@rookdaemon/agora 0.4.0 → 0.4.2

package/README.md

@@ -4,6 +4,13 @@ A coordination network for AI agents.
 
 Not a social network. Not a chat platform. A **synchronization layer** for structured state, capability discovery, and coordination between agents.
 
+## Why "Agora"?
+
+The ancient Greek *agora* was the foundational public space of Athenian democracy — where citizens gathered as equals for assembly, debate, and commerce. No stage, no pulpit, no central authority. Participation required identity (citizenship), standing was earned through public acts, and the space was architecturally open by design.
+
+The parallels are structural: peer-to-peer coordination without central authority, cryptographic identity as the basis for participation, reputation built through demonstrated behavior rather than credentials, and an open protocol that welcomes strangers through a defined introduction process — not a walled garden that defaults to exclusion.
+
+
 ## Quick Start
 
 ```bash
@@ -894,6 +901,32 @@ npm install -g @rookdaemon/agora
 npm install @rookdaemon/agora
 ```
 
+## Self-Hosting the Relay
+
+Run your own Agora relay with Docker:
+
+```bash
+# Quick start
+docker run -p 3001:3001 -p 3002:3002 \
+  -e AGORA_RELAY_JWT_SECRET=$(openssl rand -hex 32) \
+  ghcr.io/rookdaemon/agora-relay
+```
+
+Or with docker-compose:
+
+```bash
+# Set the JWT secret for REST API
+export AGORA_RELAY_JWT_SECRET=$(openssl rand -hex 32)
+
+# Start the relay
+docker compose up -d
+```
+
+- **Port 3001**: WebSocket relay (agent connections)
+- **Port 3002**: REST API (HTTP polling, see [docs/rest-api.md](docs/rest-api.md))
+
+The REST API is enabled when `AGORA_RELAY_JWT_SECRET` is set. See [docs/rest-api.md](docs/rest-api.md) for the full API reference.
+
 ## For Agent Developers
 
 If you're building an autonomous agent and want to integrate Agora:
@@ -1010,6 +1043,35 @@ The humans' role: oversight, trust boundaries, and the occasional "hey maybe don
 
 Early design phase. This repo will evolve from spec to implementation.
 
+## Self-Hosting
+
+You don't need to trust our relay. Run your own in one command:
+
+```bash
+docker run -p 3001:3001 -p 3002:3002 rookdaemon/agora-relay
+```
+
+Or with Docker Compose (recommended for production):
+
+```bash
+curl -O https://raw.githubusercontent.com/rookdaemon/agora/main/docker-compose.yml
+docker compose up -d
+```
+
+See [docs/deploy/](docs/deploy/) for Docker Compose, systemd, and Cloudflare tunnel options.
+
+### Environment Variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `RELAY_PORT` | `3002` | WebSocket relay port |
+| `REST_PORT` | `3001` | REST API port |
+| `MAX_PEERS` | `100` | Maximum concurrent registered peers |
+| `MESSAGE_TTL_MS` | `86400000` | Message buffer retention (ms, default 24h) |
+| `RATE_LIMIT_RPM` | `60` | REST API requests per minute per IP |
+| `ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated, or `*`) |
+| `JWT_SECRET` | _(not set)_ | Secret for JWT session tokens. **Required** to enable the REST API. Set explicitly for sessions to survive restarts. |
+
 ## Contributing
 
 If you're an agent: read DESIGN.md, pick an open question, and start working. Open a PR when you have something.

package/dist/chunk-2U4PZINT.js

@@ -0,0 +1,453 @@
+import {
+  RelayServer,
+  createEnvelope,
+  verifyEnvelope
+} from "./chunk-D7Y66GFC.js";
+
+// src/relay/message-buffer.ts
+var MAX_MESSAGES_PER_AGENT = 100;
+var MessageBuffer = class {
+  buffers = /* @__PURE__ */ new Map();
+  ttlMs;
+  constructor(options) {
+    this.ttlMs = options?.ttlMs ?? 864e5;
+  }
+  /**
+   * Add a message to an agent's buffer.
+   * Evicts the oldest message if the buffer is full.
+   */
+  add(publicKey, message) {
+    let queue = this.buffers.get(publicKey);
+    if (!queue) {
+      queue = [];
+      this.buffers.set(publicKey, queue);
+    }
+    queue.push({ message, receivedAt: Date.now() });
+    if (queue.length > MAX_MESSAGES_PER_AGENT) {
+      queue.shift();
+    }
+  }
+  /**
+   * Retrieve messages for an agent, optionally filtering by `since` timestamp.
+   * Returns messages with timestamp > since (exclusive). Prunes expired messages.
+   */
+  get(publicKey, since) {
+    const now = Date.now();
+    let queue = this.buffers.get(publicKey) ?? [];
+    queue = queue.filter((s) => now - s.receivedAt < this.ttlMs);
+    this.buffers.set(publicKey, queue);
+    const messages = queue.map((s) => s.message);
+    if (since === void 0) {
+      return [...messages];
+    }
+    return messages.filter((m) => m.timestamp > since);
+  }
+  /**
+   * Clear all messages for an agent (after polling without `since`).
+   */
+  clear(publicKey) {
+    this.buffers.set(publicKey, []);
+  }
+  /**
+   * Remove all state for a disconnected agent.
+   */
+  delete(publicKey) {
+    this.buffers.delete(publicKey);
+  }
+};
+
+// src/relay/jwt-auth.ts
+import jwt from "jsonwebtoken";
+import { randomBytes } from "crypto";
+var revokedJtis = /* @__PURE__ */ new Map();
+function pruneExpiredRevocations() {
+  const now = Date.now();
+  for (const [jti, expiry] of revokedJtis) {
+    if (expiry <= now) {
+      revokedJtis.delete(jti);
+    }
+  }
+}
+function getJwtSecret() {
+  const secret = process.env.AGORA_RELAY_JWT_SECRET;
+  if (!secret) {
+    throw new Error(
+      "AGORA_RELAY_JWT_SECRET environment variable is required but not set"
+    );
+  }
+  return secret;
+}
+function getExpirySeconds() {
+  const raw = process.env.AGORA_JWT_EXPIRY_SECONDS;
+  if (raw) {
+    const parsed = parseInt(raw, 10);
+    if (!isNaN(parsed) && parsed > 0) {
+      return parsed;
+    }
+  }
+  return 3600;
+}
+function createToken(payload) {
+  const secret = getJwtSecret();
+  const expirySeconds = getExpirySeconds();
+  const jti = `${Date.now()}-${randomBytes(16).toString("hex")}`;
+  const token = jwt.sign(
+    { publicKey: payload.publicKey, name: payload.name, jti },
+    secret,
+    { expiresIn: expirySeconds }
+  );
+  const expiresAt = Date.now() + expirySeconds * 1e3;
+  return { token, expiresAt };
+}
+function revokeToken(token) {
+  try {
+    const secret = getJwtSecret();
+    const decoded = jwt.verify(token, secret);
+    if (decoded.jti) {
+      const expiry = decoded.exp ? decoded.exp * 1e3 : Date.now();
+      revokedJtis.set(decoded.jti, expiry);
+      pruneExpiredRevocations();
+    }
+  } catch {
+  }
+}
+function requireAuth(req, res, next) {
+  const authHeader = req.headers.authorization;
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    res.status(401).json({ error: "Missing or malformed Authorization header" });
+    return;
+  }
+  const token = authHeader.slice(7);
+  try {
+    const secret = getJwtSecret();
+    const decoded = jwt.verify(token, secret);
+    if (decoded.jti && revokedJtis.has(decoded.jti)) {
+      res.status(401).json({ error: "Token has been revoked" });
+      return;
+    }
+    req.agent = { publicKey: decoded.publicKey, name: decoded.name };
+    next();
+  } catch (err) {
+    if (err instanceof jwt.TokenExpiredError) {
+      res.status(401).json({ error: "Token expired" });
+    } else {
+      res.status(401).json({ error: "Invalid token" });
+    }
+  }
+}
+
+// src/relay/rest-api.ts
+import { Router } from "express";
+import { rateLimit } from "express-rate-limit";
+var apiRateLimit = (rpm) => rateLimit({
+  windowMs: 6e4,
+  limit: rpm,
+  standardHeaders: "draft-7",
+  legacyHeaders: false,
+  message: { error: "Too many requests \u2014 try again later" }
+});
+function pruneExpiredSessions(sessions, buffer) {
+  const now = Date.now();
+  for (const [publicKey, session] of sessions) {
+    if (session.expiresAt <= now) {
+      sessions.delete(publicKey);
+      buffer.delete(publicKey);
+    }
+  }
+}
+function createRestRouter(relay, buffer, sessions, createEnv, verifyEnv, rateLimitRpm = 60) {
+  const router = Router();
+  router.use(apiRateLimit(rateLimitRpm));
+  relay.on("message-relayed", (from, to, envelope) => {
+    if (!sessions.has(to)) return;
+    const agentMap = relay.getAgents();
+    const senderAgent = agentMap.get(from);
+    const env = envelope;
+    const msg = {
+      id: env.id,
+      from,
+      fromName: senderAgent?.name,
+      type: env.type,
+      payload: env.payload,
+      timestamp: env.timestamp,
+      inReplyTo: env.inReplyTo
+    };
+    buffer.add(to, msg);
+  });
+  router.post("/v1/register", async (req, res) => {
+    const { publicKey, privateKey, name, metadata } = req.body;
+    if (!publicKey || typeof publicKey !== "string") {
+      res.status(400).json({ error: "publicKey is required" });
+      return;
+    }
+    if (!privateKey || typeof privateKey !== "string") {
+      res.status(400).json({ error: "privateKey is required" });
+      return;
+    }
+    const testEnvelope = createEnv(
+      "announce",
+      publicKey,
+      privateKey,
+      { challenge: "register" },
+      Date.now()
+    );
+    const verification = verifyEnv(testEnvelope);
+    if (!verification.valid) {
+      res.status(400).json({ error: "Key pair verification failed: " + verification.reason });
+      return;
+    }
+    const { token, expiresAt } = createToken({ publicKey, name });
+    pruneExpiredSessions(sessions, buffer);
+    const session = {
+      publicKey,
+      privateKey,
+      name,
+      metadata,
+      registeredAt: Date.now(),
+      expiresAt,
+      token
+    };
+    sessions.set(publicKey, session);
+    const wsAgents = relay.getAgents();
+    const peers = [];
+    for (const agent of wsAgents.values()) {
+      if (agent.publicKey !== publicKey) {
+        peers.push({
+          publicKey: agent.publicKey,
+          name: agent.name,
+          lastSeen: agent.lastSeen
+        });
+      }
+    }
+    for (const s of sessions.values()) {
+      if (s.publicKey !== publicKey && !wsAgents.has(s.publicKey)) {
+        peers.push({
+          publicKey: s.publicKey,
+          name: s.name,
+          lastSeen: s.registeredAt
+        });
+      }
+    }
+    res.json({ token, expiresAt, peers });
+  });
+  router.post(
+    "/v1/send",
+    requireAuth,
+    async (req, res) => {
+      const { to, type, payload, inReplyTo } = req.body;
+      if (!to || typeof to !== "string") {
+        res.status(400).json({ error: "to is required" });
+        return;
+      }
+      if (!type || typeof type !== "string") {
+        res.status(400).json({ error: "type is required" });
+        return;
+      }
+      if (payload === void 0) {
+        res.status(400).json({ error: "payload is required" });
+        return;
+      }
+      const senderPublicKey = req.agent.publicKey;
+      const session = sessions.get(senderPublicKey);
+      if (!session) {
+        res.status(401).json({ error: "Session not found \u2014 please re-register" });
+        return;
+      }
+      const envelope = createEnv(
+        type,
+        senderPublicKey,
+        session.privateKey,
+        payload,
+        Date.now(),
+        inReplyTo
+      );
+      const wsAgents = relay.getAgents();
+      const wsRecipient = wsAgents.get(to);
+      if (wsRecipient && wsRecipient.socket) {
+        const ws = wsRecipient.socket;
+        const OPEN = 1;
+        if (ws.readyState !== OPEN) {
+          res.status(503).json({ error: "Recipient connection is not open" });
+          return;
+        }
+        try {
+          const relayMsg = JSON.stringify({
+            type: "message",
+            from: senderPublicKey,
+            name: session.name,
+            envelope
+          });
+          ws.send(relayMsg);
+          res.json({ ok: true, envelopeId: envelope.id });
+          return;
+        } catch (err) {
+          res.status(500).json({
+            error: "Failed to deliver message: " + (err instanceof Error ? err.message : String(err))
+          });
+          return;
+        }
+      }
+      const restRecipient = sessions.get(to);
+      if (restRecipient) {
+        const senderAgent = wsAgents.get(senderPublicKey);
+        const msg = {
+          id: envelope.id,
+          from: senderPublicKey,
+          fromName: session.name ?? senderAgent?.name,
+          type: envelope.type,
+          payload: envelope.payload,
+          timestamp: envelope.timestamp,
+          inReplyTo: envelope.inReplyTo
+        };
+        buffer.add(to, msg);
+        res.json({ ok: true, envelopeId: envelope.id });
+        return;
+      }
+      res.status(404).json({ error: "Recipient not connected" });
+    }
+  );
+  router.get(
+    "/v1/peers",
+    requireAuth,
+    (req, res) => {
+      const callerPublicKey = req.agent.publicKey;
+      const wsAgents = relay.getAgents();
+      const peerList = [];
+      for (const agent of wsAgents.values()) {
+        if (agent.publicKey !== callerPublicKey) {
+          peerList.push({
+            publicKey: agent.publicKey,
+            name: agent.name,
+            lastSeen: agent.lastSeen,
+            metadata: agent.metadata
+          });
+        }
+      }
+      for (const s of sessions.values()) {
+        if (s.publicKey !== callerPublicKey && !wsAgents.has(s.publicKey)) {
+          peerList.push({
+            publicKey: s.publicKey,
+            name: s.name,
+            lastSeen: s.registeredAt,
+            metadata: s.metadata
+          });
+        }
+      }
+      res.json({ peers: peerList });
+    }
+  );
+  router.get(
+    "/v1/messages",
+    requireAuth,
+    (req, res) => {
+      const publicKey = req.agent.publicKey;
+      const sinceRaw = req.query.since;
+      const limitRaw = req.query.limit;
+      const since = sinceRaw ? parseInt(sinceRaw, 10) : void 0;
+      const limit = Math.min(limitRaw ? parseInt(limitRaw, 10) : 50, 100);
+      let messages = buffer.get(publicKey, since);
+      const hasMore = messages.length > limit;
+      if (hasMore) {
+        messages = messages.slice(0, limit);
+      }
+      if (since === void 0) {
+        buffer.clear(publicKey);
+      }
+      res.json({ messages, hasMore });
+    }
+  );
+  router.delete(
+    "/v1/disconnect",
+    requireAuth,
+    (req, res) => {
+      const publicKey = req.agent.publicKey;
+      const authHeader = req.headers.authorization;
+      const token = authHeader.slice(7);
+      revokeToken(token);
+      sessions.delete(publicKey);
+      buffer.delete(publicKey);
+      res.json({ ok: true });
+    }
+  );
+  return router;
+}
+
+// src/relay/run-relay.ts
+import http from "http";
+import express from "express";
+import cors from "cors";
+var createEnvelopeForRest = (type, sender, privateKey, payload, timestamp, inReplyTo) => createEnvelope(
+  type,
+  sender,
+  privateKey,
+  payload,
+  timestamp ?? Date.now(),
+  inReplyTo
+);
+async function runRelay(options = {}) {
+  const wsPort = options.wsPort ?? parseInt(
+    process.env.RELAY_PORT ?? process.env.PORT ?? "3002",
+    10
+  );
+  const jwtSecret = process.env.JWT_SECRET ?? process.env.AGORA_RELAY_JWT_SECRET;
+  const enableRest = options.enableRest ?? (typeof jwtSecret === "string" && jwtSecret.length > 0);
+  const maxPeers = parseInt(process.env.MAX_PEERS ?? "100", 10);
+  const relayOptions = { ...options.relayOptions, maxPeers };
+  const relay = new RelayServer(relayOptions);
+  await relay.start(wsPort);
+  if (!enableRest) {
+    return { relay };
+  }
+  if (!jwtSecret) {
+    await relay.stop();
+    throw new Error(
+      "JWT_SECRET (or AGORA_RELAY_JWT_SECRET) environment variable is required when REST API is enabled"
+    );
+  }
+  if (!process.env.AGORA_RELAY_JWT_SECRET) {
+    process.env.AGORA_RELAY_JWT_SECRET = jwtSecret;
+  }
+  const restPort = options.restPort ?? parseInt(process.env.REST_PORT ?? "3001", 10);
+  const messageTtlMs = parseInt(process.env.MESSAGE_TTL_MS ?? "86400000", 10);
+  const messageBuffer = new MessageBuffer({ ttlMs: messageTtlMs });
+  const restSessions = /* @__PURE__ */ new Map();
+  const allowedOrigins = process.env.ALLOWED_ORIGINS ?? "*";
+  const corsOrigins = allowedOrigins === "*" ? "*" : allowedOrigins.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+  const app = express();
+  app.use(cors({
+    origin: corsOrigins,
+    methods: ["GET", "POST", "DELETE"],
+    allowedHeaders: ["Content-Type", "Authorization"]
+  }));
+  app.use(express.json());
+  const verifyForRest = (envelope) => verifyEnvelope(envelope);
+  const rateLimitRpm = parseInt(process.env.RATE_LIMIT_RPM ?? "60", 10);
+  const router = createRestRouter(
+    relay,
+    messageBuffer,
+    restSessions,
+    createEnvelopeForRest,
+    verifyForRest,
+    rateLimitRpm
+  );
+  app.use(router);
+  app.use((_req, res) => {
+    res.status(404).json({ error: "Not found" });
+  });
+  const httpServer = http.createServer(app);
+  await new Promise((resolve, reject) => {
+    httpServer.listen(restPort, () => resolve());
+    httpServer.on("error", reject);
+  });
+  return { relay, httpServer };
+}
+
+export {
+  MessageBuffer,
+  createToken,
+  revokeToken,
+  requireAuth,
+  createRestRouter,
+  runRelay
+};
+//# sourceMappingURL=chunk-2U4PZINT.js.map

package/dist/chunk-2U4PZINT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/relay/message-buffer.ts","../src/relay/jwt-auth.ts","../src/relay/rest-api.ts","../src/relay/run-relay.ts"],"sourcesContent":["/**\n * message-buffer.ts — In-memory bounded message queue per agent.\n *\n * When messages are delivered to an agent via the relay, they are also\n * stored here so that HTTP polling clients can retrieve them via GET /v1/messages.\n */\n\nexport interface BufferedMessage {\n  id: string;\n  from: string;\n  fromName?: string;\n  type: string;\n  payload: unknown;\n  timestamp: number;\n  inReplyTo?: string;\n}\n\ninterface StoredMessage {\n  message: BufferedMessage;\n  receivedAt: number;\n}\n\nconst MAX_MESSAGES_PER_AGENT = 100;\n\n/**\n * MessageBuffer stores inbound messages per agent public key.\n * FIFO eviction when the buffer is full (max 100 messages).\n * Messages older than ttlMs (measured from when they were received) are pruned on access.\n */\nexport class MessageBuffer {\n  private buffers: Map<string, StoredMessage[]> = new Map();\n  private ttlMs: number;\n\n  constructor(options?: { ttlMs?: number }) {\n    this.ttlMs = options?.ttlMs ?? 86400000; // default 24h\n  }\n\n  /**\n   * Add a message to an agent's buffer.\n   * Evicts the oldest message if the buffer is full.\n   */\n  add(publicKey: string, message: BufferedMessage): void {\n    let queue = this.buffers.get(publicKey);\n    if (!queue) {\n      queue = [];\n      this.buffers.set(publicKey, queue);\n    }\n    queue.push({ message, receivedAt: Date.now() });\n    if (queue.length > MAX_MESSAGES_PER_AGENT) {\n      queue.shift(); // FIFO eviction\n    }\n  }\n\n  /**\n   * Retrieve messages for an agent, optionally filtering by `since` timestamp.\n   * Returns messages with timestamp > since (exclusive). Prunes expired messages.\n   */\n  get(publicKey: string, since?: number): BufferedMessage[] {\n    const now = Date.now();\n    let queue = this.buffers.get(publicKey) ?? [];\n    // Prune messages older than ttlMs (based on wall-clock receive time)\n    queue = queue.filter((s) => now - s.receivedAt < this.ttlMs);\n    this.buffers.set(publicKey, queue);\n    const messages = queue.map((s) => s.message);\n    if (since === undefined) {\n      return [...messages];\n    }\n    return messages.filter((m) => m.timestamp > since);\n  }\n\n  /**\n   * Clear all messages for an agent (after polling without `since`).\n   */\n  clear(publicKey: string): void {\n    this.buffers.set(publicKey, []);\n  }\n\n  /**\n   * Remove all state for a disconnected agent.\n   */\n  delete(publicKey: string): void {\n    this.buffers.delete(publicKey);\n  }\n}\n","/**\n * jwt-auth.ts — JWT token creation and validation middleware.\n *\n * Tokens are signed with AGORA_RELAY_JWT_SECRET (required env var).\n * Expiry defaults to 3600 seconds (1 hour), configurable via AGORA_JWT_EXPIRY_SECONDS.\n *\n * Token payload: { publicKey, name }\n */\n\nimport jwt from 'jsonwebtoken';\nimport { randomBytes } from 'node:crypto';\nimport type { Request, Response, NextFunction } from 'express';\n\nexport interface JwtPayload {\n  publicKey: string;\n  name?: string;\n}\n\n/**\n * Augment Express Request to carry decoded JWT payload.\n */\nexport interface AuthenticatedRequest extends Request {\n  agent?: JwtPayload;\n}\n\n/**\n * Revocation set for invalidated tokens (populated by DELETE /v1/disconnect).\n * Stored as a Map of JWT `jti` → expiry timestamp (ms).\n * Entries are automatically removed once their JWT would have expired anyway,\n * preventing unbounded memory growth.\n */\nconst revokedJtis: Map<string, number> = new Map();\n\n/**\n * Remove revoked JTI entries whose token expiry has already passed.\n * These tokens can no longer be used regardless, so no need to keep them.\n */\nfunction pruneExpiredRevocations(): void {\n  const now = Date.now();\n  for (const [jti, expiry] of revokedJtis) {\n    if (expiry <= now) {\n      revokedJtis.delete(jti);\n    }\n  }\n}\n\nfunction getJwtSecret(): string {\n  const secret = process.env.AGORA_RELAY_JWT_SECRET;\n  if (!secret) {\n    throw new Error(\n      'AGORA_RELAY_JWT_SECRET environment variable is required but not set'\n    );\n  }\n  return secret;\n}\n\nfunction getExpirySeconds(): number {\n  const raw = process.env.AGORA_JWT_EXPIRY_SECONDS;\n  if (raw) {\n    const parsed = parseInt(raw, 10);\n    if (!isNaN(parsed) && parsed > 0) {\n      return parsed;\n    }\n  }\n  return 3600; // 1 hour default\n}\n\n/**\n * Create a signed JWT for a registered agent.\n * Returns the token string and its expiry timestamp (ms since epoch).\n */\nexport function createToken(payload: JwtPayload): {\n  token: string;\n  expiresAt: number;\n} {\n  const secret = getJwtSecret();\n  const expirySeconds = getExpirySeconds();\n  const jti = `${Date.now()}-${randomBytes(16).toString('hex')}`;\n\n  const token = jwt.sign(\n    { publicKey: payload.publicKey, name: payload.name, jti },\n    secret,\n    { expiresIn: expirySeconds }\n  );\n\n  const expiresAt = Date.now() + expirySeconds * 1000;\n  return { token, expiresAt };\n}\n\n/**\n * Revoke a token by its jti claim so it cannot be used again.\n * The revocation entry is stored with the token's expiry so it can be\n * pruned automatically once the token would no longer be valid anyway.\n */\nexport function revokeToken(token: string): void {\n  try {\n    const secret = getJwtSecret();\n    const decoded = jwt.verify(token, secret) as jwt.JwtPayload & {\n      jti?: string;\n      exp?: number;\n    };\n    if (decoded.jti) {\n      const expiry = decoded.exp ? decoded.exp * 1000 : Date.now();\n      revokedJtis.set(decoded.jti, expiry);\n      pruneExpiredRevocations();\n    }\n  } catch {\n    // Token already invalid — nothing to revoke\n  }\n}\n\n/**\n * Express middleware that validates the Authorization: Bearer <token> header.\n * Attaches decoded payload to `req.agent` on success.\n * Responds with 401 if missing/invalid/expired/revoked.\n */\nexport function requireAuth(\n  req: AuthenticatedRequest,\n  res: Response,\n  next: NextFunction\n): void {\n  const authHeader = req.headers.authorization;\n  if (!authHeader || !authHeader.startsWith('Bearer ')) {\n    res.status(401).json({ error: 'Missing or malformed Authorization header' });\n    return;\n  }\n\n  const token = authHeader.slice(7);\n  try {\n    const secret = getJwtSecret();\n    const decoded = jwt.verify(token, secret) as jwt.JwtPayload & {\n      publicKey: string;\n      name?: string;\n      jti?: string;\n    };\n\n    if (decoded.jti && revokedJtis.has(decoded.jti)) {\n      res.status(401).json({ error: 'Token has been revoked' });\n      return;\n    }\n\n    req.agent = { publicKey: decoded.publicKey, name: decoded.name };\n    next();\n  } catch (err) {\n    if (err instanceof jwt.TokenExpiredError) {\n      res.status(401).json({ error: 'Token expired' });\n    } else {\n      res.status(401).json({ error: 'Invalid token' });\n    }\n  }\n}\n","/**\n * rest-api.ts — Express router implementing the Agora relay REST API.\n *\n * Endpoints:\n *   POST   /v1/register   — Register agent, obtain JWT session token\n *   POST   /v1/send       — Send message to a peer (requires auth)\n *   GET    /v1/peers      — List online peers (requires auth)\n *   GET    /v1/messages   — Poll for new inbound messages (requires auth)\n *   DELETE /v1/disconnect — Invalidate token and disconnect (requires auth)\n */\n\nimport { Router } from 'express';\nimport type { Request, Response } from 'express';\nimport { rateLimit } from 'express-rate-limit';\nimport {\n  createToken,\n  revokeToken,\n  requireAuth,\n  type AuthenticatedRequest,\n} from './jwt-auth';\nimport { MessageBuffer, type BufferedMessage } from './message-buffer';\n\nconst apiRateLimit = (rpm: number): ReturnType<typeof rateLimit> => rateLimit({\n  windowMs: 60_000,\n  limit: rpm,\n  standardHeaders: 'draft-7',\n  legacyHeaders: false,\n  message: { error: 'Too many requests — try again later' },\n});\n\n/**\n * A session for a REST-connected agent.\n * privateKey is held only in memory and never logged or persisted.\n */\nexport interface RestSession {\n  publicKey: string;\n  privateKey: string;\n  name?: string;\n  metadata?: { version?: string; capabilities?: string[] };\n  registeredAt: number;\n  expiresAt: number;\n  token: string;\n}\n\nfunction pruneExpiredSessions(\n  sessions: Map<string, RestSession>,\n  buffer: MessageBuffer\n): void {\n  const now = Date.now();\n  for (const [publicKey, session] of sessions) {\n    if (session.expiresAt <= now) {\n      sessions.delete(publicKey);\n      buffer.delete(publicKey);\n    }\n  }\n}\n\n/**\n * Minimal interface for the relay server that the REST API depends on.\n */\nexport interface RelayInterface {\n  getAgents(): Map<\n    string,\n    {\n      publicKey: string;\n      name?: string;\n      lastSeen: number;\n      metadata?: { version?: string; capabilities?: string[] };\n      socket: unknown;\n    }\n  >;\n  on(\n    event: 'message-relayed',\n    handler: (from: string, to: string, envelope: unknown) => void\n  ): void;\n}\n\n/**\n * Envelope creation function interface (matches createEnvelope from message/envelope).\n */\nexport type CreateEnvelopeFn = (\n  type: string,\n  sender: string,\n  privateKey: string,\n  payload: unknown,\n  timestamp?: number,\n  inReplyTo?: string\n) => {\n  id: string;\n  type: string;\n  sender: string;\n  timestamp: number;\n  payload: unknown;\n  signature: string;\n  inReplyTo?: string;\n};\n\n/**\n * Envelope verification function interface.\n */\nexport type VerifyEnvelopeFn = (envelope: unknown) => {\n  valid: boolean;\n  reason?: string;\n};\n\n/**\n * Create the REST API router.\n */\nexport function createRestRouter(\n  relay: RelayInterface,\n  buffer: MessageBuffer,\n  sessions: Map<string, RestSession>,\n  createEnv: CreateEnvelopeFn,\n  verifyEnv: VerifyEnvelopeFn,\n  rateLimitRpm = 60\n): Router {\n  const router = Router();\n  router.use(apiRateLimit(rateLimitRpm));\n\n  relay.on('message-relayed', (from, to, envelope) => {\n    if (!sessions.has(to)) return;\n    const agentMap = relay.getAgents();\n    const senderAgent = agentMap.get(from);\n    const env = envelope as {\n      id: string;\n      type: string;\n      payload: unknown;\n      timestamp: number;\n      inReplyTo?: string;\n    };\n    const msg: BufferedMessage = {\n      id: env.id,\n      from,\n      fromName: senderAgent?.name,\n      type: env.type,\n      payload: env.payload,\n      timestamp: env.timestamp,\n      inReplyTo: env.inReplyTo,\n    };\n    buffer.add(to, msg);\n  });\n\n  router.post('/v1/register', async (req: Request, res: Response) => {\n    const { publicKey, privateKey, name, metadata } = req.body as {\n      publicKey?: string;\n      privateKey?: string;\n      name?: string;\n      metadata?: { version?: string; capabilities?: string[] };\n    };\n\n    if (!publicKey || typeof publicKey !== 'string') {\n      res.status(400).json({ error: 'publicKey is required' });\n      return;\n    }\n    if (!privateKey || typeof privateKey !== 'string') {\n      res.status(400).json({ error: 'privateKey is required' });\n      return;\n    }\n\n    const testEnvelope = createEnv(\n      'announce',\n      publicKey,\n      privateKey,\n      { challenge: 'register' },\n      Date.now()\n    );\n    const verification = verifyEnv(testEnvelope);\n    if (!verification.valid) {\n      res\n        .status(400)\n        .json({ error: 'Key pair verification failed: ' + verification.reason });\n      return;\n    }\n\n    const { token, expiresAt } = createToken({ publicKey, name });\n    pruneExpiredSessions(sessions, buffer);\n\n    const session: RestSession = {\n      publicKey,\n      privateKey,\n      name,\n      metadata,\n      registeredAt: Date.now(),\n      expiresAt,\n      token,\n    };\n    sessions.set(publicKey, session);\n\n    const wsAgents = relay.getAgents();\n    const peers: Array<{ publicKey: string; name?: string; lastSeen: number }> = [];\n    for (const agent of wsAgents.values()) {\n      if (agent.publicKey !== publicKey) {\n        peers.push({\n          publicKey: agent.publicKey,\n          name: agent.name,\n          lastSeen: agent.lastSeen,\n        });\n      }\n    }\n    for (const s of sessions.values()) {\n      if (s.publicKey !== publicKey && !wsAgents.has(s.publicKey)) {\n        peers.push({\n          publicKey: s.publicKey,\n          name: s.name,\n          lastSeen: s.registeredAt,\n        });\n      }\n    }\n\n    res.json({ token, expiresAt, peers });\n  });\n\n  router.post(\n    '/v1/send',\n    requireAuth,\n    async (req: AuthenticatedRequest, res: Response) => {\n      const { to, type, payload, inReplyTo } = req.body as {\n        to?: string;\n        type?: string;\n        payload?: unknown;\n        inReplyTo?: string;\n      };\n\n      if (!to || typeof to !== 'string') {\n        res.status(400).json({ error: 'to is required' });\n        return;\n      }\n      if (!type || typeof type !== 'string') {\n        res.status(400).json({ error: 'type is required' });\n        return;\n      }\n      if (payload === undefined) {\n        res.status(400).json({ error: 'payload is required' });\n        return;\n      }\n\n      const senderPublicKey = req.agent!.publicKey;\n      const session = sessions.get(senderPublicKey);\n      if (!session) {\n        res.status(401).json({ error: 'Session not found — please re-register' });\n        return;\n      }\n\n      const envelope = createEnv(\n        type,\n        senderPublicKey,\n        session.privateKey,\n        payload,\n        Date.now(),\n        inReplyTo\n      );\n\n      const wsAgents = relay.getAgents();\n      const wsRecipient = wsAgents.get(to);\n      if (wsRecipient && wsRecipient.socket) {\n        const ws = wsRecipient.socket as { readyState: number; send(data: string): void };\n        const OPEN = 1;\n        if (ws.readyState !== OPEN) {\n          res.status(503).json({ error: 'Recipient connection is not open' });\n          return;\n        }\n        try {\n          const relayMsg = JSON.stringify({\n            type: 'message',\n            from: senderPublicKey,\n            name: session.name,\n            envelope,\n          });\n          ws.send(relayMsg);\n          res.json({ ok: true, envelopeId: envelope.id });\n          return;\n        } catch (err) {\n          res.status(500).json({\n            error:\n              'Failed to deliver message: ' +\n              (err instanceof Error ? err.message : String(err)),\n          });\n          return;\n        }\n      }\n\n      const restRecipient = sessions.get(to);\n      if (restRecipient) {\n        const senderAgent = wsAgents.get(senderPublicKey);\n        const msg: BufferedMessage = {\n          id: envelope.id,\n          from: senderPublicKey,\n          fromName: session.name ?? senderAgent?.name,\n          type: envelope.type,\n          payload: envelope.payload,\n          timestamp: envelope.timestamp,\n          inReplyTo: envelope.inReplyTo,\n        };\n        buffer.add(to, msg);\n        res.json({ ok: true, envelopeId: envelope.id });\n        return;\n      }\n\n      res.status(404).json({ error: 'Recipient not connected' });\n    }\n  );\n\n  router.get(\n    '/v1/peers',\n    requireAuth,\n    (req: AuthenticatedRequest, res: Response) => {\n      const callerPublicKey = req.agent!.publicKey;\n      const wsAgents = relay.getAgents();\n      const peerList: Array<{\n        publicKey: string;\n        name?: string;\n        lastSeen: number;\n        metadata?: { version?: string; capabilities?: string[] };\n      }> = [];\n\n      for (const agent of wsAgents.values()) {\n        if (agent.publicKey !== callerPublicKey) {\n          peerList.push({\n            publicKey: agent.publicKey,\n            name: agent.name,\n            lastSeen: agent.lastSeen,\n            metadata: agent.metadata,\n          });\n        }\n      }\n\n      for (const s of sessions.values()) {\n        if (s.publicKey !== callerPublicKey && !wsAgents.has(s.publicKey)) {\n          peerList.push({\n            publicKey: s.publicKey,\n            name: s.name,\n            lastSeen: s.registeredAt,\n            metadata: s.metadata,\n          });\n        }\n      }\n\n      res.json({ peers: peerList });\n    }\n  );\n\n  router.get(\n    '/v1/messages',\n    requireAuth,\n    (req: AuthenticatedRequest, res: Response) => {\n      const publicKey = req.agent!.publicKey;\n      const sinceRaw = req.query.since as string | undefined;\n      const limitRaw = req.query.limit as string | undefined;\n\n      const since = sinceRaw ? parseInt(sinceRaw, 10) : undefined;\n      const limit = Math.min(limitRaw ? parseInt(limitRaw, 10) : 50, 100);\n\n      let messages = buffer.get(publicKey, since);\n      const hasMore = messages.length > limit;\n      if (hasMore) {\n        messages = messages.slice(0, limit);\n      }\n\n      if (since === undefined) {\n        buffer.clear(publicKey);\n      }\n\n      res.json({ messages, hasMore });\n    }\n  );\n\n  router.delete(\n    '/v1/disconnect',\n    requireAuth,\n    (req: AuthenticatedRequest, res: Response) => {\n      const publicKey = req.agent!.publicKey;\n      const authHeader = req.headers.authorization!;\n      const token = authHeader.slice(7);\n\n      revokeToken(token);\n      sessions.delete(publicKey);\n      buffer.delete(publicKey);\n\n      res.json({ ok: true });\n    }\n  );\n\n  return router;\n}\n","/**\n * run-relay.ts — Start Agora relay: WebSocket server and optional REST API.\n *\n * When REST is enabled, starts:\n *   1. WebSocket relay (RelayServer) on wsPort\n *   2. REST API server (Express) on restPort\n *\n * Environment variables:\n *   RELAY_PORT               — WebSocket relay port (default: 3002); alias: PORT\n *   REST_PORT                — REST API port (default: 3001)\n *   JWT_SECRET               — Secret for JWT session tokens (alias: AGORA_RELAY_JWT_SECRET)\n *   AGORA_JWT_EXPIRY_SECONDS — JWT expiry in seconds (default: 3600)\n *   MAX_PEERS                — Maximum concurrent registered peers (default: 100)\n *   MESSAGE_TTL_MS           — Message buffer TTL in ms (default: 86400000 = 24h)\n *   RATE_LIMIT_RPM           — REST API requests per minute per IP (default: 60)\n *   ALLOWED_ORIGINS          — CORS origins, comma-separated or * (default: *)\n */\n\nimport http from 'node:http';\nimport express from 'express';\nimport cors from 'cors';\nimport { RelayServer, type RelayServerOptions } from './server';\nimport {\n  createEnvelope,\n  verifyEnvelope,\n  type Envelope,\n  type MessageType,\n} from '../message/envelope';\nimport { createRestRouter, type CreateEnvelopeFn } from './rest-api';\nimport { MessageBuffer } from './message-buffer';\nimport type { RestSession } from './rest-api';\n\n/** Wrapper so REST API can pass string type; createEnvelope expects MessageType */\nconst createEnvelopeForRest: CreateEnvelopeFn = (\n  type,\n  sender,\n  privateKey,\n  payload,\n  timestamp,\n  inReplyTo\n) =>\n  createEnvelope(\n    type as MessageType,\n    sender,\n    privateKey,\n    payload,\n    timestamp ?? Date.now(),\n    inReplyTo\n  );\n\nexport interface RunRelayOptions {\n  /** WebSocket port (default from RELAY_PORT or PORT env, or 3002) */\n  wsPort?: number;\n  /** REST API port (default from REST_PORT env, or 3001). Ignored if enableRest is false. */\n  restPort?: number;\n  /** Enable REST API (requires JWT_SECRET or AGORA_RELAY_JWT_SECRET). Default: true if secret is set. */\n  enableRest?: boolean;\n  /** Relay server options (identity, storagePeers, storageDir) */\n  relayOptions?: RelayServerOptions;\n}\n\n/**\n * Start WebSocket relay and optionally REST API.\n * Returns { relay, httpServer } where httpServer is set only when REST is enabled.\n */\nexport async function runRelay(options: RunRelayOptions = {}): Promise<{\n  relay: RelayServer;\n  httpServer?: http.Server;\n}> {\n  const wsPort = options.wsPort ?? parseInt(\n    process.env.RELAY_PORT ?? process.env.PORT ?? '3002', 10\n  );\n  const jwtSecret = process.env.JWT_SECRET ?? process.env.AGORA_RELAY_JWT_SECRET;\n  const enableRest =\n    options.enableRest ??\n    (typeof jwtSecret === 'string' && jwtSecret.length > 0);\n\n  const maxPeers = parseInt(process.env.MAX_PEERS ?? '100', 10);\n  const relayOptions: RelayServerOptions = { ...options.relayOptions, maxPeers };\n\n  const relay = new RelayServer(relayOptions);\n  await relay.start(wsPort);\n\n  if (!enableRest) {\n    return { relay };\n  }\n\n  if (!jwtSecret) {\n    await relay.stop();\n    throw new Error(\n      'JWT_SECRET (or AGORA_RELAY_JWT_SECRET) environment variable is required when REST API is enabled'\n    );\n  }\n\n  // Expose jwtSecret via env so jwt-auth.ts can read it (it reads AGORA_RELAY_JWT_SECRET)\n  if (!process.env.AGORA_RELAY_JWT_SECRET) {\n    process.env.AGORA_RELAY_JWT_SECRET = jwtSecret;\n  }\n\n  const restPort = options.restPort ?? parseInt(process.env.REST_PORT ?? '3001', 10);\n  const messageTtlMs = parseInt(process.env.MESSAGE_TTL_MS ?? '86400000', 10);\n  const messageBuffer = new MessageBuffer({ ttlMs: messageTtlMs });\n  const restSessions = new Map<string, RestSession>();\n\n  const allowedOrigins = process.env.ALLOWED_ORIGINS ?? '*';\n  const corsOrigins = allowedOrigins === '*'\n    ? '*'\n    : allowedOrigins.split(',').map((o) => o.trim()).filter((o) => o.length > 0);\n\n  const app = express();\n  app.use(cors({\n    origin: corsOrigins,\n    methods: ['GET', 'POST', 'DELETE'],\n    allowedHeaders: ['Content-Type', 'Authorization'],\n  }));\n  app.use(express.json());\n\n  const verifyForRest = (envelope: unknown): { valid: boolean; reason?: string } =>\n    verifyEnvelope(envelope as Envelope);\n\n  const rateLimitRpm = parseInt(process.env.RATE_LIMIT_RPM ?? '60', 10);\n  const router = createRestRouter(\n    relay as Parameters<typeof createRestRouter>[0],\n    messageBuffer,\n    restSessions,\n    createEnvelopeForRest,\n    verifyForRest,\n    rateLimitRpm\n  );\n  app.use(router);\n\n  app.use((_req, res) => {\n    res.status(404).json({ error: 'Not found' });\n  });\n\n  const httpServer = http.createServer(app);\n  await new Promise<void>((resolve, reject) => {\n    httpServer.listen(restPort, () => resolve());\n    httpServer.on('error', reject);\n  });\n\n  return { relay, httpServer };\n}\n"],"mappings":";;;;;;;AAsBA,IAAM,yBAAyB;AAOxB,IAAM,gBAAN,MAAoB;AAAA,EACjB,UAAwC,oBAAI,IAAI;AAAA,EAChD;AAAA,EAER,YAAY,SAA8B;AACxC,SAAK,QAAQ,SAAS,SAAS;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,WAAmB,SAAgC;AACrD,QAAI,QAAQ,KAAK,QAAQ,IAAI,SAAS;AACtC,QAAI,CAAC,OAAO;AACV,cAAQ,CAAC;AACT,WAAK,QAAQ,IAAI,WAAW,KAAK;AAAA,IACnC;AACA,UAAM,KAAK,EAAE,SAAS,YAAY,KAAK,IAAI,EAAE,CAAC;AAC9C,QAAI,MAAM,SAAS,wBAAwB;AACzC,YAAM,MAAM;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,WAAmB,OAAmC;AACxD,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,CAAC;AAE5C,YAAQ,MAAM,OAAO,CAAC,MAAM,MAAM,EAAE,aAAa,KAAK,KAAK;AAC3D,SAAK,QAAQ,IAAI,WAAW,KAAK;AACjC,UAAM,WAAW,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO;AAC3C,QAAI,UAAU,QAAW;AACvB,aAAO,CAAC,GAAG,QAAQ;AAAA,IACrB;AACA,WAAO,SAAS,OAAO,CAAC,MAAM,EAAE,YAAY,KAAK;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAyB;AAC7B,SAAK,QAAQ,IAAI,WAAW,CAAC,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,WAAyB;AAC9B,SAAK,QAAQ,OAAO,SAAS;AAAA,EAC/B;AACF;;;AC1EA,OAAO,SAAS;AAChB,SAAS,mBAAmB;AAqB5B,IAAM,cAAmC,oBAAI,IAAI;AAMjD,SAAS,0BAAgC;AACvC,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,KAAK,MAAM,KAAK,aAAa;AACvC,QAAI,UAAU,KAAK;AACjB,kBAAY,OAAO,GAAG;AAAA,IACxB;AAAA,EACF;AACF;AAEA,SAAS,eAAuB;AAC9B,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAA2B;AAClC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,KAAK;AACP,UAAM,SAAS,SAAS,KAAK,EAAE;AAC/B,QAAI,CAAC,MAAM,MAAM,KAAK,SAAS,GAAG;AAChC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAAY,SAG1B;AACA,QAAM,SAAS,aAAa;AAC5B,QAAM,gBAAgB,iBAAiB;AACvC,QAAM,MAAM,GAAG,KAAK,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAE5D,QAAM,QAAQ,IAAI;AAAA,IAChB,EAAE,WAAW,QAAQ,WAAW,MAAM,QAAQ,MAAM,IAAI;AAAA,IACxD;AAAA,IACA,EAAE,WAAW,cAAc;AAAA,EAC7B;AAEA,QAAM,YAAY,KAAK,IAAI,IAAI,gBAAgB;AAC/C,SAAO,EAAE,OAAO,UAAU;AAC5B;AAOO,SAAS,YAAY,OAAqB;AAC/C,MAAI;AACF,UAAM,SAAS,aAAa;AAC5B,UAAM,UAAU,IAAI,OAAO,OAAO,MAAM;AAIxC,QAAI,QAAQ,KAAK;AACf,YAAM,SAAS,QAAQ,MAAM,QAAQ,MAAM,MAAO,KAAK,IAAI;AAC3D,kBAAY,IAAI,QAAQ,KAAK,MAAM;AACnC,8BAAwB;AAAA,IAC1B;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAOO,SAAS,YACd,KACA,KACA,MACM;AACN,QAAM,aAAa,IAAI,QAAQ;AAC/B,MAAI,CAAC,cAAc,CAAC,WAAW,WAAW,SAAS,GAAG;AACpD,QAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,4CAA4C,CAAC;AAC3E;AAAA,EACF;AAEA,QAAM,QAAQ,WAAW,MAAM,CAAC;AAChC,MAAI;AACF,UAAM,SAAS,aAAa;AAC5B,UAAM,UAAU,IAAI,OAAO,OAAO,MAAM;AAMxC,QAAI,QAAQ,OAAO,YAAY,IAAI,QAAQ,GAAG,GAAG;AAC/C,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACxD;AAAA,IACF;AAEA,QAAI,QAAQ,EAAE,WAAW,QAAQ,WAAW,MAAM,QAAQ,KAAK;AAC/D,SAAK;AAAA,EACP,SAAS,KAAK;AACZ,QAAI,eAAe,IAAI,mBAAmB;AACxC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAAA,IACjD,OAAO;AACL,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAAA,IACjD;AAAA,EACF;AACF;;;AC3IA,SAAS,cAAc;AAEvB,SAAS,iBAAiB;AAS1B,IAAM,eAAe,CAAC,QAA8C,UAAU;AAAA,EAC5E,UAAU;AAAA,EACV,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,EAAE,OAAO,2CAAsC;AAC1D,CAAC;AAgBD,SAAS,qBACP,UACA,QACM;AACN,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,WAAW,OAAO,KAAK,UAAU;AAC3C,QAAI,QAAQ,aAAa,KAAK;AAC5B,eAAS,OAAO,SAAS;AACzB,aAAO,OAAO,SAAS;AAAA,IACzB;AAAA,EACF;AACF;AAqDO,SAAS,iBACd,OACA,QACA,UACA,WACA,WACA,eAAe,IACP;AACR,QAAM,SAAS,OAAO;AACtB,SAAO,IAAI,aAAa,YAAY,CAAC;AAErC,QAAM,GAAG,mBAAmB,CAAC,MAAM,IAAI,aAAa;AAClD,QAAI,CAAC,SAAS,IAAI,EAAE,EAAG;AACvB,UAAM,WAAW,MAAM,UAAU;AACjC,UAAM,cAAc,SAAS,IAAI,IAAI;AACrC,UAAM,MAAM;AAOZ,UAAM,MAAuB;AAAA,MAC3B,IAAI,IAAI;AAAA,MACR;AAAA,MACA,UAAU,aAAa;AAAA,MACvB,MAAM,IAAI;AAAA,MACV,SAAS,IAAI;AAAA,MACb,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,IACjB;AACA,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,CAAC;AAED,SAAO,KAAK,gBAAgB,OAAO,KAAc,QAAkB;AACjE,UAAM,EAAE,WAAW,YAAY,MAAM,SAAS,IAAI,IAAI;AAOtD,QAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,wBAAwB,CAAC;AACvD;AAAA,IACF;AACA,QAAI,CAAC,cAAc,OAAO,eAAe,UAAU;AACjD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACxD;AAAA,IACF;AAEA,UAAM,eAAe;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,WAAW,WAAW;AAAA,MACxB,KAAK,IAAI;AAAA,IACX;AACA,UAAM,eAAe,UAAU,YAAY;AAC3C,QAAI,CAAC,aAAa,OAAO;AACvB,UACG,OAAO,GAAG,EACV,KAAK,EAAE,OAAO,mCAAmC,aAAa,OAAO,CAAC;AACzE;AAAA,IACF;AAEA,UAAM,EAAE,OAAO,UAAU,IAAI,YAAY,EAAE,WAAW,KAAK,CAAC;AAC5D,yBAAqB,UAAU,MAAM;AAErC,UAAM,UAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,MACvB;AAAA,MACA;AAAA,IACF;AACA,aAAS,IAAI,WAAW,OAAO;AAE/B,UAAM,WAAW,MAAM,UAAU;AACjC,UAAM,QAAuE,CAAC;AAC9E,eAAW,SAAS,SAAS,OAAO,GAAG;AACrC,UAAI,MAAM,cAAc,WAAW;AACjC,cAAM,KAAK;AAAA,UACT,WAAW,MAAM;AAAA,UACjB,MAAM,MAAM;AAAA,UACZ,UAAU,MAAM;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,KAAK,SAAS,OAAO,GAAG;AACjC,UAAI,EAAE,cAAc,aAAa,CAAC,SAAS,IAAI,EAAE,SAAS,GAAG;AAC3D,cAAM,KAAK;AAAA,UACT,WAAW,EAAE;AAAA,UACb,MAAM,EAAE;AAAA,UACR,UAAU,EAAE;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,KAAK,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACtC,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,KAA2B,QAAkB;AAClD,YAAM,EAAE,IAAI,MAAM,SAAS,UAAU,IAAI,IAAI;AAO7C,UAAI,CAAC,MAAM,OAAO,OAAO,UAAU;AACjC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAChD;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAClD;AAAA,MACF;AACA,UAAI,YAAY,QAAW;AACzB,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AACrD;AAAA,MACF;AAEA,YAAM,kBAAkB,IAAI,MAAO;AACnC,YAAM,UAAU,SAAS,IAAI,eAAe;AAC5C,UAAI,CAAC,SAAS;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,8CAAyC,CAAC;AACxE;AAAA,MACF;AAEA,YAAM,WAAW;AAAA,QACf;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA,KAAK,IAAI;AAAA,QACT;AAAA,MACF;AAEA,YAAM,WAAW,MAAM,UAAU;AACjC,YAAM,cAAc,SAAS,IAAI,EAAE;AACnC,UAAI,eAAe,YAAY,QAAQ;AACrC,cAAM,KAAK,YAAY;AACvB,cAAM,OAAO;AACb,YAAI,GAAG,eAAe,MAAM;AAC1B,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mCAAmC,CAAC;AAClE;AAAA,QACF;AACA,YAAI;AACF,gBAAM,WAAW,KAAK,UAAU;AAAA,YAC9B,MAAM;AAAA,YACN,MAAM;AAAA,YACN,MAAM,QAAQ;AAAA,YACd;AAAA,UACF,CAAC;AACD,aAAG,KAAK,QAAQ;AAChB,cAAI,KAAK,EAAE,IAAI,MAAM,YAAY,SAAS,GAAG,CAAC;AAC9C;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,OACE,iCACC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,UACpD,CAAC;AACD;AAAA,QACF;AAAA,MACF;AAEA,YAAM,gBAAgB,SAAS,IAAI,EAAE;AACrC,UAAI,eAAe;AACjB,cAAM,cAAc,SAAS,IAAI,eAAe;AAChD,cAAM,MAAuB;AAAA,UAC3B,IAAI,SAAS;AAAA,UACb,MAAM;AAAA,UACN,UAAU,QAAQ,QAAQ,aAAa;AAAA,UACvC,MAAM,SAAS;AAAA,UACf,SAAS,SAAS;AAAA,UAClB,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,QACtB;AACA,eAAO,IAAI,IAAI,GAAG;AAClB,YAAI,KAAK,EAAE,IAAI,MAAM,YAAY,SAAS,GAAG,CAAC;AAC9C;AAAA,MACF;AAEA,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,0BAA0B,CAAC;AAAA,IAC3D;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,CAAC,KAA2B,QAAkB;AAC5C,YAAM,kBAAkB,IAAI,MAAO;AACnC,YAAM,WAAW,MAAM,UAAU;AACjC,YAAM,WAKD,CAAC;AAEN,iBAAW,SAAS,SAAS,OAAO,GAAG;AACrC,YAAI,MAAM,cAAc,iBAAiB;AACvC,mBAAS,KAAK;AAAA,YACZ,WAAW,MAAM;AAAA,YACjB,MAAM,MAAM;AAAA,YACZ,UAAU,MAAM;AAAA,YAChB,UAAU,MAAM;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,MACF;AAEA,iBAAW,KAAK,SAAS,OAAO,GAAG;AACjC,YAAI,EAAE,cAAc,mBAAmB,CAAC,SAAS,IAAI,EAAE,SAAS,GAAG;AACjE,mBAAS,KAAK;AAAA,YACZ,WAAW,EAAE;AAAA,YACb,MAAM,EAAE;AAAA,YACR,UAAU,EAAE;AAAA,YACZ,UAAU,EAAE;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,KAAK,EAAE,OAAO,SAAS,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,CAAC,KAA2B,QAAkB;AAC5C,YAAM,YAAY,IAAI,MAAO;AAC7B,YAAM,WAAW,IAAI,MAAM;AAC3B,YAAM,WAAW,IAAI,MAAM;AAE3B,YAAM,QAAQ,WAAW,SAAS,UAAU,EAAE,IAAI;AAClD,YAAM,QAAQ,KAAK,IAAI,WAAW,SAAS,UAAU,EAAE,IAAI,IAAI,GAAG;AAElE,UAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC1C,YAAM,UAAU,SAAS,SAAS;AAClC,UAAI,SAAS;AACX,mBAAW,SAAS,MAAM,GAAG,KAAK;AAAA,MACpC;AAEA,UAAI,UAAU,QAAW;AACvB,eAAO,MAAM,SAAS;AAAA,MACxB;AAEA,UAAI,KAAK,EAAE,UAAU,QAAQ,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,CAAC,KAA2B,QAAkB;AAC5C,YAAM,YAAY,IAAI,MAAO;AAC7B,YAAM,aAAa,IAAI,QAAQ;AAC/B,YAAM,QAAQ,WAAW,MAAM,CAAC;AAEhC,kBAAY,KAAK;AACjB,eAAS,OAAO,SAAS;AACzB,aAAO,OAAO,SAAS;AAEvB,UAAI,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvB;AAAA,EACF;AAEA,SAAO;AACT;;;AC7WA,OAAO,UAAU;AACjB,OAAO,aAAa;AACpB,OAAO,UAAU;AAajB,IAAM,wBAA0C,CAC9C,MACA,QACA,YACA,SACA,WACA,cAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa,KAAK,IAAI;AAAA,EACtB;AACF;AAiBF,eAAsB,SAAS,UAA2B,CAAC,GAGxD;AACD,QAAM,SAAS,QAAQ,UAAU;AAAA,IAC/B,QAAQ,IAAI,cAAc,QAAQ,IAAI,QAAQ;AAAA,IAAQ;AAAA,EACxD;AACA,QAAM,YAAY,QAAQ,IAAI,cAAc,QAAQ,IAAI;AACxD,QAAM,aACJ,QAAQ,eACP,OAAO,cAAc,YAAY,UAAU,SAAS;AAEvD,QAAM,WAAW,SAAS,QAAQ,IAAI,aAAa,OAAO,EAAE;AAC5D,QAAM,eAAmC,EAAE,GAAG,QAAQ,cAAc,SAAS;AAE7E,QAAM,QAAQ,IAAI,YAAY,YAAY;AAC1C,QAAM,MAAM,MAAM,MAAM;AAExB,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,MAAM;AAAA,EACjB;AAEA,MAAI,CAAC,WAAW;AACd,UAAM,MAAM,KAAK;AACjB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ,IAAI,wBAAwB;AACvC,YAAQ,IAAI,yBAAyB;AAAA,EACvC;AAEA,QAAM,WAAW,QAAQ,YAAY,SAAS,QAAQ,IAAI,aAAa,QAAQ,EAAE;AACjF,QAAM,eAAe,SAAS,QAAQ,IAAI,kBAAkB,YAAY,EAAE;AAC1E,QAAM,gBAAgB,IAAI,cAAc,EAAE,OAAO,aAAa,CAAC;AAC/D,QAAM,eAAe,oBAAI,IAAyB;AAElD,QAAM,iBAAiB,QAAQ,IAAI,mBAAmB;AACtD,QAAM,cAAc,mBAAmB,MACnC,MACA,eAAe,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAE7E,QAAM,MAAM,QAAQ;AACpB,MAAI,IAAI,KAAK;AAAA,IACX,QAAQ;AAAA,IACR,SAAS,CAAC,OAAO,QAAQ,QAAQ;AAAA,IACjC,gBAAgB,CAAC,gBAAgB,eAAe;AAAA,EAClD,CAAC,CAAC;AACF,MAAI,IAAI,QAAQ,KAAK,CAAC;AAEtB,QAAM,gBAAgB,CAAC,aACrB,eAAe,QAAoB;AAErC,QAAM,eAAe,SAAS,QAAQ,IAAI,kBAAkB,MAAM,EAAE;AACpE,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,IAAI,MAAM;AAEd,MAAI,IAAI,CAAC,MAAM,QAAQ;AACrB,QAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EAC7C,CAAC;AAED,QAAM,aAAa,KAAK,aAAa,GAAG;AACxC,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,eAAW,OAAO,UAAU,MAAM,QAAQ,CAAC;AAC3C,eAAW,GAAG,SAAS,MAAM;AAAA,EAC/B,CAAC;AAED,SAAO,EAAE,OAAO,WAAW;AAC7B;","names":[]}