C,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC7C,QAAQ,CAAC,MAAM,CAAC;oBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,aAAa;oBACpB,IAAI,EAAE,UAAU,CAAC,aAAa;iBAC/B,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,wCAAwC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1H,IAAI,UAAU,CAAC,aAAa,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACjD,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;oBAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,IAAwB,EAAE,EAAE;YAC5C,oCAAoC;YACpC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,MAAM,CAAC;oBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,0BAA0B;oBACjC,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;oBACtB,EAAE,EAAE,QAAQ,CAAC,MAAM;iBACpB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,4BAA4B;YAC5B,MAAM,eAAe,GAAG,IAAA,kBAAW,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,eAAe;gBAAE,OAAO;YAC7B,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAI,EAAE,eAAe,CAAC;gBAAE,OAAO;YAEnD,sCAAsC;YACtC,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,IAAA,mBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC3D,IAAI,CAAC,IAAA,6BAAsB,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;wBACvF,QAAQ,CAAC,MAAM,CAAC;4BACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BACnC,KAAK,EAAE,qBAAqB;4BAC5B,SAAS,EAAE,IAAI,CAAC,EAAE;4BAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;yBACvB,CAAC,CAAC;wBACH,iEAAiE;oBACnE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;YACH,CAAC;YAED,6DAA6D;YAC7D,IAAI,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAChE,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,IAAA,mBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC3D,IAAI,CAAC,IAAA,gCAAyB,EAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;wBAC7D,QAAQ,CAAC,MAAM,CAAC;4BACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BACnC,KAAK,EAAE,oBAAoB;4BAC3B,SAAS,EAAE,IAAI,CAAC,EAAE;4BAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;yBACvB,CAAC,CAAC;wBACH,qEAAqE;oBACvE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,qBAAqB;gBACvB,CAAC;YACH,CAAC;YAED,IAAI,SAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,SAAS,GAAG,IAAA,sBAAe,EAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,WAAW,CAAC;YAC3D,IAAI,IAAA,sBAAQ,EAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,QAAQ,CAAC,MAAM,CAAC;oBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,gBAAgB;oBACvB,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;oBACtB,EAAE,EAAE,QAAQ,CAAC,MAAM;iBACpB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,gFAAgF;YAChF,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,EAAE,CAAC;gBAC9C,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;oBAC1B,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC9D,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;wBAClD,QAAQ,CAAC,MAAM,CAAC;4BACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BACnC,KAAK,EAAE,uBAAuB;4BAC9B,SAAS,EAAE,IAAI,CAAC,EAAE;4BAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;4BACtB,EAAE,EAAE,QAAQ,CAAC,MAAM;yBACpB,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YAED,IAAI,IAAA,mCAAqB,EAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE;YAChC,QAAQ,CAAC,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB;aACvD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE/E,KAAK,UAAU,cAAc;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,SAAS,UAAU;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9C,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK;SACrC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,SAAS,OAAO,CAAC,SAAiB;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,kBAAkB;YACzB,SAAS;YACT,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM;YAC3B,EAAE,EAAE,QAAQ,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,IAAI,CAAC,SAAiB,EAAE,OAAgB;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,gBAAgB;YACvB,SAAS;YACT,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM;YAC3B,EAAE,EAAE,QAAQ,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,SAAS,SAAS,CAAC,MAA+B,EAAE,iBAA0B;QAC5E,MAAM,UAAU,GAAG,IAAA,0BAAmB,EACpC,QAAQ,CAAC,MAAM,EACf,MAAM,EACN,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,iBAAiB,CAClB,CAAC;QACF,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,EAAE,CAAC;YACT,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC7C,QAAQ,CAAC,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,QAAQ,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAA,gBAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CACtG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC,CACrB,CAAC;IAEF,SAAS,sBAAsB,CAAC,UAAkB,EAAE,KAAK,GAAG,GAAG;QAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,kBAAkB,IAAI,CAAC,CAAC,KAAK,KAAK,kBAAkB,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC;YAChI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAC7F,CAAC;QACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,GAAG,GAAyF;gBAChG,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC;YACF,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;YAC3D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5C,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,GAAuD,IAAI,CAAC;IAC3E,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1B,WAAW,GAAG,IAAA,2CAAwB,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAA,4BAAc,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpE,+DAA+D;YAC/D,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1C,QAAQ,CAAC,MAAM,CAAC;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,aAAa;gBACpB,IAAI,EAAE,WAAW,CAAC,MAAM;gBACxB,EAAE,EAAE,WAAW,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,4BAAgB,EAAC;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,qBAAqB,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9D,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE;QAC5C,YAAY;QACZ,WAAW,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;QACzF,cAAc;QACd,UAAU;QACV,OAAO;QACP,IAAI;QACJ,WAAW;QACX,WAAW;QACX,WAAW,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1D,sBAAsB;QACtB,gBAAgB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CACvC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACnE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC;QAC9C,SAAS;QACT,cAAc,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7C,SAAS;QACT,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE;QACtB,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI;YACzB,cAAc,EAAE,GAAG,EAAE;gBACnB,MAAM,CAAC,GAAG,WAAY,CAAC,SAAS,EAAE,CAAC;gBACnC,OAAO;oBACL,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;iBACjC,CAAC;YACJ,CAAC;SACF,CAAC;QACF,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;KACzF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC;IACrC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QACvD,OAAO,CAAC,GAAG,CACT,qCAAqC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,YAAY,QAAQ,CAAC,MAAM,GAAG,CACtG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE,CAAC;IAEtB,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,GAAG;gBAAE,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,QAAQ;QACf,IAAI,CAAC;YACH,IAAI,IAAA,oBAAU,EAAC,OAAO,CAAC;gBAAE,IAAA,oBAAU,EAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpB,WAAW,CAAC,UAAU,EAAE,CAAC;gBACzB,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,UAAU,EAAE,CAAC;YACzB,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/policies.d.ts

@@ -0,0 +1,11 @@
+export interface PolicyRule {
+    id: string;
+    action: "allow" | "deny" | "require_approval";
+    scope?: string;
+    description?: string;
+}
+export declare function loadPolicies(dataDir: string): PolicyRule[];
+export declare function savePolicies(dataDir: string, rules: PolicyRule[]): void;
+export declare function isDenied(rules: PolicyRule[], fromNodeId: string, _payloadType: string): boolean;
+export declare function shouldRequireApproval(rules: PolicyRule[], fromNodeId: string, _payloadType: string): boolean;
+//# sourceMappingURL=policies.d.ts.map

package/dist/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAiB1D;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAIvE;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAM/F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAM5G"}

package/dist/policies.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPolicies = loadPolicies;
+exports.savePolicies = savePolicies;
+exports.isDenied = isDenied;
+exports.shouldRequireApproval = shouldRequireApproval;
+/**
+ * Policy rules: load/save from data dir, evaluate allow/deny/require_approval.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const POLICIES_FILE = "policies.json";
+function getPath(dataDir) {
+    return (0, node_path_1.join)(dataDir, POLICIES_FILE);
+}
+function loadPolicies(dataDir) {
+    const path = getPath(dataDir);
+    if (!(0, node_fs_1.existsSync)(path))
+        return [];
+    try {
+        const raw = (0, node_fs_1.readFileSync)(path, "utf8");
+        const data = JSON.parse(raw);
+        if (!Array.isArray(data?.rules))
+            return [];
+        return data.rules.filter((r) => r != null &&
+            typeof r === "object" &&
+            typeof r.id === "string" &&
+            ["allow", "deny", "require_approval"].includes(r.action));
+    }
+    catch {
+        return [];
+    }
+}
+function savePolicies(dataDir, rules) {
+    if (!(0, node_fs_1.existsSync)(dataDir))
+        (0, node_fs_1.mkdirSync)(dataDir, { recursive: true });
+    const path = getPath(dataDir);
+    (0, node_fs_1.writeFileSync)(path, JSON.stringify({ rules }));
+}
+function isDenied(rules, fromNodeId, _payloadType) {
+    for (const r of rules) {
+        if (r.action !== "deny")
+            continue;
+        if (r.id === "*" || r.id === fromNodeId)
+            return true;
+    }
+    return false;
+}
+function shouldRequireApproval(rules, fromNodeId, _payloadType) {
+    for (const r of rules) {
+        if (r.action !== "require_approval")
+            continue;
+        if (r.id === "*" || r.id === fromNodeId)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=policies.js.map

package/dist/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":";;AAmBA,oCAiBC;AAED,oCAIC;AAED,4BAMC;AAED,sDAMC;AA1DD;;GAEG;AACH,qCAA6E;AAC7E,yCAAiC;AAEjC,MAAM,aAAa,GAAG,eAAe,CAAC;AAStC,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,YAAY,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CACtB,CAAC,CAAC,EAAmB,EAAE,CACrB,CAAC,IAAI,IAAI;YACT,OAAO,CAAC,KAAK,QAAQ;YACrB,OAAQ,CAAgB,CAAC,EAAE,KAAK,QAAQ;YACxC,CAAC,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAE,CAAgB,CAAC,MAAM,CAAC,CAC3D,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,YAAY,CAAC,OAAe,EAAE,KAAmB;IAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,OAAO,CAAC;QAAE,IAAA,mBAAS,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAgB,QAAQ,CAAC,KAAmB,EAAE,UAAkB,EAAE,YAAoB;IACpF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAmB,EAAE,UAAkB,EAAE,YAAoB;IACjG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/relay-client.d.ts

@@ -0,0 +1,34 @@
+/**
+ * WebSocket client to relay: signed challenge auth, send envelopes, reconnect with backoff.
+ */
+import { type SignetEnvelopeWire, type Ed25519KeyPair, type KeyRevocation } from "@onsignet/core";
+export interface WebChatInPayload {
+    sessionId: string;
+    visitorAuthLevel: string;
+    content: unknown;
+}
+export interface RelayClientOptions {
+    relayUrl: string;
+    nodeId: string;
+    ed25519KeyPair: Ed25519KeyPair;
+    onMessage: (_wire: SignetEnvelopeWire) => void | Promise<void>;
+    onConnectionChange?: (_connected: boolean) => void;
+    onWebChatMessage?: (_payload: WebChatInPayload) => void;
+    onKeyRevocation?: (_revocation: KeyRevocation) => void;
+}
+export declare class RelayClient {
+    private options;
+    private ws;
+    private backoff;
+    private reconnectTimer;
+    private registered;
+    private awaitingChallenge;
+    constructor(options: RelayClientOptions);
+    connect(): void;
+    private scheduleReconnect;
+    send(wire: SignetEnvelopeWire): boolean;
+    sendRaw(payload: unknown): boolean;
+    disconnect(): void;
+    isConnected(): boolean;
+}
+//# sourceMappingURL=relay-client.d.ts.map