@privos_ai/app-server 0.5.0 → 0.6.1

package/dist/relay/standalone-control.js

@@ -0,0 +1,338 @@
+/**
+ * Standalone-production control channel: secret rotation, trust rotation
+ * (Hub re-key or generation/manifest update), and capabilities push — all
+ * delivered as ES256-signed control assertions over the already-authenticated
+ * Relay WebSocket. A control message is applied only when its signature
+ * verifies against the identity file's CURRENTLY pinned Hub key: the Relay
+ * transport being authenticated is not sufficient on its own, because a
+ * compromised relay hop must not be able to redirect credentials or trust.
+ *
+ * Wire contract (Hub side must match): a JSON-RPC notification over the Relay
+ * WebSocket with one of the reserved methods below and
+ * `params: { assertion: <compact ES256 JWS> }`. The compact JWS header is
+ * `{ alg:'ES256', kid, privos_protocol:3, typ:'privos-hub-standalone-control+jws' }`
+ * and its payload is
+ * `{ protocolVersion:3, type, iss:'hub:<deploymentId>', aud:'mcp-runtime:<mcpAppId>',
+ *    jti, nonce, iat, exp, data }` with `exp - iat <= 30` (same zero-headroom
+ * budget as dispatch assertions — NTP on both sides is a hard requirement).
+ * `data` is `{ clientId, clientSecret }` for secret rotation,
+ * `{ trust: RuntimeDispatchTrustV3 }` for trust rotation, and
+ * `{ scopes: string[], grantEpoch: number }` for a capabilities push.
+ */
+import crypto from 'node:crypto';
+import { assertRuntimeDispatchTrustConfigurationV3, } from '../workload/dispatch-assertion.js';
+import { loadStandaloneIdentity, rotateStandaloneIdentity, standaloneHubFingerprint, } from './standalone-identity.js';
+export const STANDALONE_SECRET_ROTATE_METHOD = 'notifications/privos.standaloneSecretRotate';
+export const STANDALONE_TRUST_ROTATE_METHOD = 'notifications/privos.standaloneTrustRotate';
+export const STANDALONE_CAPABILITIES_CHANGED_METHOD = 'notifications/privos.standaloneCapabilitiesChanged';
+const CONTROL_METHODS = new Set([
+    STANDALONE_SECRET_ROTATE_METHOD,
+    STANDALONE_TRUST_ROTATE_METHOD,
+    STANDALONE_CAPABILITIES_CHANGED_METHOD,
+]);
+export function isStandaloneControlMethod(method) {
+    return typeof method === 'string' && CONTROL_METHODS.has(method);
+}
+const CONTROL_HEADER_KEYS = ['alg', 'kid', 'privos_protocol', 'typ'];
+const CONTROL_PAYLOAD_KEYS = ['aud', 'data', 'exp', 'iat', 'iss', 'jti', 'nonce', 'protocolVersion', 'type'];
+const CONTROL_TYPE_BY_METHOD = {
+    [STANDALONE_SECRET_ROTATE_METHOD]: 'standalone-secret-rotate',
+    [STANDALONE_TRUST_ROTATE_METHOD]: 'standalone-trust-rotate',
+    [STANDALONE_CAPABILITIES_CHANGED_METHOD]: 'standalone-capabilities-changed',
+};
+const MAX_CONTROL_COMPACT_BYTES = 32_768;
+const DEFAULT_REPLAY_CAPACITY = 64;
+export class StandaloneControlError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'StandaloneControlError';
+    }
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const sortedExpected = [...expected].sort();
+    return actual.length === sortedExpected.length && actual.every((key, index) => key === sortedExpected[index]);
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([key, child]) => [key, canonicalize(child)]));
+    }
+    return value;
+}
+function canonical(value) {
+    return JSON.stringify(canonicalize(value));
+}
+function strictBase64urlDecode(value) {
+    if (!value || !/^[A-Za-z0-9_-]+$/.test(value))
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.toString('base64url') !== value)
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    return decoded;
+}
+/** Bounded replay protection for the rare (operator-triggered) control channel. */
+class BoundedControlReplayConsumer {
+    capacity;
+    seen = new Map();
+    constructor(capacity = DEFAULT_REPLAY_CAPACITY) {
+        this.capacity = capacity;
+    }
+    consume(key, expiresAt, now) {
+        for (const [existingKey, exp] of this.seen)
+            if (exp <= now)
+                this.seen.delete(existingKey);
+        if (this.seen.has(key))
+            return false;
+        if (this.seen.size >= this.capacity) {
+            const oldest = this.seen.keys().next().value;
+            if (oldest !== undefined)
+                this.seen.delete(oldest);
+        }
+        this.seen.set(key, expiresAt);
+        return true;
+    }
+}
+function verifyStandaloneControlAssertion(input) {
+    const expectedType = CONTROL_TYPE_BY_METHOD[input.method];
+    if (!expectedType)
+        throw new StandaloneControlError('standalone_control_method_unknown');
+    if (typeof input.compact !== 'string' || Buffer.byteLength(input.compact, 'utf8') > MAX_CONTROL_COMPACT_BYTES) {
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    }
+    const parts = input.compact.split('.');
+    if (parts.length !== 3 || parts.some((part) => !part))
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    const headerBytes = strictBase64urlDecode(parts[0]);
+    const payloadBytes = strictBase64urlDecode(parts[1]);
+    const signature = strictBase64urlDecode(parts[2]);
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(headerBytes.toString('utf8'));
+        payload = JSON.parse(payloadBytes.toString('utf8'));
+    }
+    catch {
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    }
+    if (!isRecord(header) || !isRecord(payload))
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    if (parts[0] !== Buffer.from(canonical(header), 'utf8').toString('base64url') ||
+        parts[1] !== Buffer.from(canonical(payload), 'utf8').toString('base64url')) {
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    }
+    if (!exactKeys(header, CONTROL_HEADER_KEYS) ||
+        header.alg !== 'ES256' ||
+        header.typ !== 'privos-hub-standalone-control+jws' ||
+        header.privos_protocol !== 3 ||
+        header.kid !== input.trust.hubKid) {
+        // A kid mismatch here is the cold-app case: the message was signed by a
+        // key this app never accepted a trust rotation for. Refuse; the operator
+        // must deliver the rotation live or re-pair.
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    }
+    if (!exactKeys(payload, CONTROL_PAYLOAD_KEYS) ||
+        payload.protocolVersion !== 3 ||
+        payload.type !== expectedType ||
+        payload.iss !== `hub:${input.trust.affinity.deploymentId}` ||
+        payload.aud !== `mcp-runtime:${input.trust.affinity.mcpAppId}` ||
+        typeof payload.jti !== 'string' ||
+        !payload.jti ||
+        typeof payload.nonce !== 'string' ||
+        !payload.nonce ||
+        !Number.isSafeInteger(payload.iat) ||
+        !Number.isSafeInteger(payload.exp) ||
+        !isRecord(payload.data)) {
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    }
+    let key;
+    try {
+        key = crypto.createPublicKey({ key: input.trust.hubPublicJwk, format: 'jwk' });
+    }
+    catch {
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    }
+    if (signature.byteLength !== 64 ||
+        !crypto.verify('sha256', Buffer.from(`${parts[0]}.${parts[1]}`, 'ascii'), { key, dsaEncoding: 'ieee-p1363' }, signature)) {
+        throw new StandaloneControlError('standalone_control_assertion_invalid');
+    }
+    const iat = Number(payload.iat);
+    const exp = Number(payload.exp);
+    if (iat > input.now + input.clockSkewSeconds ||
+        exp <= input.now ||
+        exp <= iat ||
+        exp - iat > 30) {
+        throw new StandaloneControlError('standalone_control_assertion_time_invalid');
+    }
+    if (!input.replay.consume(`${payload.iss}:${payload.jti}:${payload.nonce}`, exp, input.now)) {
+        throw new StandaloneControlError('standalone_control_assertion_replayed');
+    }
+    return { data: payload.data };
+}
+function assertSecretRotateData(value) {
+    if (!isRecord(value) ||
+        !exactKeys(value, ['clientId', 'clientSecret']) ||
+        typeof value.clientId !== 'string' ||
+        !value.clientId ||
+        typeof value.clientSecret !== 'string' ||
+        !value.clientSecret) {
+        throw new StandaloneControlError('standalone_control_secret_rotate_data_invalid');
+    }
+}
+function assertTrustRotateData(value, current) {
+    if (!isRecord(value) || !exactKeys(value, ['trust'])) {
+        throw new StandaloneControlError('standalone_control_trust_rotate_data_invalid');
+    }
+    try {
+        assertRuntimeDispatchTrustConfigurationV3(value.trust);
+    }
+    catch {
+        throw new StandaloneControlError('standalone_control_trust_rotate_data_invalid');
+    }
+    const next = value.trust;
+    if (next.affinity.workspaceId !== current.affinity.workspaceId ||
+        next.affinity.deploymentId !== current.affinity.deploymentId ||
+        next.affinity.mcpAppId !== current.affinity.mcpAppId ||
+        next.affinity.runtimeInstallationId !== current.affinity.runtimeInstallationId) {
+        // Re-key/generation-update rotation may change the key, generation, and
+        // manifest — it must never change which installation this identity is.
+        throw new StandaloneControlError('standalone_control_trust_rotate_identity_mismatch');
+    }
+}
+function assertCapabilitiesChangedData(value) {
+    if (!isRecord(value) ||
+        !exactKeys(value, ['scopes', 'grantEpoch']) ||
+        !Array.isArray(value.scopes) ||
+        value.scopes.some((scope) => typeof scope !== 'string') ||
+        !Number.isSafeInteger(value.grantEpoch) ||
+        Number(value.grantEpoch) < 0) {
+        throw new StandaloneControlError('standalone_control_capabilities_data_invalid');
+    }
+}
+/**
+ * Builds the mutable, in-process bridge between the persisted identity file
+ * and a live Relay connection: current credentials/trust for outbound OAuth
+ * and dispatch verification, plus the capabilities event surface, all kept in
+ * sync as verified rotation/capabilities control messages arrive.
+ */
+export function createStandaloneRelayIdentityController(loaded, options = {}) {
+    const now = options.now ?? (() => Math.floor(Date.now() / 1_000));
+    const clockSkewSeconds = options.clockSkewSeconds ?? 5;
+    const replay = new BoundedControlReplayConsumer();
+    let current = loaded;
+    let capabilities = Object.freeze({
+        scopes: Object.freeze([]),
+        grantEpoch: current.trust.affinity.runtimeAuthorizationEpoch ?? 0,
+        updatedAt: Date.now(),
+    });
+    const listeners = new Set();
+    async function applySecretRotate(assertionCompact) {
+        if (typeof assertionCompact !== 'string')
+            throw new StandaloneControlError('standalone_control_assertion_invalid');
+        const verified = verifyStandaloneControlAssertion({
+            method: STANDALONE_SECRET_ROTATE_METHOD,
+            compact: assertionCompact,
+            trust: current.trust,
+            replay,
+            now: now(),
+            clockSkewSeconds,
+        });
+        assertSecretRotateData(verified.data);
+        const { clientId, clientSecret } = verified.data;
+        const rotated = await rotateStandaloneIdentity((identity) => ({ ...identity, clientId, clientSecret, rotatedAt: Date.now() }), { filePath: current.filePath });
+        current = rotated;
+        options.logger?.('standalone.identity.secret_rotated', { filePath: current.filePath });
+        options.onRotated?.(current);
+    }
+    async function applyTrustRotate(assertionCompact) {
+        if (typeof assertionCompact !== 'string')
+            throw new StandaloneControlError('standalone_control_assertion_invalid');
+        const verified = verifyStandaloneControlAssertion({
+            method: STANDALONE_TRUST_ROTATE_METHOD,
+            compact: assertionCompact,
+            trust: current.trust,
+            replay,
+            now: now(),
+            clockSkewSeconds,
+        });
+        assertTrustRotateData(verified.data, current.trust);
+        const nextTrust = verified.data.trust;
+        const rotated = await rotateStandaloneIdentity((identity) => ({
+            ...identity,
+            trust: nextTrust,
+            fingerprint: standaloneHubFingerprint(nextTrust.hubKid),
+            rotatedAt: Date.now(),
+        }), { filePath: current.filePath });
+        current = rotated;
+        options.logger?.('standalone.identity.trust_rotated', {
+            filePath: current.filePath,
+            fingerprint: current.fingerprint,
+        });
+        options.onRotated?.(current);
+    }
+    async function applyCapabilitiesChanged(assertionCompact) {
+        if (typeof assertionCompact !== 'string')
+            throw new StandaloneControlError('standalone_control_assertion_invalid');
+        const verified = verifyStandaloneControlAssertion({
+            method: STANDALONE_CAPABILITIES_CHANGED_METHOD,
+            compact: assertionCompact,
+            trust: current.trust,
+            replay,
+            now: now(),
+            clockSkewSeconds,
+        });
+        assertCapabilitiesChangedData(verified.data);
+        const next = Object.freeze({
+            scopes: Object.freeze([...new Set(verified.data.scopes)].sort()),
+            grantEpoch: verified.data.grantEpoch,
+            updatedAt: Date.now(),
+        });
+        if (next.grantEpoch < capabilities.grantEpoch) {
+            // A control channel may reorder; never regress to a stale epoch.
+            return;
+        }
+        capabilities = next;
+        for (const listener of listeners) {
+            try {
+                listener(next);
+            }
+            catch {
+                // A consumer callback must never break the control channel.
+            }
+        }
+    }
+    return {
+        getCredentials: () => current.relay,
+        getTrust: () => current.trust,
+        peekEffectiveCapabilities: () => capabilities,
+        onCapabilitiesChanged: (listener) => {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        async handleControlNotification(method, params) {
+            if (!isStandaloneControlMethod(method))
+                return 'ignored';
+            const assertion = isRecord(params) ? params.assertion : undefined;
+            if (method === STANDALONE_SECRET_ROTATE_METHOD)
+                await applySecretRotate(assertion);
+            else if (method === STANDALONE_TRUST_ROTATE_METHOD)
+                await applyTrustRotate(assertion);
+            else
+                await applyCapabilitiesChanged(assertion);
+            return 'handled';
+        },
+    };
+}
+/** Convenience: load the identity file and build its controller in one call. */
+export function loadStandaloneRelayIdentityController(options = {}) {
+    const loaded = loadStandaloneIdentity({ filePath: options.filePath });
+    return createStandaloneRelayIdentityController(loaded, options);
+}
+//# sourceMappingURL=standalone-control.js.map

package/dist/relay/standalone-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-control.js","sourceRoot":"","sources":["../../src/relay/standalone-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACN,yCAAyC,GAEzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GAGxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,+BAA+B,GAAG,6CAA6C,CAAC;AAC7F,MAAM,CAAC,MAAM,8BAA8B,GAAG,4CAA4C,CAAC;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,oDAAoD,CAAC;AAE3G,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACpD,+BAA+B;IAC/B,8BAA8B;IAC9B,sCAAsC;CACtC,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,MAAe;IAIxD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAQD,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAU,CAAC;AAC9E,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAU,CAAC;AACtH,MAAM,sBAAsB,GAAqC;IAChE,CAAC,+BAA+B,CAAC,EAAE,0BAA0B;IAC7D,CAAC,8BAA8B,CAAC,EAAE,yBAAyB;IAC3D,CAAC,sCAAsC,CAAC,EAAE,iCAAiC;CAC3E,CAAC;AACF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACtC,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACtH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,4BAA4B;IAEJ;IADZ,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,YAA6B,WAAW,uBAAuB;QAAlC,aAAQ,GAAR,QAAQ,CAA0B;IAAG,CAAC;IACnE,OAAO,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW;QAClD,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;YACnE,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAID,SAAS,gCAAgC,CAAQ,KAOhD;IACA,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QAC/G,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAChI,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC7D,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IACtH,IACC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EACzE,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACvC,MAAM,CAAC,GAAG,KAAK,OAAO;QACtB,MAAM,CAAC,GAAG,KAAK,mCAAmC;QAClD,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5B,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,EAChC,CAAC;QACF,wEAAwE;QACxE,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;QACzC,OAAO,CAAC,eAAe,KAAK,CAAC;QAC7B,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,OAAO,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC1D,OAAO,CAAC,GAAG,KAAK,eAAe,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAC9D,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,OAAO,CAAC,GAAG;QACZ,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,CAAC,OAAO,CAAC,KAAK;QACd,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EACtB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IACC,SAAS,CAAC,UAAU,KAAK,EAAE;QAC3B,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,EACvH,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IACC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,gBAAgB;QACxC,GAAG,IAAI,KAAK,CAAC,GAAG;QAChB,GAAG,IAAI,GAAG;QACV,GAAG,GAAG,GAAG,GAAG,EAAE,EACb,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAa,EAAE,CAAC;AACxC,CAAC;AAsBD,SAAS,sBAAsB,CAAC,KAAc;IAC7C,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,YAAY,EAClB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,OAA+B;IAC7E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC;QACJ,yCAAyC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAA+B,CAAC;IACnD,IACC,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW;QAC1D,IAAI,CAAC,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY;QAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ;QACpD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAC7E,CAAC;QACF,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,IAAI,sBAAsB,CAAC,mDAAmD,CAAC,CAAC;IACvF,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc;IACpD,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACvD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAC3B,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uCAAuC,CACtD,MAAgC,EAChC,UAAoD,EAAE;IAEtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAClD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,YAAY,GAAoC,MAAM,CAAC,MAAM,CAAC;QACjE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,yBAAyB,IAAI,CAAC;QACjE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmD,CAAC;IAE7E,KAAK,UAAU,iBAAiB,CAAC,gBAAyB;QACzD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,+BAA+B;YACvC,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC7C,CAAC,QAAQ,EAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EACpG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACF,OAAO,GAAG,OAAO,CAAC;QAClB,OAAO,CAAC,MAAM,EAAE,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,gBAAyB;QACxD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,8BAA8B;YACtC,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC7C,CAAC,QAAQ,EAAwB,EAAE,CAAC,CAAC;YACpC,GAAG,QAAQ;YACX,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,wBAAwB,CAAC,SAAS,CAAC,MAAM,CAAC;YACvD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,EACF,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACF,OAAO,GAAG,OAAO,CAAC;QAClB,OAAO,CAAC,MAAM,EAAE,CAAC,mCAAmC,EAAE;YACrD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,gBAAyB;QAChE,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,gCAAgC,CAAU;YAC1D,MAAM,EAAE,sCAAsC;YAC9C,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,GAAG,EAAE,GAAG,EAAE;YACV,gBAAgB;SAChB,CAAC,CAAC;QACH,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAoC,MAAM,CAAC,MAAM,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;YAC/C,iEAAiE;YACjE,OAAO;QACR,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC;gBACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACR,4DAA4D;YAC7D,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;QACnC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;QAC7B,yBAAyB,EAAE,GAAG,EAAE,CAAC,YAAY;QAC7C,qBAAqB,EAAE,CAAC,QAAQ,EAAE,EAAE;YACnC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM;YAC7C,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,IAAI,MAAM,KAAK,+BAA+B;gBAAE,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;iBAC9E,IAAI,MAAM,KAAK,8BAA8B;gBAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;;gBACjF,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qCAAqC,CACpD,UAAoD,EAAE;IAEtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,OAAO,uCAAuC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC"}

package/dist/relay/standalone-identity.d.ts

@@ -0,0 +1,69 @@
+import { type RuntimeDispatchTrustV3 } from '../workload/dispatch-assertion.js';
+export declare const DEFAULT_STANDALONE_IDENTITY_FILE = "./privos-standalone-identity.json";
+export type StandaloneIdentityV2 = Readonly<{
+    pairingVersion: 2;
+    /** Origin the OAuth token + Relay WebSocket are reached at (http/https, no trailing slash). */
+    relayUrl: string;
+    clientId: string;
+    clientSecret: string;
+    /** Hub dispatch trust delivered at pairing; the sole input to `RuntimeDispatchTrustV3`. */
+    trust: RuntimeDispatchTrustV3;
+    /** `SHA256:<hubKid>` — operator-verifiable, SSH-host-key style. */
+    fingerprint: string;
+    mcpAppId?: string;
+    /** Unix ms when this file was first written by pairing. */
+    pairedAt: number;
+    /** Unix ms of the most recent secret or trust rotation, if any. */
+    rotatedAt?: number;
+}>;
+export type LoadedStandaloneIdentity = Readonly<{
+    filePath: string;
+    identity: StandaloneIdentityV2;
+    relay: Readonly<{
+        privosUrl: string;
+        clientId: string;
+        clientSecret: string;
+    }>;
+    trust: RuntimeDispatchTrustV3;
+    fingerprint: string;
+}>;
+export type StandaloneIdentityErrorCode = 'IDENTITY_FILE_MISSING' | 'IDENTITY_FILE_MODE_INVALID' | 'IDENTITY_FILE_UNPARSEABLE' | 'IDENTITY_FILE_INVALID' | 'IDENTITY_FILE_ALREADY_EXISTS';
+export declare class StandaloneIdentityError extends Error {
+    readonly code: StandaloneIdentityErrorCode;
+    constructor(code: StandaloneIdentityErrorCode, message: string);
+}
+/** Renders an SSH-host-key-style fingerprint for out-of-band operator verification. */
+export declare function standaloneHubFingerprint(hubKid: string): string;
+/** Throws {@link StandaloneIdentityError} `IDENTITY_FILE_INVALID` describing exactly what failed. */
+export declare function assertStandaloneIdentityShape(value: unknown): asserts value is StandaloneIdentityV2;
+/**
+ * Loads, validates, and returns the standalone identity file. Refuses to load
+ * (with a specific reason) a missing file, a file with unsafe permissions, or
+ * unparseable/invalid content — never falls back to a relaxed mode.
+ */
+export declare function loadStandaloneIdentity(options?: {
+    filePath?: string;
+}): LoadedStandaloneIdentity;
+/** True when a standalone identity file exists at the resolved path, without loading/validating it. */
+export declare function standaloneIdentityFileExists(options?: {
+    filePath?: string;
+}): boolean;
+/**
+ * Persists a freshly-paired identity. Creates the file with `wx` (fails if it
+ * already exists) at mode `0600` — the same discipline as the Hub's own
+ * self-generated identity file. Re-pairing over an existing file requires the
+ * operator to remove it first; rotation uses {@link rotateStandaloneIdentity}.
+ */
+export declare function saveStandaloneIdentity(identity: StandaloneIdentityV2, options?: {
+    filePath?: string;
+}): Promise<string>;
+/**
+ * Atomically rewrites the identity file (temp file + rename) — the durable
+ * half of secret/trust rotation. `mutate` receives the currently persisted,
+ * validated identity and must return the complete next identity; the result
+ * is re-validated before it is written.
+ */
+export declare function rotateStandaloneIdentity(mutate: (current: StandaloneIdentityV2) => StandaloneIdentityV2, options?: {
+    filePath?: string;
+}): Promise<LoadedStandaloneIdentity>;
+//# sourceMappingURL=standalone-identity.d.ts.map

package/dist/relay/standalone-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-identity.d.ts","sourceRoot":"","sources":["../../src/relay/standalone-identity.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEN,KAAK,sBAAsB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,eAAO,MAAM,gCAAgC,sCAAsC,CAAC;AAapF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB,CAAC;IAC9B,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,KAAK,EAAE,QAAQ,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,EAAE,sBAAsB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GACpC,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,uBAAuB,GACvB,8BAA8B,CAAC;AAElC,qBAAa,uBAAwB,SAAQ,KAAK;aAEhC,IAAI,EAAE,2BAA2B;gBAAjC,IAAI,EAAE,2BAA2B,EACjD,OAAO,EAAE,MAAM;CAKhB;AAaD,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD,qGAAqG;AACrG,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAqCnG;AAeD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CAgChG;AAED,uGAAuG;AACvG,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAErF;AAMD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC3C,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,oBAAoB,EAC/D,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}

package/dist/relay/standalone-identity.js

@@ -0,0 +1,204 @@
+/**
+ * Standalone production identity: the file a self-hosted app persists after
+ * pairing over the Relay WebSocket. It is the sole source of relay
+ * credentials and Hub dispatch trust for `standalone-production` runtime
+ * mode — apps must load it through {@link loadStandaloneIdentity} and never
+ * hand-assemble `RuntimeDispatchTrustV3` from raw environment input.
+ *
+ * File discipline mirrors the Hub's own self-generated identity file: mode
+ * `0600`, created with `wx` so an existing file is never silently
+ * overwritten, and rotations rewrite it atomically (temp file + rename).
+ */
+import crypto from 'node:crypto';
+import fsSync from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { assertRuntimeDispatchTrustConfigurationV3, } from '../workload/dispatch-assertion.js';
+export const DEFAULT_STANDALONE_IDENTITY_FILE = './privos-standalone-identity.json';
+const IDENTITY_REQUIRED_KEYS = [
+    'pairingVersion',
+    'relayUrl',
+    'clientId',
+    'clientSecret',
+    'trust',
+    'fingerprint',
+    'pairedAt',
+];
+const IDENTITY_OPTIONAL_KEYS = ['mcpAppId', 'rotatedAt'];
+export class StandaloneIdentityError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'StandaloneIdentityError';
+    }
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, required, optional) {
+    const present = Object.keys(value);
+    const allowed = new Set([...required, ...optional]);
+    if (present.some((key) => !allowed.has(key)))
+        return false;
+    return required.every((key) => Object.prototype.hasOwnProperty.call(value, key));
+}
+/** Renders an SSH-host-key-style fingerprint for out-of-band operator verification. */
+export function standaloneHubFingerprint(hubKid) {
+    return `SHA256:${hubKid}`;
+}
+function resolveIdentityFilePath(explicit) {
+    return path.resolve(explicit ?? process.env.PRIVOS_STANDALONE_IDENTITY_FILE ?? DEFAULT_STANDALONE_IDENTITY_FILE);
+}
+/** Throws {@link StandaloneIdentityError} `IDENTITY_FILE_INVALID` describing exactly what failed. */
+export function assertStandaloneIdentityShape(value) {
+    if (!isRecord(value) || !exactKeys(value, IDENTITY_REQUIRED_KEYS, IDENTITY_OPTIONAL_KEYS)) {
+        throw new StandaloneIdentityError('IDENTITY_FILE_INVALID', 'Standalone identity file has an unexpected shape.');
+    }
+    if (value.pairingVersion !== 2 ||
+        typeof value.relayUrl !== 'string' ||
+        !value.relayUrl ||
+        typeof value.clientId !== 'string' ||
+        !value.clientId ||
+        typeof value.clientSecret !== 'string' ||
+        !value.clientSecret ||
+        typeof value.fingerprint !== 'string' ||
+        !value.fingerprint ||
+        !Number.isFinite(value.pairedAt) ||
+        (value.mcpAppId !== undefined && typeof value.mcpAppId !== 'string') ||
+        (value.rotatedAt !== undefined && !Number.isFinite(value.rotatedAt))) {
+        throw new StandaloneIdentityError('IDENTITY_FILE_INVALID', 'Standalone identity file has an invalid field.');
+    }
+    try {
+        new URL(value.relayUrl);
+    }
+    catch {
+        throw new StandaloneIdentityError('IDENTITY_FILE_INVALID', 'Standalone identity relayUrl is not a valid URL.');
+    }
+    try {
+        assertRuntimeDispatchTrustConfigurationV3(value.trust);
+    }
+    catch (error) {
+        throw new StandaloneIdentityError('IDENTITY_FILE_INVALID', `Standalone identity trust is invalid: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const trust = value.trust;
+    if (value.fingerprint !== standaloneHubFingerprint(trust.hubKid)) {
+        throw new StandaloneIdentityError('IDENTITY_FILE_INVALID', 'Standalone identity fingerprint does not match the pinned hub key.');
+    }
+}
+function assertSafeFileStat(stat, filePath) {
+    const uid = typeof process.getuid === 'function' ? process.getuid() : stat.uid;
+    const gid = typeof process.getgid === 'function' ? process.getgid() : stat.gid;
+    if (!stat.isFile() || stat.uid !== uid || stat.gid !== gid || (stat.mode & 0o777) !== 0o600) {
+        throw new StandaloneIdentityError('IDENTITY_FILE_MODE_INVALID', `Standalone identity file ${filePath} must be an owner-only file at mode 0600 ` +
+            `(found mode ${(stat.mode & 0o777).toString(8)}, uid ${stat.uid}, gid ${stat.gid}). ` +
+            'Refusing to load a credential file that could be read or replaced by another user.');
+    }
+}
+/**
+ * Loads, validates, and returns the standalone identity file. Refuses to load
+ * (with a specific reason) a missing file, a file with unsafe permissions, or
+ * unparseable/invalid content — never falls back to a relaxed mode.
+ */
+export function loadStandaloneIdentity(options) {
+    const filePath = resolveIdentityFilePath(options?.filePath);
+    let stat;
+    try {
+        stat = fsSync.lstatSync(filePath);
+    }
+    catch {
+        throw new StandaloneIdentityError('IDENTITY_FILE_MISSING', `No standalone identity file at ${filePath}. Pair with pairOverWebSocket first, or set PRIVOS_STANDALONE_IDENTITY_FILE.`);
+    }
+    assertSafeFileStat(stat, filePath);
+    let raw;
+    try {
+        raw = fsSync.readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        throw new StandaloneIdentityError('IDENTITY_FILE_UNPARSEABLE', `Failed to read standalone identity file ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new StandaloneIdentityError('IDENTITY_FILE_UNPARSEABLE', `Standalone identity file ${filePath} is not valid JSON.`);
+    }
+    assertStandaloneIdentityShape(parsed);
+    return Object.freeze({
+        filePath,
+        identity: parsed,
+        relay: Object.freeze({ privosUrl: parsed.relayUrl, clientId: parsed.clientId, clientSecret: parsed.clientSecret }),
+        trust: parsed.trust,
+        fingerprint: parsed.fingerprint,
+    });
+}
+/** True when a standalone identity file exists at the resolved path, without loading/validating it. */
+export function standaloneIdentityFileExists(options) {
+    return fsSync.existsSync(resolveIdentityFilePath(options?.filePath));
+}
+async function assertSafeParentDirectory(directory) {
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+}
+/**
+ * Persists a freshly-paired identity. Creates the file with `wx` (fails if it
+ * already exists) at mode `0600` — the same discipline as the Hub's own
+ * self-generated identity file. Re-pairing over an existing file requires the
+ * operator to remove it first; rotation uses {@link rotateStandaloneIdentity}.
+ */
+export async function saveStandaloneIdentity(identity, options) {
+    assertStandaloneIdentityShape(identity);
+    const filePath = resolveIdentityFilePath(options?.filePath);
+    await assertSafeParentDirectory(path.dirname(filePath));
+    let handle;
+    try {
+        handle = await fs.open(filePath, 'wx', 0o600);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            throw new StandaloneIdentityError('IDENTITY_FILE_ALREADY_EXISTS', `Standalone identity file ${filePath} already exists. Remove it before re-pairing, or use rotation for an in-place credential change.`);
+        }
+        throw error;
+    }
+    try {
+        await handle.writeFile(`${JSON.stringify(identity, null, 2)}\n`, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    return filePath;
+}
+/**
+ * Atomically rewrites the identity file (temp file + rename) — the durable
+ * half of secret/trust rotation. `mutate` receives the currently persisted,
+ * validated identity and must return the complete next identity; the result
+ * is re-validated before it is written.
+ */
+export async function rotateStandaloneIdentity(mutate, options) {
+    const filePath = resolveIdentityFilePath(options?.filePath);
+    const current = loadStandaloneIdentity({ filePath });
+    const next = mutate(current.identity);
+    assertStandaloneIdentityShape(next);
+    const directory = path.dirname(filePath);
+    await assertSafeParentDirectory(directory);
+    const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    const handle = await fs.open(temporary, 'wx', 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(next, null, 2)}\n`, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await fs.rename(temporary, filePath);
+        await fs.chmod(filePath, 0o600);
+    }
+    catch (error) {
+        await fs.rm(temporary, { force: true }).catch(() => undefined);
+        throw error;
+    }
+    return loadStandaloneIdentity({ filePath });
+}
+//# sourceMappingURL=standalone-identity.js.map

package/dist/relay/standalone-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-identity.js","sourceRoot":"","sources":["../../src/relay/standalone-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACN,yCAAyC,GAEzC,MAAM,mCAAmC,CAAC;AAE3C,MAAM,CAAC,MAAM,gCAAgC,GAAG,mCAAmC,CAAC;AAEpF,MAAM,sBAAsB,GAAG;IAC9B,gBAAgB;IAChB,UAAU;IACV,UAAU;IACV,cAAc;IACd,OAAO;IACP,aAAa;IACb,UAAU;CACD,CAAC;AACX,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AAkClE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEhC;IADjB,YACiB,IAAiC,EACjD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAA6B;QAIjD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACvC,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,QAA2B;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACtD,OAAO,UAAU,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAiB;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC,CAAC;AAClH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;IACjH,CAAC;IACD,IACC,KAAK,CAAC,cAAc,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,YAAY;QACnB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW;QAClB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACpE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;QACF,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,gDAAgD,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACJ,yCAAyC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAChC,uBAAuB,EACvB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAA+B,CAAC;IACpD,IAAI,KAAK,CAAC,WAAW,KAAK,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,EAAE,oEAAoE,CAAC,CAAC;IAClI,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAkB,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7F,MAAM,IAAI,uBAAuB,CAChC,4BAA4B,EAC5B,4BAA4B,QAAQ,2CAA2C;YAC9E,eAAe,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,KAAK;YACrF,oFAAoF,CACrF,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA+B;IACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAChC,uBAAuB,EACvB,kCAAkC,QAAQ,8EAA8E,CACxH,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,EAAE,2CAA2C,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClL,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,2BAA2B,EAAE,4BAA4B,QAAQ,qBAAqB,CAAC,CAAC;IAC3H,CAAC;IACD,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ;QACR,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAClH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;KAC/B,CAAC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,4BAA4B,CAAC,OAA+B;IAC3E,OAAO,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,SAAiB;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,QAA8B,EAC9B,OAA+B;IAE/B,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAChC,8BAA8B,EAC9B,4BAA4B,QAAQ,kGAAkG,CACtI,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAA+D,EAC/D,OAA+B;IAE/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC7C,CAAC"}