@serfab/cadre-host 1.13.0 → 1.14.0

package/dist/server/routes/bootstrap-node-validation.d.ts

@@ -1,115 +0,0 @@
-/**
- * Shape validation for the requester-supplied `bootstrapNodes` of `POST /grants`
- * — the requester's control-network addresses the donated node is started with
- * (written into the child's `cadre.json` as `controlNetwork.bootstrapNodes` by
- * `orchestrator/host-process-orchestrator.ts`) and hands to `@libp2p/bootstrap`.
- *
- * Its own module rather than part of `grants.ts`: the per-entry rule is a duplicate
- * of cadre-provider's copy (`packages/cadre-provider/src/server/bootstrap-node-validation.ts`)
- * and must stay identical to it, so it is worth reading, testing and changing on
- * its own, without a routing file around it — the same arrangement cadre-provider
- * uses for its restatement of cadre-core's owner-key rule.
- *
- * ## An empty list is accepted — where this copy differs, on purpose
- *
- * The field may be absent or `[]`; cadre-provider's copy still requires at least one
- * address. A lent node's requester is typically a phone, and a phone has no address
- * to give — its node listens on nothing and can only dial out. Such a requester sends
- * no addresses and dials the node itself, at the WebSocket address
- * `GET /grants/:id/peer` reports. The node starts with no bootstrap peers and waits,
- * and admits that first inbound connection because it holds no authorized members
- * yet (`admitInboundControlConnection` / `authorizeInboundControlStream` in
- * `cadre-core/src/cadre-node.ts`). A provider container has no such requester yet, so
- * there an empty list is still the node-comes-up-alone failure described below
- * (`backlog/feat-provider-drone-reachable-by-phone`).
- *
- * The difference is at the list level only: every entry that IS given must pass the
- * rule below, which is identical in both packages.
- *
- * ## The rule, and why each clause is there
- *
- * An entry is usable exactly when it is a string, parses as a multiaddr, carries
- * a `/p2p/<peerId>` component whose peer id decodes, and says where that peer is.
- * Each clause corresponds to a distinct downstream failure the caller would
- * otherwise never be told about — the value is forwarded verbatim into the spawned
- * child, so every one of these surfaces where the caller cannot see it:
- *
- * - **Not parsable as a multiaddr → the child dies at boot.** `@libp2p/bootstrap`'s
- *   constructor maps `multiaddr()` over the whole list *before* filtering anything,
- *   and `multiaddr()` throws on a string that does not start with `/` (and on a
- *   non-string outright). libp2p construction throws and the node never starts.
- * - **No `/p2p/<peerId>` → the node starts and never joins.** The quiet one.
- *   `/ip4/127.0.0.1/tcp/4001` parses fine, then `@libp2p/bootstrap` filters it out
- *   ("invalid bootstrap multiaddr without peer id", logged inside the child) and
- *   the node comes up with *zero* bootstrap peers: healthy-looking, permanently
- *   alone, never reaching the party it was created for. cadre-core's
- *   `getBootstrapPeerIds` (`packages/cadre-core/src/cadre-node.ts`) skips such an
- *   entry silently for the same reason.
- * - **Malformed peer id → the child dies at boot.** `multiaddr()` does *not*
- *   validate the `/p2p/` value — parsing `/ip4/1.2.3.4/tcp/1/p2p/12D3KooReq` yields
- *   a `p2p` component whose value is the junk string unchanged — but
- *   `@libp2p/bootstrap` then calls `peerIdFromString` on it, unguarded, and it
- *   throws `Incorrect length`. A truncated copy-paste of a 52-character peer id is
- *   the likeliest human typo in this field.
- * - **No location at all → the node starts and never joins.** `/p2p/<peerId>` (and
- *   `/p2p/<relay>/p2p-circuit/p2p/<target>`) parses and names a decodable peer, and
- *   `@libp2p/bootstrap` keeps it — but it says nothing about *where* the peer is, so
- *   libp2p finds no transport for it and the dial fails with no valid addresses.
- *   The node comes up with a bootstrap peer it can never reach, which looks the same
- *   from outside as having none. Only the total absence of a location is rejected:
- *   which transports the child can actually dial is the embedder's choice
- *   (`NetworkConfig.transports`), invisible from here, so a partial address like
- *   `/ip4/1.2.3.4/p2p/<peerId>` is deliberately left to the child.
- *
- * The peer id is read the way `@libp2p/bootstrap` reads it — the `p2p` components
- * of `getComponents()` — rather than through the deprecated `getPeerId()`, so the
- * two cannot disagree about which part of the address is the peer. Bootstrap uses
- * only the *last* `p2p` component; this checks **every** one, so the relay half of
- * a `…/p2p/<relay>/p2p-circuit/p2p/<target>` address must decode too. An address
- * naming an undecodable relay is not dialable either, and bootstrap's own
- * `P2P.matches` filter accepts any address carrying a `p2p` component, so nothing
- * this accepts is dropped there.
- *
- * Requiring a multiaddr also closes a downstream ambiguity on the *other* side of
- * this rule: cadre-provider joins its list with `,` into `CADRE_BOOTSTRAP_NODES`
- * and cadre-cli's env loader splits it back on `,`, so an entry containing a comma
- * would silently become two addresses there. This host writes JSON rather than an
- * env var and so is not exposed to that, but the two per-entry rules are kept
- * identical — see the note about manual upkeep below.
- *
- * Reachability is deliberately NOT checked: a well-formed address for a peer that
- * happens to be down is indistinguishable here from one that is up, and no
- * boundary check can tell them apart. This validates the *shape* the child must be
- * able to parse, nothing more.
- *
- * Keeping the two per-entry rules in step is **manual** — neither package can see
- * the other's rule, so no test can compare them. What the tests give instead is a
- * tripwire on each side: `../__tests__/bootstrap-node-validation.test.ts` here and
- * `packages/cadre-provider/src/server/__tests__/bootstrap-node-validation.test.ts`
- * there each pin their own copy to the same per-entry accept/reject table (the
- * empty-list row is the one that differs), so changing either rule fails that
- * package's own suite — and the comment above the rule you just changed is what
- * points at the other copy.
- */
-/**
- * Validate the optional `bootstrapNodes` field of a provision request: absent, or an
- * array of dialable control-network addresses (see {@link validateBootstrapNode}).
- * Absent and `[]` alike mean the requester dials the node itself — see "An empty list
- * is accepted" in the module comment.
- *
- * Provisioning is the last point at which the requester can still fix a typo, so
- * the shape is checked here: without it a bad address is answered 201 and then
- * produces a donated node that either dies at boot or comes up permanently alone
- * — the requester learning about it, if ever, from donation status rather than
- * from a 400 naming the bad address.
- *
- * Every rejection names the offending entry: with several addresses in one
- * request the message is the only thing that says WHICH one.
- *
- * @returns the trimmed addresses (`[]` when none were given), so the provision request carries exactly what was validated.
- */
-export declare function validateBootstrapNodes(value: unknown): {
-    nodes: string[];
-} | {
-    error: string;
-};

package/dist/server/routes/bootstrap-node-validation.js

@@ -1,197 +0,0 @@
-/**
- * Shape validation for the requester-supplied `bootstrapNodes` of `POST /grants`
- * — the requester's control-network addresses the donated node is started with
- * (written into the child's `cadre.json` as `controlNetwork.bootstrapNodes` by
- * `orchestrator/host-process-orchestrator.ts`) and hands to `@libp2p/bootstrap`.
- *
- * Its own module rather than part of `grants.ts`: the per-entry rule is a duplicate
- * of cadre-provider's copy (`packages/cadre-provider/src/server/bootstrap-node-validation.ts`)
- * and must stay identical to it, so it is worth reading, testing and changing on
- * its own, without a routing file around it — the same arrangement cadre-provider
- * uses for its restatement of cadre-core's owner-key rule.
- *
- * ## An empty list is accepted — where this copy differs, on purpose
- *
- * The field may be absent or `[]`; cadre-provider's copy still requires at least one
- * address. A lent node's requester is typically a phone, and a phone has no address
- * to give — its node listens on nothing and can only dial out. Such a requester sends
- * no addresses and dials the node itself, at the WebSocket address
- * `GET /grants/:id/peer` reports. The node starts with no bootstrap peers and waits,
- * and admits that first inbound connection because it holds no authorized members
- * yet (`admitInboundControlConnection` / `authorizeInboundControlStream` in
- * `cadre-core/src/cadre-node.ts`). A provider container has no such requester yet, so
- * there an empty list is still the node-comes-up-alone failure described below
- * (`backlog/feat-provider-drone-reachable-by-phone`).
- *
- * The difference is at the list level only: every entry that IS given must pass the
- * rule below, which is identical in both packages.
- *
- * ## The rule, and why each clause is there
- *
- * An entry is usable exactly when it is a string, parses as a multiaddr, carries
- * a `/p2p/<peerId>` component whose peer id decodes, and says where that peer is.
- * Each clause corresponds to a distinct downstream failure the caller would
- * otherwise never be told about — the value is forwarded verbatim into the spawned
- * child, so every one of these surfaces where the caller cannot see it:
- *
- * - **Not parsable as a multiaddr → the child dies at boot.** `@libp2p/bootstrap`'s
- *   constructor maps `multiaddr()` over the whole list *before* filtering anything,
- *   and `multiaddr()` throws on a string that does not start with `/` (and on a
- *   non-string outright). libp2p construction throws and the node never starts.
- * - **No `/p2p/<peerId>` → the node starts and never joins.** The quiet one.
- *   `/ip4/127.0.0.1/tcp/4001` parses fine, then `@libp2p/bootstrap` filters it out
- *   ("invalid bootstrap multiaddr without peer id", logged inside the child) and
- *   the node comes up with *zero* bootstrap peers: healthy-looking, permanently
- *   alone, never reaching the party it was created for. cadre-core's
- *   `getBootstrapPeerIds` (`packages/cadre-core/src/cadre-node.ts`) skips such an
- *   entry silently for the same reason.
- * - **Malformed peer id → the child dies at boot.** `multiaddr()` does *not*
- *   validate the `/p2p/` value — parsing `/ip4/1.2.3.4/tcp/1/p2p/12D3KooReq` yields
- *   a `p2p` component whose value is the junk string unchanged — but
- *   `@libp2p/bootstrap` then calls `peerIdFromString` on it, unguarded, and it
- *   throws `Incorrect length`. A truncated copy-paste of a 52-character peer id is
- *   the likeliest human typo in this field.
- * - **No location at all → the node starts and never joins.** `/p2p/<peerId>` (and
- *   `/p2p/<relay>/p2p-circuit/p2p/<target>`) parses and names a decodable peer, and
- *   `@libp2p/bootstrap` keeps it — but it says nothing about *where* the peer is, so
- *   libp2p finds no transport for it and the dial fails with no valid addresses.
- *   The node comes up with a bootstrap peer it can never reach, which looks the same
- *   from outside as having none. Only the total absence of a location is rejected:
- *   which transports the child can actually dial is the embedder's choice
- *   (`NetworkConfig.transports`), invisible from here, so a partial address like
- *   `/ip4/1.2.3.4/p2p/<peerId>` is deliberately left to the child.
- *
- * The peer id is read the way `@libp2p/bootstrap` reads it — the `p2p` components
- * of `getComponents()` — rather than through the deprecated `getPeerId()`, so the
- * two cannot disagree about which part of the address is the peer. Bootstrap uses
- * only the *last* `p2p` component; this checks **every** one, so the relay half of
- * a `…/p2p/<relay>/p2p-circuit/p2p/<target>` address must decode too. An address
- * naming an undecodable relay is not dialable either, and bootstrap's own
- * `P2P.matches` filter accepts any address carrying a `p2p` component, so nothing
- * this accepts is dropped there.
- *
- * Requiring a multiaddr also closes a downstream ambiguity on the *other* side of
- * this rule: cadre-provider joins its list with `,` into `CADRE_BOOTSTRAP_NODES`
- * and cadre-cli's env loader splits it back on `,`, so an entry containing a comma
- * would silently become two addresses there. This host writes JSON rather than an
- * env var and so is not exposed to that, but the two per-entry rules are kept
- * identical — see the note about manual upkeep below.
- *
- * Reachability is deliberately NOT checked: a well-formed address for a peer that
- * happens to be down is indistinguishable here from one that is up, and no
- * boundary check can tell them apart. This validates the *shape* the child must be
- * able to parse, nothing more.
- *
- * Keeping the two per-entry rules in step is **manual** — neither package can see
- * the other's rule, so no test can compare them. What the tests give instead is a
- * tripwire on each side: `../__tests__/bootstrap-node-validation.test.ts` here and
- * `packages/cadre-provider/src/server/__tests__/bootstrap-node-validation.test.ts`
- * there each pin their own copy to the same per-entry accept/reject table (the
- * empty-list row is the one that differs), so changing either rule fails that
- * package's own suite — and the comment above the rule you just changed is what
- * points at the other copy.
- */
-import debug from 'debug';
-import { CODE_P2P, CODE_P2P_CIRCUIT, multiaddr } from '@multiformats/multiaddr';
-import { peerIdFromString } from '@libp2p/peer-id';
-const log = debug('cadre:host:bootstrap-nodes');
-/**
- * Longest rejected address echoed back in an error message. Generous compared to
- * the owner-key limit because a legitimate address is long: a plain
- * `/ip4/…/tcp/…/p2p/<52 chars>` runs ~80 characters and a relayed
- * `…/p2p-circuit/p2p/<52 chars>` about 150, so a smaller cap would truncate the
- * very values an operator needs to read back.
- */
-const REJECTED_ADDRESS_ECHO_LIMIT = 192;
-/**
- * Render a rejected address for an error message, capped: `bootstrapNodes`
- * arrives from a caller over the network, so an unbounded echo would let one junk
- * string become a megabyte of log line.
- */
-function describeRejectedAddress(value) {
-    return value.length <= REJECTED_ADDRESS_ECHO_LIMIT
-        ? value
-        : `${value.slice(0, REJECTED_ADDRESS_ECHO_LIMIT)}… (${value.length} chars)`;
-}
-/** The message of a thrown parse/decode failure, whatever the thrower used. */
-function reasonOf(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-/**
- * Apply the rule above to one entry. Returns the trimmed value, so the create
- * provision request carries exactly what was validated.
- */
-function validateBootstrapNode(value) {
-    const trimmed = value.trim();
-    if (trimmed.length === 0) {
-        return { error: 'bootstrapNodes entries must not be empty or whitespace-only' };
-    }
-    let address;
-    try {
-        address = multiaddr(trimmed);
-    }
-    catch (error) {
-        log('rejecting bootstrapNodes entry: %s', reasonOf(error));
-        return {
-            error: `bootstrapNodes entries must be multiaddrs (could not parse "${describeRejectedAddress(trimmed)}": ${reasonOf(error)})`,
-        };
-    }
-    const components = address.getComponents();
-    const peerIds = components.filter(component => component.code === CODE_P2P);
-    if (peerIds.length === 0) {
-        return {
-            error: `bootstrapNodes entries must include a /p2p/<peerId> component ("${describeRejectedAddress(trimmed)}" names no peer, so the node would drop it and start with no bootstrap peers)`,
-        };
-    }
-    if (!components.some(component => component.code !== CODE_P2P && component.code !== CODE_P2P_CIRCUIT)) {
-        return {
-            error: `bootstrapNodes entries must name where to reach the peer ("${describeRejectedAddress(trimmed)}" names only peer ids, so no transport can dial it and the node would start with no reachable bootstrap peers)`,
-        };
-    }
-    for (const { value } of peerIds) {
-        try {
-            peerIdFromString(value ?? '');
-        }
-        catch (error) {
-            log('rejecting bootstrapNodes peer id: %s', reasonOf(error));
-            return {
-                error: `bootstrapNodes entries must carry a decodable peer id ("${describeRejectedAddress(trimmed)}" names peer "${describeRejectedAddress(value ?? '')}", which does not decode: ${reasonOf(error)})`,
-            };
-        }
-    }
-    return { node: trimmed };
-}
-/**
- * Validate the optional `bootstrapNodes` field of a provision request: absent, or an
- * array of dialable control-network addresses (see {@link validateBootstrapNode}).
- * Absent and `[]` alike mean the requester dials the node itself — see "An empty list
- * is accepted" in the module comment.
- *
- * Provisioning is the last point at which the requester can still fix a typo, so
- * the shape is checked here: without it a bad address is answered 201 and then
- * produces a donated node that either dies at boot or comes up permanently alone
- * — the requester learning about it, if ever, from donation status rather than
- * from a 400 naming the bad address.
- *
- * Every rejection names the offending entry: with several addresses in one
- * request the message is the only thing that says WHICH one.
- *
- * @returns the trimmed addresses (`[]` when none were given), so the provision request carries exactly what was validated.
- */
-export function validateBootstrapNodes(value) {
-    if (value === undefined) {
-        return { nodes: [] };
-    }
-    if (!Array.isArray(value) || !value.every((entry) => typeof entry === 'string')) {
-        return { error: 'bootstrapNodes must be an array of strings' };
-    }
-    const nodes = [];
-    for (const entry of value) {
-        const checked = validateBootstrapNode(entry);
-        if ('error' in checked)
-            return checked;
-        nodes.push(checked.node);
-    }
-    return { nodes };
-}
-//# sourceMappingURL=bootstrap-node-validation.js.map

package/dist/server/routes/bootstrap-node-validation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrap-node-validation.js","sourceRoot":"","sources":["../../../src/server/routes/bootstrap-node-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAkB,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,GAAG,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,MAAM,IAAI,2BAA2B;QAChD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,2BAA2B,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,oCAAoC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,OAAO;YACL,KAAK,EAAE,+DAA+D,uBAAuB,CAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG;SAC/H,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,mEAAmE,uBAAuB,CAAC,OAAO,CAAC,+EAA+E;SAC1L,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;QACtG,OAAO;YACL,KAAK,EAAE,8DAA8D,uBAAuB,CAAC,OAAO,CAAC,gHAAgH;SACtN,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,sCAAsC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,OAAO;gBACL,KAAK,EAAE,2DAA2D,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,uBAAuB,CAAC,KAAK,IAAI,EAAE,CAAC,6BAA6B,QAAQ,CAAC,KAAK,CAAC,GAAG;aACvM,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACjG,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/server/routes/grants-admin.d.ts

@@ -1,29 +0,0 @@
-/**
- * Donation grant **admin** HTTP routes — thin adapters around
- * `GrantAdminHandlers` (`createGrantAdminHandlers(service, donations)`).
- *
- * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
- * targets. It is **loopback, no bearer**: same-machine admin, matching
- * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
- * Security posture). This is distinct from the grantee-facing `/grants`
- * provisioning surface (`routes/grants.ts`), which carries the bearer gate.
- *
- * Clients: the `cadre-host grant` CLI and the local UI's Grants page. The list
- * reports each grant's live-node count and the donations a revoke would end.
- *
- * Revoking a grant also terminates the nodes donated under it unless the
- * caller passes `?keepNodes=true`; `DELETE /grants-admin/donations/:id` ends a
- * single donated node. Those are the host's only teardown paths once a grant is
- * revoked — the grantee's own `DELETE /grants/:id` is refused from then on.
- *
- * Each successful mutation publishes a `grants-changed` bus event, so an open
- * Grants page refreshes when the CLI acts.
- */
-import type { FastifyInstance } from 'fastify';
-import type { GrantAdminHandlers } from '../../donation/types.js';
-import type { EventBus } from '../events/bus.js';
-export interface GrantsAdminRoutesOptions {
-    handlers: GrantAdminHandlers;
-    events: EventBus;
-}
-export declare function registerGrantsAdminRoutes(app: FastifyInstance, opts: GrantsAdminRoutesOptions): void;

package/dist/server/routes/grants-admin.js

@@ -1,58 +0,0 @@
-/**
- * Donation grant **admin** HTTP routes — thin adapters around
- * `GrantAdminHandlers` (`createGrantAdminHandlers(service, donations)`).
- *
- * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
- * targets. It is **loopback, no bearer**: same-machine admin, matching
- * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
- * Security posture). This is distinct from the grantee-facing `/grants`
- * provisioning surface (`routes/grants.ts`), which carries the bearer gate.
- *
- * Clients: the `cadre-host grant` CLI and the local UI's Grants page. The list
- * reports each grant's live-node count and the donations a revoke would end.
- *
- * Revoking a grant also terminates the nodes donated under it unless the
- * caller passes `?keepNodes=true`; `DELETE /grants-admin/donations/:id` ends a
- * single donated node. Those are the host's only teardown paths once a grant is
- * revoked — the grantee's own `DELETE /grants/:id` is refused from then on.
- *
- * Each successful mutation publishes a `grants-changed` bus event, so an open
- * Grants page refreshes when the CLI acts.
- */
-export function registerGrantsAdminRoutes(app, opts) {
-    const { handlers, events } = opts;
-    app.get('/grants-admin', async () => {
-        return handlers.listGrants();
-    });
-    app.post('/grants-admin', async (request) => {
-        const body = (request.body ?? {});
-        const label = typeof body.label === 'string' ? body.label : '';
-        const args = { label };
-        if (typeof body.maxNodes === 'number')
-            args.maxNodes = body.maxNodes;
-        if (typeof body.ttlMs === 'number')
-            args.ttlMs = body.ttlMs;
-        const result = await handlers.postGrant(args);
-        events.publish({ type: 'grants-changed', kind: 'issued' });
-        return result;
-    });
-    app.delete('/grants-admin/:token', async (request) => {
-        const keepNodes = isTrueFlag(request.query.keepNodes);
-        const { terminated } = await handlers.deleteGrant(request.params.token, { keepNodes });
-        events.publish({ type: 'grants-changed', kind: 'revoked' });
-        return { ok: true, terminated };
-    });
-    // Two path segments past `/grants-admin`, so it never collides with `/:token`.
-    const { terminateDonation } = handlers;
-    if (terminateDonation) {
-        app.delete('/grants-admin/donations/:id', async (request) => {
-            await terminateDonation(request.params.id);
-            events.publish({ type: 'grants-changed', kind: 'terminated' });
-            return { ok: true };
-        });
-    }
-}
-function isTrueFlag(value) {
-    return value === 'true' || value === '1';
-}
-//# sourceMappingURL=grants-admin.js.map

package/dist/server/routes/grants-admin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grants-admin.js","sourceRoot":"","sources":["../../../src/server/routes/grants-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAYH,MAAM,UAAU,yBAAyB,CAAC,GAAoB,EAAE,IAA8B;IAC5F,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAElC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAClC,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA6D,CAAC;QAC9F,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAyD,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CACR,sBAAsB,EACtB,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,+EAA+E;IAC/E,MAAM,EAAE,iBAAiB,EAAE,GAAG,QAAQ,CAAC;IACvC,IAAI,iBAAiB,EAAE,CAAC;QACtB,GAAG,CAAC,MAAM,CAA6B,6BAA6B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACtF,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;AAC3C,CAAC"}

package/dist/server/routes/grants.d.ts

@@ -1,28 +0,0 @@
-/**
- * Grantee-facing donation routes — the HTTP surface an external cadre authority
- * (a friend's phone) drives to have this host donate a node into *its* cadre.
- *
- * Mount path: `/grants`. Distinct from the loopback-only `/grants-admin` surface
- * (issue/list/revoke, no bearer): this one is **bearer-gated** — every request
- * carries `Authorization: Bearer <grant-token>`, and a grantee sees only the
- * donations its own grant authorized (the single cross-grantee boundary,
- * analogous to cadre-provider's per-customer ownership check).
- *
- * Reachability is out of scope here: in v1 this mounts on the loopback
- * management server, same as the trust-circle / NAT surfaces. Physically exposing
- * it to a remote phone is `backlog/feat-cadre-host-wan-grant-reachability`.
- *
- * Errors: handlers either send a `{ ok:false, error:{code,message} }` envelope
- * inline (auth / body validation) or let the `DonationService` throw a
- * `DonationError`, which `server/error-handler.ts` maps to the matching HTTP
- * status and the same envelope.
- */
-import type { FastifyInstance } from 'fastify';
-import type { DonationService } from '../../donation/donation-service.js';
-import type { GrantValidator } from '../../donation/types.js';
-export interface GrantsRoutesOptions {
-    donations: DonationService;
-    /** Validates the presented bearer for non-provisioning ops (provision revalidates internally). */
-    grants: GrantValidator;
-}
-export declare function registerGrantsRoutes(app: FastifyInstance, opts: GrantsRoutesOptions): void;

package/dist/server/routes/grants.js

@@ -1,165 +0,0 @@
-/**
- * Grantee-facing donation routes — the HTTP surface an external cadre authority
- * (a friend's phone) drives to have this host donate a node into *its* cadre.
- *
- * Mount path: `/grants`. Distinct from the loopback-only `/grants-admin` surface
- * (issue/list/revoke, no bearer): this one is **bearer-gated** — every request
- * carries `Authorization: Bearer <grant-token>`, and a grantee sees only the
- * donations its own grant authorized (the single cross-grantee boundary,
- * analogous to cadre-provider's per-customer ownership check).
- *
- * Reachability is out of scope here: in v1 this mounts on the loopback
- * management server, same as the trust-circle / NAT surfaces. Physically exposing
- * it to a remote phone is `backlog/feat-cadre-host-wan-grant-reachability`.
- *
- * Errors: handlers either send a `{ ok:false, error:{code,message} }` envelope
- * inline (auth / body validation) or let the `DonationService` throw a
- * `DonationError`, which `server/error-handler.ts` maps to the matching HTTP
- * status and the same envelope.
- */
-import { validateProvisionRequest } from './provision-request-validation.js';
-/** Uniform error envelope (matches `error-handler.ts` and the provider API). */
-function errorResponse(reply, code, message, status) {
-    return reply.status(status).send({ ok: false, error: { code, message } });
-}
-/** Pull the `Bearer <token>` value out of the Authorization header, or undefined. */
-function parseBearer(header) {
-    if (!header)
-        return undefined;
-    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-    return match ? match[1].trim() : undefined;
-}
-/** Map a grant denial reason to an HTTP status for the bearer gate. */
-function denyStatus(reason) {
-    if (reason === 'expired' || reason === 'revoked')
-        return 403;
-    return 401; // unknown_token / missing
-}
-/**
- * Authenticate the grant bearer for a non-provisioning op (identity + not
- * expired/revoked; no quota). Returns the token, or null after sending the
- * failure response. Provision does its own quota-aware validation inside
- * `DonationService.provision`.
- */
-function authenticate(request, reply, grants) {
-    const token = parseBearer(request.headers.authorization);
-    if (!token) {
-        errorResponse(reply, 'unauthorized', 'Missing bearer grant token', 401);
-        return null;
-    }
-    const validation = grants.validate(token);
-    if (!validation.ok) {
-        const status = denyStatus(validation.reason);
-        // Keep the envelope code aligned with the status (and with the POST path,
-        // which surfaces an unknown token as `unauthorized`): 401 → unauthorized,
-        // 403 → forbidden. A 401 labelled `forbidden` is self-contradictory.
-        const code = status === 403 ? 'forbidden' : 'unauthorized';
-        errorResponse(reply, code, `Grant is ${validation.reason ?? 'invalid'}`, status);
-        return null;
-    }
-    return token;
-}
-/**
- * Resolve a donation the presented grant owns. Returns the redacted view, or
- * null after sending a 404 — an unknown id and one owned by a *different* grant
- * are deliberately indistinguishable (a grantee never learns another grantee's
- * donations exist).
- */
-function requireOwned(donations, id, token, reply) {
-    const donation = donations.get(id);
-    if (!donation || donation.grantToken !== token) {
-        errorResponse(reply, 'not_found', `No such donation: ${id}`, 404);
-        return null;
-    }
-    return donation;
-}
-export function registerGrantsRoutes(app, opts) {
-    const { donations, grants } = opts;
-    // POST /grants — provision a donated node. The bearer's identity/expiry/
-    // revocation AND quota are validated inside provision(), which throws a
-    // DonationError (unauthorized / forbidden / quota_exceeded) the error handler
-    // maps. We only parse the bearer and validate the request body here.
-    app.post('/grants', async (request, reply) => {
-        const token = parseBearer(request.headers.authorization);
-        if (!token) {
-            return errorResponse(reply, 'unauthorized', 'Missing bearer grant token', 401);
-        }
-        // One validator owns the whole body — see `provision-request-validation.ts`
-        // for why no per-field check lives here. Nothing is provisioned on a
-        // rejection: this runs before the service is touched.
-        const validated = validateProvisionRequest(request.body ?? {}, token);
-        if ('error' in validated) {
-            return errorResponse(reply, 'invalid_request', validated.error, 400);
-        }
-        const donation = await donations.provision(validated.request);
-        return reply.status(201).send({ ok: true, data: { donation } });
-    });
-    // GET /grants — list only the donations this grant authorized.
-    app.get('/grants', async (request, reply) => {
-        const token = authenticate(request, reply, grants);
-        if (!token)
-            return reply;
-        return reply.send({ ok: true, data: { donations: donations.list(token) } });
-    });
-    // GET /grants/:id — one donation (redacted), owned by this grant.
-    app.get('/grants/:id', async (request, reply) => {
-        const token = authenticate(request, reply, grants);
-        if (!token)
-            return reply;
-        const donation = requireOwned(donations, request.params.id, token, reply);
-        if (!donation)
-            return reply;
-        return reply.send({ ok: true, data: { donation } });
-    });
-    // GET /grants/:id/peer — live { peerId, multiaddrs } for the requester's addDrone.
-    app.get('/grants/:id/peer', async (request, reply) => {
-        const token = authenticate(request, reply, grants);
-        if (!token)
-            return reply;
-        if (!requireOwned(donations, request.params.id, token, reply))
-            return reply;
-        const peer = await donations.getPeer(request.params.id);
-        return reply.send({ ok: true, data: peer });
-    });
-    // PUT /grants/:id/seed — apply the requester's phone-signed seed.
-    app.put('/grants/:id/seed', async (request, reply) => {
-        const token = authenticate(request, reply, grants);
-        if (!token)
-            return reply;
-        if (!requireOwned(donations, request.params.id, token, reply))
-            return reply;
-        const body = (request.body ?? {});
-        if (typeof body.seed !== 'string' || body.seed.length === 0) {
-            return errorResponse(reply, 'invalid_request', 'seed is required', 400);
-        }
-        const result = await donations.applySeed(request.params.id, body.seed);
-        // NOTE: exhaustive over today's three outcomes, and nothing forces it to stay
-        // that way — an unhandled fourth would fall out of the handler as `undefined`
-        // and hang the request rather than fail to compile. If `DonationSeedResult`
-        // ever grows a variant, add a `default:` that 500s here.
-        switch (result.outcome) {
-            case 'rejected':
-                return errorResponse(reply, 'seed_failed', result.error ?? 'Node rejected the seed', 502);
-            // The loan ended while the seed was in flight. The ending won, so the
-            // caller is told the record it seeded is no longer seedable (409) — or is
-            // gone entirely (404) — rather than a 200 that implies a live node.
-            case 'abandoned':
-                return result.status
-                    ? errorResponse(reply, 'invalid_state', `Donation ${request.params.id} ended (${result.status}) while the seed was in flight`, 409)
-                    : errorResponse(reply, 'not_found', `No such donation: ${request.params.id}`, 404);
-            case 'seeded':
-                return reply.send({ ok: true, data: { peersAdded: result.peersAdded } });
-        }
-    });
-    // DELETE /grants/:id — terminate the donated node.
-    app.delete('/grants/:id', async (request, reply) => {
-        const token = authenticate(request, reply, grants);
-        if (!token)
-            return reply;
-        if (!requireOwned(donations, request.params.id, token, reply))
-            return reply;
-        await donations.terminate(request.params.id);
-        return reply.send({ ok: true });
-    });
-}
-//# sourceMappingURL=grants.js.map

package/dist/server/routes/grants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/server/routes/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAQ7E,gFAAgF;AAChF,SAAS,aAAa,CAAC,KAAmB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAc;IACvF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,MAA0B;IAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,0BAA0B;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,OAAuB,EACvB,KAAmB,EACnB,MAAsB;IAEtB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3D,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,UAAU,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,SAA0B,EAC1B,EAAU,EACV,KAAa,EACb,KAAmB;IAEnB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC/C,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,IAAyB;IAClF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEnC,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,qEAAqE;IACrE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAA6B,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAA6B,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAA6B,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5E,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACxD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,yDAAyD;QACzD,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,UAAU;gBACb,OAAO,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC5F,sEAAsE;YACtE,0EAA0E;YAC1E,oEAAoE;YACpE,KAAK,WAAW;gBACd,OAAO,MAAM,CAAC,MAAM;oBAClB,CAAC,CAAC,aAAa,CACX,KAAK,EACL,eAAe,EACf,YAAY,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,MAAM,gCAAgC,EACrF,GAAG,CACJ;oBACH,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACvF,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,GAAG,CAAC,MAAM,CAA6B,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}