@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/hub/audit/index.js

@@ -0,0 +1,344 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { personKeyString } from "../directory/index.js";
+import { hubTxDatabase } from "../db.js";
+export const HUB_AUDIT_MIGRATION = Object.freeze({
+    component: "s5-audit",
+    version: 1,
+    up(db) {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS hub_audit (
+        sequence INTEGER PRIMARY KEY,
+        id TEXT NOT NULL UNIQUE,
+        at INTEGER NOT NULL,
+        request_id TEXT NOT NULL,
+        actor TEXT NOT NULL,
+        action TEXT NOT NULL,
+        result TEXT NOT NULL,
+        message_id TEXT, room_id TEXT, fleet_id TEXT, exposure_id TEXT,
+        owner_at_event TEXT, grant_id TEXT, grant_revision INTEGER,
+        policy_version INTEGER NOT NULL,
+        content_ref TEXT, reason_code TEXT,
+        component_sequence INTEGER,
+        prev_hash TEXT NOT NULL,
+        hash TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS hub_audit_at ON hub_audit(at);
+      CREATE INDEX IF NOT EXISTS hub_audit_exposure ON hub_audit(exposure_id);
+      CREATE INDEX IF NOT EXISTS hub_audit_owner ON hub_audit(owner_at_event);
+      CREATE INDEX IF NOT EXISTS hub_audit_fleet ON hub_audit(fleet_id);
+      CREATE INDEX IF NOT EXISTS hub_audit_message ON hub_audit(message_id);
+      CREATE TABLE IF NOT EXISTS hub_audit_head (singleton INTEGER PRIMARY KEY CHECK(singleton = 1), sequence INTEGER NOT NULL, hash TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS hub_audit_checkpoint (sequence INTEGER PRIMARY KEY, hash TEXT NOT NULL, at INTEGER NOT NULL);
+      CREATE TABLE IF NOT EXISTS hub_audit_content (ref TEXT PRIMARY KEY, record_id TEXT UNIQUE, nonce BLOB NOT NULL, ciphertext BLOB NOT NULL, created_at INTEGER NOT NULL);
+      CREATE INDEX IF NOT EXISTS hub_audit_content_created ON hub_audit_content(created_at);
+      CREATE TABLE IF NOT EXISTS hub_auditors (person_id TEXT PRIMARY KEY, assigned_at INTEGER NOT NULL, assigned_by TEXT NOT NULL);
+    `);
+    },
+});
+const GENESIS = "0".repeat(64);
+const RESULTS = new Set(["allowed", "denied", "held", "completed"]);
+const ACTION = /^[a-z][a-z0-9.-]{0,127}$/;
+const DAY_MS = 86_400_000;
+export class HubAuditAccessError extends Error {
+    constructor(message = "not allowed to read this audit") {
+        super(message);
+        this.name = "HubAuditAccessError";
+    }
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value).filter(([, v]) => v !== undefined);
+        entries.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+/** The fields the hash covers: everything stored except the hash itself. */
+function hashedFields(row) {
+    const { prev_hash: _prev, ...rest } = row;
+    return rest;
+}
+function chainHash(prevHash, row) {
+    return createHash("sha256").update(`${prevHash}\n${canonical(hashedFields(row))}`).digest("hex");
+}
+function parsePersonId(id) {
+    if (!id)
+        return undefined;
+    const slash = id.indexOf("/");
+    return slash > 0 ? { realm: id.slice(0, slash), objectId: id.slice(slash + 1) } : undefined;
+}
+function toRecord(row) {
+    const owner = parsePersonId(row.owner_at_event);
+    return {
+        id: row.id,
+        sequence: row.sequence,
+        at: row.at,
+        requestId: row.request_id,
+        actor: JSON.parse(row.actor),
+        action: row.action,
+        result: row.result,
+        policyVersion: row.policy_version,
+        ...(row.message_id ? { messageId: row.message_id } : {}),
+        ...(row.room_id ? { roomId: row.room_id } : {}),
+        ...(row.fleet_id ? { fleetId: row.fleet_id } : {}),
+        ...(row.exposure_id ? { exposureId: row.exposure_id } : {}),
+        ...(owner ? { ownerAtEvent: owner } : {}),
+        ...(row.grant_id ? { grantId: row.grant_id } : {}),
+        ...(row.grant_revision !== null ? { grantRevision: row.grant_revision } : {}),
+        ...(row.content_ref ? { contentRef: row.content_ref } : {}),
+        ...(row.reason_code ? { reasonCode: row.reason_code } : {}),
+    };
+}
+export function createHubAudit(options) {
+    const { db } = options;
+    if (!Buffer.isBuffer(options.contentKey) || options.contentKey.length !== 32)
+        throw new Error("the Hub content key must be 32 bytes");
+    const key = Buffer.from(options.contentKey);
+    const now = options.now ?? Date.now;
+    const insert = db.prepare(`INSERT INTO hub_audit (sequence, id, at, request_id, actor, action, result, message_id, room_id, fleet_id,
+    exposure_id, owner_at_event, grant_id, grant_revision, policy_version, content_ref, reason_code, component_sequence, prev_hash, hash)
+    VALUES (@sequence, @id, @at, @request_id, @actor, @action, @result, @message_id, @room_id, @fleet_id, @exposure_id, @owner_at_event,
+    @grant_id, @grant_revision, @policy_version, @content_ref, @reason_code, @component_sequence, @prev_hash, @hash)`);
+    const head = () => {
+        const row = db.prepare("SELECT sequence, hash FROM hub_audit_head WHERE singleton = 1").get();
+        return row ?? { sequence: 0, hash: GENESIS };
+    };
+    /** The one write path. Caller guarantees we are inside a transaction on `db`. */
+    const write = (record) => {
+        if (!db.inTransaction)
+            throw new Error("Hub audit is written only inside a transaction");
+        if (!ACTION.test(record.action ?? ""))
+            throw new Error("Hub audit: invalid action");
+        if (!RESULTS.has(record.result))
+            throw new Error("Hub audit: invalid result");
+        if (!Number.isSafeInteger(record.at) || !Number.isSafeInteger(record.policyVersion) || record.policyVersion < 0)
+            throw new Error("Hub audit: invalid time or policy version");
+        if (!record.actor || !["person", "local-host", "member"].includes(record.actor.kind))
+            throw new Error("Hub audit: invalid actor");
+        const prev = head();
+        const row = {
+            sequence: prev.sequence + 1,
+            id: typeof record.id === "string" && record.id ? record.id : randomUUID(),
+            at: record.at,
+            request_id: typeof record.requestId === "string" && record.requestId ? record.requestId : "-",
+            actor: canonical(record.actor),
+            action: record.action,
+            result: record.result,
+            message_id: record.messageId ?? null,
+            room_id: record.roomId ?? null,
+            fleet_id: record.fleetId ?? null,
+            exposure_id: record.exposureId ?? null,
+            owner_at_event: record.ownerAtEvent ? personKeyString(record.ownerAtEvent) : null,
+            grant_id: record.grantId ?? null,
+            grant_revision: record.grantRevision ?? null,
+            policy_version: record.policyVersion,
+            content_ref: record.contentRef ?? null,
+            reason_code: record.reasonCode ?? null,
+            component_sequence: Number.isSafeInteger(record.sequence) ? record.sequence : null,
+            prev_hash: prev.hash,
+        };
+        if (record.contentRef !== undefined)
+            bindContent(record.contentRef, row.id);
+        const hash = chainHash(prev.hash, row);
+        insert.run({ ...row, hash });
+        db.prepare("INSERT INTO hub_audit_head(singleton, sequence, hash) VALUES(1, ?, ?) ON CONFLICT(singleton) DO UPDATE SET sequence = excluded.sequence, hash = excluded.hash").run(row.sequence, hash);
+        return row.sequence;
+    };
+    // GCM authenticated data binds a payload to its ref and, once its record exists, to that record's immutable id
+    // (hub-composition.md §4): a ciphertext moved to another ref or record does not decrypt.
+    const aad = (ref, recordId) => Buffer.from(`${ref}\n${recordId ?? ""}`);
+    const encrypt = (ref, recordId, payload) => {
+        const nonce = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", key, nonce);
+        cipher.setAAD(aad(ref, recordId));
+        const body = Buffer.concat([cipher.update(JSON.stringify(payload), "utf8"), cipher.final(), cipher.getAuthTag()]);
+        return { nonce, body };
+    };
+    const decrypt = (ref, recordId, nonce, body) => {
+        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+        decipher.setAAD(aad(ref, recordId));
+        decipher.setAuthTag(body.subarray(body.length - 16));
+        const plain = Buffer.concat([decipher.update(body.subarray(0, body.length - 16)), decipher.final()]).toString("utf8");
+        return JSON.parse(plain);
+    };
+    /** Inside the record's own transaction: the content row gets the record's id, re-encrypted under it. Once only. */
+    const bindContent = (ref, recordId) => {
+        const row = db.prepare("SELECT record_id, nonce, ciphertext FROM hub_audit_content WHERE ref = ?").get(ref);
+        if (!row)
+            throw new Error("Hub audit: contentRef was not stored in this transaction's database");
+        if (row.record_id !== null)
+            throw new Error("Hub audit: this content already belongs to another record");
+        const payload = decrypt(ref, null, row.nonce, row.ciphertext);
+        const { nonce, body } = encrypt(ref, recordId, payload);
+        db.prepare("UPDATE hub_audit_content SET record_id = ?, nonce = ?, ciphertext = ? WHERE ref = ?").run(recordId, nonce, body, ref);
+    };
+    /** A bound content row, decrypted under its own (ref, record id); `expectedRecordId` must match when given. */
+    const readBound = (ref, expectedRecordId) => {
+        const row = db.prepare("SELECT record_id, nonce, ciphertext FROM hub_audit_content WHERE ref = ?").get(ref);
+        if (!row || row.record_id === null)
+            return undefined;
+        if (expectedRecordId !== undefined && row.record_id !== expectedRecordId)
+            throw new HubAuditAccessError("this content belongs to another record");
+        return decrypt(ref, row.record_id, row.nonce, row.ciphertext);
+    };
+    const sameDb = (tx) => {
+        if (hubTxDatabase(tx) !== db)
+            throw new Error("Hub audit: the transaction belongs to another database");
+    };
+    const content = {
+        put(tx, payload) {
+            sameDb(tx);
+            const clean = {};
+            if (typeof payload.question === "string")
+                clean.question = payload.question;
+            if (typeof payload.answer === "string")
+                clean.answer = payload.answer;
+            if (payload.buttons !== undefined)
+                clean.buttons = payload.buttons;
+            if (payload.pollBallot !== undefined)
+                clean.pollBallot = payload.pollBallot;
+            const ref = randomBytes(16).toString("hex");
+            const { nonce, body } = encrypt(ref, null, clean);
+            db.prepare("INSERT INTO hub_audit_content(ref, record_id, nonce, ciphertext, created_at) VALUES(?, NULL, ?, ?, ?)").run(ref, nonce, body, now());
+            return ref;
+        },
+        get(ref) {
+            if (typeof ref !== "string" || !/^[0-9a-f]{32}$/.test(ref))
+                return undefined;
+            return readBound(ref);
+        },
+    };
+    /**
+     * Who is asking: resolved asynchronously (fresh session and directory eligibility). The scope itself (auditor
+     * assignment, ownership) is decided later, synchronously, in the same transaction that records the read and runs the
+     * query: nothing is awaited between that check and the data leaving.
+     */
+    const identity = async (ctx) => {
+        const actor = await ctx.current();
+        if (actor.kind !== "directory")
+            throw new HubAuditAccessError("audit is read with a directory identity; the local host is not an auditor");
+        const person = await ctx.requirePerson();
+        return { personId: personKeyString(person), actor: { kind: "person", person } };
+    };
+    const isAuditor = (personId) => db.prepare("SELECT 1 FROM hub_auditors WHERE person_id = ?").get(personId) !== undefined;
+    const recordRead = (ctx, actor, action, extra = {}) => {
+        write({ id: randomUUID(), sequence: 0, at: now(), requestId: ctx.requestId, actor, action, result: "completed", policyVersion: 0, ...extra });
+    };
+    return {
+        append(tx, record) {
+            sameDb(tx);
+            write(record);
+        },
+        appendInTransaction(record, database) {
+            if (database !== db)
+                throw new Error("Hub audit: another database");
+            write(record);
+        },
+        content,
+        async read(ctx, scope) {
+            const who = await identity(ctx);
+            return db.transaction(() => {
+                const auditor = isAuditor(who.personId);
+                const where = [];
+                const args = [];
+                if (!auditor) {
+                    where.push("owner_at_event = ?");
+                    args.push(who.personId);
+                }
+                if (scope.exposureId !== undefined) {
+                    where.push("exposure_id = ?");
+                    args.push(scope.exposureId);
+                }
+                if (scope.after !== undefined) {
+                    where.push("sequence > ?");
+                    args.push(scope.after);
+                }
+                // Recorded first, in the same transaction; a failed record fails the read.
+                recordRead(ctx, who.actor, "audit.read", scope.exposureId ? { exposureId: scope.exposureId } : {});
+                const rows = db.prepare(`SELECT * FROM hub_audit ${where.length ? `WHERE ${where.join(" AND ")}` : ""} ORDER BY sequence LIMIT 500`).all(...args);
+                return rows.map(toRecord);
+            }).immediate();
+        },
+        async readContent(ctx, recordId) {
+            const who = await identity(ctx);
+            return db.transaction(() => {
+                const row = db.prepare("SELECT * FROM hub_audit WHERE id = ?").get(recordId);
+                if (!row || (!isAuditor(who.personId) && row.owner_at_event !== who.personId))
+                    throw new HubAuditAccessError();
+                recordRead(ctx, who.actor, "audit.read-content", { ...(row.message_id ? { messageId: row.message_id } : {}) });
+                const payload = row.content_ref ? readBound(row.content_ref, row.id) : undefined;
+                const audience = [];
+                const actor = JSON.parse(row.actor);
+                if (actor.kind === "person")
+                    audience.push(actor.person);
+                const owner = parsePersonId(row.owner_at_event);
+                if (owner && !audience.some((p) => personKeyString(p) === row.owner_at_event))
+                    audience.push(owner);
+                return { recordId: row.id, ...(payload?.question !== undefined ? { question: payload.question } : {}), ...(payload?.answer !== undefined ? { answer: payload.answer } : {}),
+                    ...(payload?.buttons !== undefined ? { buttons: payload.buttons } : {}), ...(payload?.pollBallot !== undefined ? { pollBallot: payload.pollBallot } : {}), audience };
+            }).immediate();
+        },
+        verifyChain() {
+            const checkpoint = db.prepare("SELECT sequence, hash FROM hub_audit_checkpoint ORDER BY sequence DESC LIMIT 1").get();
+            let prev = checkpoint?.hash ?? GENESIS;
+            let expected = (checkpoint?.sequence ?? 0) + 1;
+            let checked = 0;
+            for (const row of db.prepare("SELECT * FROM hub_audit WHERE sequence > ? ORDER BY sequence").iterate(checkpoint?.sequence ?? 0)) {
+                const { hash, ...rest } = row;
+                if (row.sequence !== expected || row.prev_hash !== prev || chainHash(prev, rest) !== hash)
+                    return { ok: false, sequence: row.sequence };
+                prev = hash;
+                expected += 1;
+                checked += 1;
+            }
+            // The head must end exactly where the rows (or the checkpoint, or genesis) end: an erased table or suffix is
+            // a broken chain even when no row is left to check.
+            const h = head();
+            if (h.hash !== prev || h.sequence !== expected - 1)
+                return { ok: false, sequence: h.sequence };
+            return { ok: true, checked };
+        },
+        setAuditor(tx, person, assigned, by, requestId) {
+            sameDb(tx);
+            const id = personKeyString(person);
+            if (assigned)
+                db.prepare("INSERT INTO hub_auditors(person_id, assigned_at, assigned_by) VALUES(?, ?, ?) ON CONFLICT(person_id) DO NOTHING").run(id, now(), canonical(by));
+            else
+                db.prepare("DELETE FROM hub_auditors WHERE person_id = ?").run(id);
+            write({ id: randomUUID(), sequence: 0, at: now(), requestId, actor: by, action: assigned ? "audit.auditor-assigned" : "audit.auditor-removed", result: "completed", policyVersion: 0, ownerAtEvent: person });
+        },
+        purge(retention, retained) {
+            for (const days of [retention.contentDays, retention.eventDays]) {
+                if (!Number.isSafeInteger(days) || days < 1)
+                    throw new Error("Hub retention must be whole days (no default)");
+            }
+            const t = now();
+            return db.transaction(() => {
+                const contentCut = t - retention.contentDays * DAY_MS;
+                const removedContent = db.prepare("DELETE FROM hub_audit_content WHERE created_at < ?").run(contentCut).changes;
+                const eventCut = t - retention.eventDays * DAY_MS;
+                let last;
+                for (const row of db.prepare("SELECT * FROM hub_audit WHERE at < ? ORDER BY sequence").iterate(eventCut)) {
+                    if (retained?.(toRecord(row)))
+                        break;
+                    last = row;
+                }
+                let removedEvents = 0;
+                if (last) {
+                    // A contiguous prefix only, so the chain verifies from the checkpoint onwards.
+                    const lowest = db.prepare("SELECT MIN(sequence) AS s FROM hub_audit").get().s;
+                    const gap = db.prepare("SELECT COUNT(*) AS n FROM hub_audit WHERE sequence BETWEEN ? AND ? AND at >= ?").get(lowest, last.sequence, eventCut);
+                    if (gap.n === 0) {
+                        db.prepare("INSERT INTO hub_audit_checkpoint(sequence, hash, at) VALUES(?, ?, ?) ON CONFLICT(sequence) DO NOTHING").run(last.sequence, last.hash, t);
+                        removedEvents = db.prepare("DELETE FROM hub_audit WHERE sequence <= ?").run(last.sequence).changes;
+                    }
+                }
+                write({ id: randomUUID(), sequence: 0, at: t, requestId: "retention", actor: { kind: "local-host" }, action: "audit.purge", result: "completed", policyVersion: 0, reasonCode: `content:${removedContent},events:${removedEvents}` });
+                return { content: removedContent, events: removedEvents };
+            }).immediate();
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/hub/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hub/audit/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAC;AAG5D,MAAM,CAAC,MAAM,mBAAmB,GAAiB,MAAM,CAAC,MAAM,CAAC;IAC7D,SAAS,EAAE,UAAU;IACrB,OAAO,EAAE,CAAC;IACV,EAAE,CAAC,EAAqB;QACtB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BP,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACpE,MAAM,MAAM,GAAG,0BAA0B,CAAC;AAC1C,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,GAAG,gCAAgC;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAyBD,4EAA4E;AAC5E,SAAS,YAAY,CAAC,GAA2B;IAC/C,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,GAA2B;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,EAAiB;IACtC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa;IAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAA4B;QACvD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAkC;QAC9C,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAsCD,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtI,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEpC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;qHAGyF,CAAC,CAAC;IAErH,MAAM,IAAI,GAAG,GAAuC,EAAE;QACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,EAAoD,CAAC;QAChJ,OAAO,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,KAAK,GAAG,CAAC,MAAsB,EAAU,EAAE;QAC/C,IAAI,CAAC,EAAE,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9K,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;QACpB,MAAM,GAAG,GAA2B;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC;YAC3B,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE;YACzE,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,UAAU,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;YAC7F,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACpC,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;YAC9B,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAChC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACtC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YACjF,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAChC,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC5C,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACtC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACtC,kBAAkB,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAClF,SAAS,EAAE,IAAI,CAAC,IAAI;SACrB,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,EAAE,CAAC,OAAO,CAAC,+JAA+J,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpM,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC,CAAC;IAEF,+GAA+G;IAC/G,yFAAyF;IACzF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,OAA0B,EAAE,EAAE;QACnF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAClH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,KAAa,EAAE,IAAY,EAAqB,EAAE;QACvG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAsB,CAAC;IAChD,CAAC,CAAC;IAEF,mHAAmH;IACnH,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CAAC,GAAG,CAAgF,CAAC;QAC3L,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACjG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxD,EAAE,CAAC,OAAO,CAAC,qFAAqF,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpI,CAAC,CAAC;IAEF,+GAA+G;IAC/G,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,gBAAyB,EAAiC,EAAE;QAC1F,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CAAC,GAAG,CAAgF,CAAC;QAC3L,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,gBAAgB,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB;YAAE,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;QAClJ,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,EAAS,EAAE,EAAE;QAC3B,IAAI,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,OAAO,GAAoB;QAC/B,GAAG,CAAC,EAAE,EAAE,OAAO;YACb,MAAM,CAAC,EAAE,CAAC,CAAC;YACX,MAAM,KAAK,GAAsB,EAAE,CAAC;YACpC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACtE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YACnE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;gBAAE,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAClD,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACjJ,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,GAAG;YACL,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;IAEF;;;;OAIG;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAsB,EAAiE,EAAE;QAC/G,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,mBAAmB,CAAC,2EAA2E,CAAC,CAAC;QAC3I,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC;IAClF,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAEjI,MAAM,UAAU,GAAG,CAAC,GAAsB,EAAE,KAA8B,EAAE,MAAc,EAAE,KAAK,GAA4B,EAAE,EAAE,EAAE;QACjI,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,KAAK,EAAoB,CAAC,CAAC;IAClK,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,EAAE,EAAE,MAAM;YACf,MAAM,CAAC,EAAE,CAAC,CAAC;YACX,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,CAAC;QAED,mBAAmB,CAAC,MAAM,EAAE,QAAQ;YAClC,IAAI,QAAQ,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,CAAC;QAED,OAAO;QAEP,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK;YACnB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAc,EAAE,CAAC;gBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;gBACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBACnC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC9B,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;gBACD,2EAA2E;gBAC3E,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnG,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,2BAA2B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAe,CAAC;gBAChK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ;YAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAyB,CAAC;gBACrG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;gBAC/G,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/G,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,MAAM,QAAQ,GAAgB,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAA4B,CAAC;gBAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAChD,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,cAAc,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzK,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC1K,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;QAED,WAAW;YACT,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,gFAAgF,CAAC,CAAC,GAAG,EAAoD,CAAC;YACxK,IAAI,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,OAAO,CAAC;YACvC,IAAI,QAAQ,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,CAA+B,EAAE,CAAC;gBAC9J,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;gBAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACxI,IAAI,GAAG,IAAI,CAAC;gBACZ,QAAQ,IAAI,CAAC,CAAC;gBACd,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;YACD,6GAA6G;YAC7G,oDAAoD;YACpD,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAED,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS;YAC5C,MAAM,CAAC,EAAE,CAAC,CAAC;YACX,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,QAAQ;gBAAE,EAAE,CAAC,OAAO,CAAC,iHAAiH,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;;gBACrK,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAoB,CAAC,CAAC;QAClO,CAAC;QAED,KAAK,CAAC,SAAS,EAAE,QAAQ;YACvB,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC;gBACtD,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;gBAChH,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,SAAS,GAAG,MAAM,CAAC;gBAClD,IAAI,IAA0B,CAAC;gBAC/B,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,OAAO,CAAC,QAAQ,CAA+B,EAAE,CAAC;oBACvI,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBAAE,MAAM;oBACrC,IAAI,GAAG,GAAG,CAAC;gBACb,CAAC;gBACD,IAAI,aAAa,GAAG,CAAC,CAAC;gBACtB,IAAI,IAAI,EAAE,CAAC;oBACT,+EAA+E;oBAC/E,MAAM,MAAM,GAAI,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;oBACjG,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,gFAAgF,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAkB,CAAC;oBAC/J,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChB,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;wBACrJ,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;oBACrG,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,cAAc,WAAW,aAAa,EAAE,EAAoB,CAAC,CAAC;gBACxP,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC5D,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hub/browser-certificate.d.ts

@@ -0,0 +1,38 @@
+/** Browser TLS selection only. The sealed Hub/member identity and member pins never change here. */
+import type Database from "better-sqlite3";
+import { type HubBrowserCertificateProposal, type HubBrowserCertificateView } from "../hub-browser-certificate-policy.js";
+import type { HubAuditStore } from "./audit/index.js";
+import type { HubMigration } from "./db.js";
+import { type HubBrowserMaterial } from "./init/browser-certificate.js";
+export interface BrowserCertificateMaterial {
+    cert: string;
+    key: string;
+}
+export interface HubBrowserCertificateControl {
+    read(): HubBrowserCertificateView;
+    prepare(input: unknown, binding: string, current: () => boolean): Promise<HubBrowserCertificateProposal>;
+    preview(input: unknown, binding: string): HubBrowserCertificateProposal;
+    apply(input: unknown, binding: string, current: () => boolean): HubBrowserCertificateView;
+}
+export declare function createHubBrowserCertificateControl(options: {
+    db: Database.Database;
+    home: string;
+    hubId: string;
+    origin: string;
+    initial: {
+        certificateFile: string;
+        keyFile: string;
+    };
+    audit: Pick<HubAuditStore, "appendInTransaction">;
+    current(): boolean;
+    now(): number;
+    activate(material: BrowserCertificateMaterial): void;
+    generate?(home: string, origin: string): Promise<HubBrowserMaterial>;
+    monotonic?: () => number;
+}): HubBrowserCertificateControl & {
+    material: () => BrowserCertificateMaterial;
+    activate(): void;
+    close(): Promise<void>;
+};
+/** Seed only when the migration itself runs, including an older initialized Hub's first upgrade. */
+export declare function browserCertificateMigration(hubId: string): HubMigration;