@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/hub/compose/server.d.ts

@@ -0,0 +1,77 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type HubAuditStore, type HubContentStore } from "../audit/index.js";
+import { type HubHoldCode, type HubMigration, type HubStateSet } from "../db.js";
+import type { HubDirectory, HubDirectoryConfig } from "../directory/index.js";
+import type { HubMountedService } from "../mount.js";
+import { HubPairingService } from "../pairing.js";
+import { type HubLinkContext } from "../server.js";
+import { HubTransportStore } from "../store.js";
+import type { HubAskerEnvelope, HubMemberFrame, HubMode, HubPerson, HubServerFrame, HubServerTransport, HubUnitOfWork, PersonKey } from "../types.js";
+import { type HubBrowserCertificateControl } from "../browser-certificate.js";
+import { type HubRetentionControl } from "../retention.js";
+import { type HubPreviewView } from "../preview.js";
+import { HubAttachmentStore } from "../attachments/store.js";
+export declare const SERVER_SET: HubStateSet;
+/** What S3b's createHubHttp receives (agreed in cid-hub-s3b-deps). */
+export interface HubHttpDeps {
+    uow: HubUnitOfWork;
+    audit: HubAuditStore;
+    content: HubContentStore;
+    /** attachments-v1 files under the content key (absent: the Hub offers no upload). */
+    attachments?: HubAttachmentStore;
+    directory: HubDirectory;
+    pairing: HubPairingService;
+    store: HubTransportStore;
+    current(): HubMode;
+    now?: () => number;
+    preview?: Readonly<HubPreviewView>;
+    config: Readonly<{
+        hubId: string;
+        name: string;
+        webOrigin: string;
+        administrator: PersonKey;
+    }>;
+    issuer: {
+        keyId: string;
+        sign(envelope: Omit<HubAskerEnvelope, "signature">): HubAskerEnvelope;
+    };
+    /** null before the member listener runs and after fence/close: S3 answers "unavailable", never queues. */
+    transport(): Pick<HubServerTransport, "send"> | null;
+}
+export interface HubHttp {
+    /** Serve a request under /hub/v1/*; false if the path is not S3's. */
+    handle(req: IncomingMessage, res: ServerResponse): boolean;
+    receive(frame: Exclude<HubMemberFrame, {
+        type: "hello";
+    }>, link: HubLinkContext): Promise<HubServerFrame | void>;
+    close(): Promise<void>;
+}
+export interface HubHttpEntry {
+    createHubHttp(deps: HubHttpDeps): HubHttp;
+    migrations: readonly HubMigration[];
+}
+export interface HubServerComponents {
+    /** S3b's entry (src/hub/http/compose.ts), imported lazily. Missing: hub-incomplete, before any I/O. */
+    http?: () => Promise<HubHttpEntry>;
+}
+export interface HubServerFactoryOptions {
+    home: string;
+    components: HubServerComponents;
+    createDirectory: (config: HubDirectoryConfig, secrets: {
+        bindPassword: string;
+    }) => HubDirectory;
+    /** The specific reason, reported before the factory throws (HubMount itself only knows service-unavailable). */
+    report(code: HubHoldCode, detail: string): void;
+    log(level: "info" | "warn", message: string, meta?: Record<string, unknown>): void;
+    now?: () => number;
+    /** Retention job interval; daily by default. */
+    retentionEveryMs?: number;
+    /** Host Settings only; the disposer removes this exact generation's control. */
+    retentionReady?(control: HubRetentionControl): () => void;
+    browserCertificateReady?(control: HubBrowserCertificateControl): () => void;
+}
+export declare function createHubServerFactory(options: HubServerFactoryOptions): ((cfg: Record<string, unknown>, current: () => boolean) => Promise<HubMountedService>) & {
+    drain: () => Promise<void>;
+};
+export type HubServerFactory = ReturnType<typeof createHubServerFactory>;
+export type { HubPerson };

package/dist/hub/compose/server.js

@@ -0,0 +1,349 @@
+/**
+ * S5b server factory (S-51; docs/design/hub-composition.md §5 "Server"). Called by S1's HubMount only after the sealed
+ * manifest verified. Builds, in order: the private DB and its migrations, the Hub-instance binding, floors and content
+ * key (first creation only), audit + unit of work, S1's transport store and pairing, S2's directory, S3's HTTP entry,
+ * S1's member listener and the Hub web listener. Either the whole service comes back or nothing stays open.
+ */
+import { createPrivateKey, randomBytes } from "node:crypto";
+import { closeSync, openSync, writeSync } from "node:fs";
+import { createServer as createHttpsServer } from "node:https";
+import { createHubAudit, HUB_AUDIT_MIGRATION } from "../audit/index.js";
+import { applyHubMigrations, bindHubInstance, createHubUnitOfWork, HUB_INSTANCE_MIGRATION, HubStateError, inspectStateSet, openHubDatabase, } from "../db.js";
+import { signAsker } from "../identity.js";
+import { BIND_SECRET_REL, bindSecretPath } from "../init/layout.js";
+import { HubPairingService } from "../pairing.js";
+import { ensurePrivateDirectory, readPrivateFile } from "../private-files.js";
+import { HubServer } from "../server.js";
+import { HUB_TRANSPORT_MIGRATION, HubTransportStore } from "../store.js";
+import { readHubIdentity } from "../tls.js";
+import { HubFileVersionFloor } from "../version-floor.js";
+import { browserCertificateMigration, createHubBrowserCertificateControl } from "../browser-certificate.js";
+import { createHubRetentionControl, retentionMigration } from "../retention.js";
+import { createHubPreviewHandler, hubPreviewSettings, hubPreviewView } from "../preview.js";
+import { HUB_ATTACHMENTS_MIGRATION, HubAttachmentStore } from "../attachments/store.js";
+export const SERVER_SET = Object.freeze({
+    database: "hub/hub.sqlite",
+    floors: Object.freeze(["hub/floors/transport"]),
+    keys: Object.freeze(["hub/keys/content.key"]),
+});
+const obj = (v) => (v && typeof v === "object" && !Array.isArray(v) ? v : {});
+const listen = (v, label) => {
+    const o = obj(v);
+    if (typeof o.host !== "string" || !o.host || !Number.isInteger(o.port) || o.port < 0 || o.port > 65535) {
+        throw new HubStateError("hub-unsealed", `hub.${label} is not a listener address`);
+    }
+    return { host: o.host, port: o.port };
+};
+function settingsOf(cfg) {
+    const tls = obj(cfg.webTls);
+    const admin = obj(cfg.administrator);
+    const retention = obj(cfg.retention);
+    const directory = obj(cfg.directory);
+    for (const k of ["hubId", "name", "webOrigin", "memberOrigin"]) {
+        if (typeof cfg[k] !== "string" || !cfg[k])
+            throw new HubStateError("hub-unsealed", `hub.${k} is missing`);
+    }
+    if (typeof tls.certificateFile !== "string" || typeof tls.keyFile !== "string")
+        throw new HubStateError("hub-unsealed", "hub.webTls is missing");
+    if (typeof admin.realm !== "string" || typeof admin.objectId !== "string")
+        throw new HubStateError("hub-unsealed", "hub.administrator is missing");
+    if (!Number.isSafeInteger(retention.contentDays) || !Number.isSafeInteger(retention.eventDays))
+        throw new HubStateError("hub-unsealed", "hub.retention is missing");
+    if (typeof directory.bindPasswordRef !== "string")
+        throw new HubStateError("hub-unsealed", "hub.directory.bindPasswordRef is missing");
+    const webListen = listen(cfg.webListen, "webListen"), memberListen = listen(cfg.memberListen, "memberListen");
+    const preview = hubPreviewSettings({ web: cfg.web, webOrigin: cfg.webOrigin, memberOrigin: cfg.memberOrigin, webListen, memberListen });
+    return {
+        hubId: cfg.hubId,
+        name: cfg.name,
+        webOrigin: cfg.webOrigin,
+        memberOrigin: cfg.memberOrigin,
+        memberListen,
+        webListen,
+        preview,
+        webTls: { certificateFile: tls.certificateFile, keyFile: tls.keyFile },
+        directory: directory,
+        administrator: { realm: admin.realm, objectId: admin.objectId },
+        retention: { contentDays: retention.contentDays, eventDays: retention.eventDays },
+    };
+}
+/**
+ * Ordered cleanup that never pretends: steps run in reverse creation order, each at most once successfully; the first
+ * failure stops the run (no dependency is closed under a component whose own close is unconfirmed) and is reported as
+ * an unconfirmed shutdown. Running it again retries from the failed step.
+ */
+class Teardown {
+    steps = [];
+    add(name, run) {
+        this.steps.push({ name, run, done: false });
+    }
+    get pending() {
+        return this.steps.some((s) => !s.done);
+    }
+    async run() {
+        for (let i = this.steps.length - 1; i >= 0; i -= 1) {
+            const step = this.steps[i];
+            if (step.done)
+                continue;
+            try {
+                await step.run();
+                step.done = true;
+            }
+            catch (err) {
+                throw new HubStateError("service-unavailable", `Hub cleanup of ${step.name} is unconfirmed: ${err.message}`);
+            }
+        }
+    }
+}
+/** Create a private file with random bytes, exclusively (never overwrite). */
+function createKeyFile(home, rel) {
+    ensurePrivateDirectory(home, rel.slice(0, rel.lastIndexOf("/")));
+    const fd = openSync(`${home}/${rel}`, "wx", 0o600);
+    try {
+        writeSync(fd, randomBytes(32).toString("base64"));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function readKeyFile(home, rel) {
+    const key = Buffer.from(readPrivateFile(home, rel, 256).trim(), "base64");
+    if (key.length !== 32)
+        throw new HubStateError("hub-storage", `${rel} is not a 32-byte key`);
+    return key;
+}
+export function createHubServerFactory(options) {
+    const now = options.now ?? Date.now;
+    /** A previous attempt whose cleanup was not confirmed: nothing new is created until it is, and Off/Stop drain it. */
+    let unconfirmed = null;
+    const createServer = async function createServer(cfg, current) {
+        if (unconfirmed) {
+            try {
+                await unconfirmed.run();
+                unconfirmed = null;
+            }
+            catch (err) {
+                options.report("service-unavailable", err.message);
+                throw err;
+            }
+        }
+        const teardown = new Teardown();
+        const fail = async (err) => {
+            try {
+                await teardown.run();
+            }
+            catch (cleanupErr) {
+                unconfirmed = teardown; // kept: retried before any replacement is created
+                options.report("service-unavailable", cleanupErr.message);
+                throw cleanupErr;
+            }
+            const code = err instanceof HubStateError ? err.code : "service-unavailable";
+            options.report(code, err.message);
+            throw err;
+        };
+        try {
+            // 0. Every slice present, before any I/O: no partial server.
+            if (!options.components.http)
+                throw new HubStateError("hub-incomplete", "the Hub web service (S3) is not in this build");
+            const httpEntry = await options.components.http();
+            const settings = settingsOf(cfg);
+            const previewBoot = randomBytes(16).toString("hex");
+            // 1. The private state set: new (create all), complete (open), anything else refused.
+            const state = inspectStateSet(options.home, SERVER_SET);
+            const db = openHubDatabase(options.home, SERVER_SET.database, { create: state === "new" });
+            teardown.add("the Hub database", () => db.close());
+            const floor = new HubFileVersionFloor(options.home, SERVER_SET.floors[0]);
+            if (state === "new") {
+                floor.initialize();
+                createKeyFile(options.home, SERVER_SET.keys[0]);
+            }
+            applyHubMigrations(db, [HUB_INSTANCE_MIGRATION, HUB_AUDIT_MIGRATION, HUB_TRANSPORT_MIGRATION, ...httpEntry.migrations,
+                retentionMigration(settings.hubId, settings.retention), browserCertificateMigration(settings.hubId), HUB_ATTACHMENTS_MIGRATION]);
+            bindHubInstance(db, settings.hubId, state, now());
+            // 2. Audit + unit of work + S1's transport store (its audit goes through the bridge, same transaction).
+            const contentKey = readKeyFile(options.home, SERVER_SET.keys[0]);
+            const audit = createHubAudit({ db, contentKey, now });
+            // attachments-v1 files, under the same content key as audit content.
+            const attachments = new HubAttachmentStore({ contentKey, now });
+            const uow = createHubUnitOfWork(db);
+            const store = new HubTransportStore(db, { floor, appendAudit: (record, database) => audit.appendInTransaction(record, database) });
+            if (state === "new")
+                store.initialize();
+            // 3. S2 directory with the service password from the one accepted private file.
+            if (!bindSecretPath(options.home, settings.directory.bindPasswordRef))
+                throw new HubStateError("hub-directory-secret", "hub.directory.bindPasswordRef is not the private bind file");
+            let bindPassword;
+            try {
+                bindPassword = readPrivateFile(options.home, BIND_SECRET_REL, 4096, { preserveBom: true });
+            }
+            catch (err) {
+                throw new HubStateError("hub-directory-secret", `the directory bind secret is missing or not private: ${err.message}`);
+            }
+            const { bindPasswordRef: _ref, ...directoryConfig } = settings.directory;
+            const directory = options.createDirectory(directoryConfig, { bindPassword });
+            teardown.add("the directory client", () => directory.close?.());
+            // 4. S1 identity, pairing and the member listener; S3's HTTP entry in between (it supplies receive).
+            const identity = readHubIdentity({ home: options.home, memberOrigin: settings.memberOrigin });
+            if (identity.hubId !== settings.hubId)
+                throw new HubStateError("hub-state-mismatch", "the Hub keys belong to another Hub");
+            const issuerKey = createPrivateKey(readPrivateFile(options.home, "hub/keys/issuer-key.pem"));
+            let memberServer = null;
+            let fenced = false;
+            const live = () => !fenced && current();
+            const retention = createHubRetentionControl({ db, hubId: settings.hubId, audit, current: live, now });
+            const pairing = new HubPairingService({
+                store,
+                identity: { hubId: identity.hubId, memberOrigin: settings.memberOrigin, webOrigin: settings.webOrigin, spkiSha256: identity.spkiSha256, issuerPublicKey: identity.issuerPublicKey },
+                directory,
+                enabled: live,
+                now,
+                fenceFleet: (fleetId, reason) => memberServer?.fenceFleet(fleetId, reason),
+            });
+            let generation = 0;
+            const mode = { serverEnabled: live, memberEnabled: () => false, epoch: () => generation };
+            const http = httpEntry.createHubHttp({
+                uow,
+                audit,
+                content: audit.content,
+                attachments,
+                directory,
+                pairing,
+                store,
+                current: () => mode,
+                now,
+                preview: hubPreviewView(settings.webOrigin, settings.preview, previewBoot),
+                config: Object.freeze({ hubId: settings.hubId, name: settings.name, webOrigin: settings.webOrigin, administrator: Object.freeze({ ...settings.administrator }) }),
+                issuer: { keyId: identity.issuerKeyId, sign: (envelope) => signAsker(envelope, issuerKey) },
+                transport: () => (live() && memberServer ? memberServer : null),
+            });
+            teardown.add("the Hub web service (S3)", () => http.close());
+            memberServer = new HubServer({
+                home: options.home,
+                hubId: settings.hubId,
+                memberOrigin: settings.memberOrigin,
+                listen: settings.memberListen,
+                pairing,
+                current: live,
+                receive: (frame, link) => http.receive(frame, link),
+                hold: (fleetId, code) => options.log("warn", "Hub member link held", { fleetId, code }),
+            });
+            teardown.add("the member listener", () => memberServer?.close());
+            // 5. The Hub web listener: every request goes to S3's handler (it serves /hub/v1/*, the Hub-only shell and its
+            //    assets without fleet cookies); anything it declines is 404. The personal fleet listener is untouched.
+            let web = null;
+            let preview = null;
+            const browserCertificate = createHubBrowserCertificateControl({ db, home: options.home, hubId: settings.hubId, origin: settings.webOrigin,
+                initial: settings.webTls, audit, current: live, now, activate: material => {
+                    if (!web || !live())
+                        throw Error("unavailable");
+                    web.setSecureContext({ ...material, minVersion: "TLSv1.2" });
+                    preview?.setSecureContext({ ...material, minVersion: "TLSv1.2" });
+                } });
+            teardown.add("browser certificate preparation", () => browserCertificate.close());
+            let retentionTimer = null;
+            const serveWeb = (req, res) => {
+                if (!live()) {
+                    res.writeHead(503, { "Content-Type": "application/json", "Cache-Control": "no-store" }).end('{"code":"unavailable"}');
+                    return;
+                }
+                if (http.handle(req, res))
+                    return;
+                res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" }).end("Not found");
+            };
+            return {
+                async start() {
+                    if (!live())
+                        throw new HubStateError("service-unavailable", "the Hub was switched off while starting");
+                    try {
+                        await memberServer.start();
+                        if (settings.preview) {
+                            const server = createHttpsServer({ ...browserCertificate.material(), minVersion: "TLSv1.2" }, createHubPreviewHandler(settings.preview, settings.webOrigin, previewBoot, live));
+                            preview = server;
+                            teardown.add("the Hub preview listener", () => {
+                                server.closeAllConnections?.();
+                                return new Promise((resolve, reject) => server.close(err => err && err.code !== "ERR_SERVER_NOT_RUNNING" ? reject(err) : resolve()));
+                            });
+                            await new Promise((resolve, reject) => {
+                                server.once("error", reject);
+                                server.listen(settings.preview.port, settings.preview.host, () => { server.removeListener("error", reject); resolve(); });
+                            });
+                        }
+                        const server = createHttpsServer({ ...browserCertificate.material(), minVersion: "TLSv1.2" }, serveWeb);
+                        teardown.add("the Hub web listener", () => {
+                            if (web !== server)
+                                return;
+                            server.closeAllConnections?.();
+                            return new Promise((resolve, reject) => server.close((err) => (err && err.code !== "ERR_SERVER_NOT_RUNNING" ? reject(err) : resolve())));
+                        });
+                        web = server;
+                        await new Promise((resolve, reject) => {
+                            server.once("error", reject);
+                            server.listen(settings.webListen.port, settings.webListen.host, () => {
+                                server.removeListener("error", reject);
+                                resolve();
+                            });
+                        });
+                        browserCertificate.activate();
+                        const detachCertificate = options.browserCertificateReady?.(browserCertificate);
+                        if (detachCertificate)
+                            teardown.add("the host browser certificate Settings", detachCertificate);
+                        retentionTimer = setInterval(() => {
+                            if (!live())
+                                return;
+                            try {
+                                const policy = retention.read();
+                                audit.purge(policy);
+                                // Files follow the content policy; expired uploads and unfinished transfers go too.
+                                db.transaction(() => attachments.purge(db, now() - policy.contentDays * 86_400_000)).immediate();
+                            }
+                            catch (err) {
+                                options.log("warn", "Hub retention could not run", { err: err.message });
+                            }
+                        }, options.retentionEveryMs ?? 86_400_000);
+                        retentionTimer.unref();
+                        const timer = retentionTimer;
+                        teardown.add("the retention timer", () => clearInterval(timer));
+                        const detach = options.retentionReady?.(retention);
+                        if (detach)
+                            teardown.add("the host retention Settings", detach);
+                    }
+                    catch (err) {
+                        options.report(err instanceof HubStateError ? err.code : "service-unavailable", err.message);
+                        throw err;
+                    }
+                },
+                fence() {
+                    fenced = true;
+                    generation += 1;
+                    memberServer?.fence();
+                },
+                async close() {
+                    fenced = true;
+                    // Rejects while any step is unconfirmed; S1 keeps ownership and retries this close before any replacement.
+                    await teardown.run();
+                },
+                /** Test and diagnostics seams (not part of HubMountedService). */
+                webAddress: () => web?.address() ?? null,
+                memberAddress: () => memberServer?.address() ?? null,
+                previewAddress: () => preview?.address() ?? null,
+                audit,
+            };
+        }
+        catch (err) {
+            return fail(err);
+        }
+    };
+    /**
+     * The factory owns what a failed creation could not clean up (HubMount never received a service for it). The runtime
+     * calls drain() when the Hub is switched off and when it stops: it retries that cleanup and rejects while it still
+     * fails, so the leftover stays owned and reported instead of being forgotten.
+     */
+    const drain = async () => {
+        if (!unconfirmed)
+            return;
+        await unconfirmed.run();
+        unconfirmed = null;
+    };
+    return Object.assign(createServer, { drain });
+}
+//# sourceMappingURL=server.js.map

package/dist/hub/compose/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/hub/compose/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAe,MAAM,YAAY,CAAC;AAG5E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAA4C,MAAM,mBAAmB,CAAC;AAClH,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,eAAe,GAIhB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAuB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAqC,MAAM,2BAA2B,CAAC;AAC/I,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAA4B,MAAM,iBAAiB,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,cAAc,EAAgD,MAAM,eAAe,CAAC;AAC1I,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAExF,MAAM,CAAC,MAAM,UAAU,GAAgB,MAAM,CAAC,MAAM,CAAC;IACnD,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;CAC9C,CAAC,CAAC;AAmEH,MAAM,GAAG,GAAG,CAAC,CAAU,EAA2B,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7I,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,EAAE;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAK,CAAC,CAAC,IAAe,GAAG,CAAC,IAAK,CAAC,CAAC,IAAe,GAAG,KAAK,EAAE,CAAC;QAC/H,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,OAAO,KAAK,4BAA4B,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,SAAS,UAAU,CAAC,GAA4B;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IACjJ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;IACnJ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IACpK,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAC;IACvI,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAmB,EAAE,YAAY,EAAE,GAAG,CAAC,YAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5J,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAc;QACxB,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,YAAY,EAAE,GAAG,CAAC,YAAsB;QACxC,YAAY;QACZ,SAAS;QACT,OAAO;QACP,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACtE,SAAS,EAAE,SAAmD;QAC9D,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QAC/D,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAqB,EAAE,SAAS,EAAE,SAAS,CAAC,SAAmB,EAAE;KACtG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,QAAQ;IACK,KAAK,GAA0D,EAAE,CAAC;IACnF,GAAG,CAAC,IAAY,EAAE,GAAkB;QAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,GAAG;QACP,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI;gBAAE,SAAS;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,CAAC,IAAI,oBAAqB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1H,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAY,EAAE,GAAW;IAC9C,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,GAAG,GAAG,uBAAuB,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,qHAAqH;IACrH,IAAI,WAAW,GAAoB,IAAI,CAAC;IACxC,MAAM,YAAY,GAAG,KAAK,UAAU,YAAY,CAAC,GAA4B,EAAE,OAAsB;QACnG,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC;gBACxB,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;gBAC9D,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAAkB,EAAE;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,WAAW,GAAG,QAAQ,CAAC,CAAC,kDAAkD;gBAC1E,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAG,UAAoB,CAAC,OAAO,CAAC,CAAC;gBACrE,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAgB,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC1F,OAAO,CAAC,MAAM,CAAC,IAAI,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC;QACF,IAAI,CAAC;YACH,6DAA6D;YAC7D,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI;gBAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;YACzH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAEpD,sFAAsF;YACtF,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACxD,MAAM,EAAE,GAAsB,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;YAC9G,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YAC3E,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,KAAK,CAAC,UAAU,EAAE,CAAC;gBACnB,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YACnD,CAAC;YACD,kBAAkB,CAAC,EAAE,EAAE,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC,UAAU;gBACnH,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnI,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAElD,wGAAwG;YACxG,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,qEAAqE;YACrE,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnI,IAAI,KAAK,KAAK,KAAK;gBAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YAExC,gFAAgF;YAChF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,4DAA4D,CAAC,CAAC;YACrL,IAAI,YAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,wDAAyD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,eAAe,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;YACzE,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,eAAqC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACnG,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAE,SAA6C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAErG,qGAAqG;YACrG,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9F,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;gBAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC;YAC3H,MAAM,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAC7F,IAAI,YAAY,GAAqB,IAAI,CAAC;YAC1C,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,yBAAyB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtG,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;gBACpC,KAAK;gBACL,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;gBACnL,SAAS;gBACT,OAAO,EAAE,IAAI;gBACb,GAAG;gBACH,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;aAC3E,CAAC,CAAC;YACH,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,MAAM,IAAI,GAAY,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;YACnG,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;gBACnC,GAAG;gBACH,KAAK;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW;gBACX,SAAS;gBACT,OAAO;gBACP,KAAK;gBACL,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;gBACnB,GAAG;gBACH,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;gBAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;gBACjK,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE;gBAC3F,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC,CAAC,CAAE,YAA4D,CAAC,CAAC,CAAC,IAAI,CAAC;aACjH,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,YAAY,GAAG,IAAI,SAAS,CAAC;gBAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,MAAM,EAAE,QAAQ,CAAC,YAAY;gBAC7B,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;gBACnD,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACxF,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjE,+GAA+G;YAC/G,2GAA2G;YAC3G,IAAI,GAAG,GAAkB,IAAI,CAAC;YAC9B,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,MAAM,kBAAkB,GAAG,kCAAkC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS;gBACvI,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACxE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE;wBAAE,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;oBAChD,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC7D,OAAO,EAAE,gBAAgB,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;gBACpE,CAAC,EAAE,CAAC,CAAC;YACP,QAAQ,CAAC,GAAG,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC;YAClF,IAAI,cAAc,GAA0B,IAAI,CAAC;YACjD,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;gBAC7D,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;oBACtH,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;oBAAE,OAAO;gBAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpH,CAAC,CAAC;YAEF,OAAO;gBACL,KAAK,CAAC,KAAK;oBACT,IAAI,CAAC,IAAI,EAAE;wBAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;oBACvG,IAAI,CAAC;wBACH,MAAM,YAAa,CAAC,KAAK,EAAE,CAAC;wBAC5B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;4BACrB,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAC1F,uBAAuB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;4BACpF,OAAO,GAAG,MAAM,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,GAAG,EAAE;gCAC5C,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;gCAC/B,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;4BACxK,CAAC,CAAC,CAAC;4BACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gCAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gCAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;4BAC9H,CAAC,CAAC,CAAC;wBACL,CAAC;wBACD,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAC3D,QAAQ,CACT,CAAC;wBACF,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE;4BACxC,IAAI,GAAG,KAAK,MAAM;gCAAE,OAAO;4BAC3B,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;4BAC/B,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC5K,CAAC,CAAC,CAAC;wBACH,GAAG,GAAG,MAAM,CAAC;wBACb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;4BAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;4BAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE;gCACnE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gCACvC,OAAO,EAAE,CAAC;4BACZ,CAAC,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC;wBACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC;wBAC9B,MAAM,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,kBAAkB,CAAC,CAAC;wBAChF,IAAI,iBAAiB;4BAAE,QAAQ,CAAC,GAAG,CAAC,uCAAuC,EAAE,iBAAiB,CAAC,CAAC;wBAChG,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;4BAChC,IAAI,CAAC,IAAI,EAAE;gCAAE,OAAO;4BACpB,IAAI,CAAC;gCACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;gCAChC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gCACpB,oFAAoF;gCACpF,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;4BACnG,CAAC;4BAAC,OAAO,GAAG,EAAE,CAAC;gCACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;4BACtF,CAAC;wBACH,CAAC,EAAE,OAAO,CAAC,gBAAgB,IAAI,UAAU,CAAC,CAAC;wBAC3C,cAAc,CAAC,KAAK,EAAE,CAAC;wBACvB,MAAM,KAAK,GAAG,cAAc,CAAC;wBAC7B,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;wBAChE,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;wBACnD,IAAI,MAAM;4BAAE,QAAQ,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;oBAClE,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;wBACxG,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,KAAK;oBACH,MAAM,GAAG,IAAI,CAAC;oBACd,UAAU,IAAI,CAAC,CAAC;oBAChB,YAAY,EAAE,KAAK,EAAE,CAAC;gBACxB,CAAC;gBACD,KAAK,CAAC,KAAK;oBACT,MAAM,GAAG,IAAI,CAAC;oBACd,2GAA2G;oBAC3G,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACvB,CAAC;gBACD,kEAAkE;gBAClE,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI;gBACxC,aAAa,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI;gBACpD,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI;gBAChD,KAAK;aACyC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF;;;;OAIG;IACH,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC;QACxB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/hub/compose/views.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Where a member's approved data views come from (S-51 PR 2b). One interface, so the owner-approval flow decided under
+ * #3095 §7 Q2 (the leader recommends: the owner picks files or folders in Settings, previews exactly what is included,
+ * confirms; snapshotted immutable at approval, re-approved to change) plugs in later without touching composition.
+ * Until then the registry is EMPTY: no exposure is publishable or askable (fail closed).
+ */
+import type { HubDocumentView } from "../execution/index.js";
+export interface HubViewSource {
+    /** The owner-approved, immutable views in force now. Called once per member mount. */
+    load(): ReadonlyMap<string, HubDocumentView>;
+}
+export declare const EMPTY_VIEW_SOURCE: HubViewSource;

package/dist/hub/compose/views.js

@@ -0,0 +1,4 @@
+export const EMPTY_VIEW_SOURCE = Object.freeze({
+    load: () => new Map(),
+});
+//# sourceMappingURL=views.js.map

package/dist/hub/compose/views.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../src/hub/compose/views.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,MAAM,iBAAiB,GAAkB,MAAM,CAAC,MAAM,CAAC;IAC5D,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,EAA2B;CAC/C,CAAC,CAAC"}

package/dist/hub/db.d.ts

@@ -0,0 +1,56 @@
+/**
+ * S5b (S-51; docs/design/hub-composition.md §3–§4): the Hub's private databases. Opening with private modes from the
+ * first byte, the per-slice migration registry, the "created together" set check, the Hub-instance binding, and the
+ * unit of work (HubUnitOfWork) with `hubTxDatabase` for slices that run their own statements inside it.
+ * Nothing here runs on import; only composition calls it, and only while a Hub switch is on.
+ */
+import Database from "better-sqlite3";
+import type { HubTx, HubUnitOfWork } from "./types.js";
+/** Composition's closed set of hold reasons (hub-composition.md §2). Each has fleet text (locale "hub.hold.<code>"). */
+export declare const HUB_HOLD_CODES: readonly ["hub-incomplete", "hub-unsealed", "hub-state-newer", "hub-state-mismatch", "hub-storage", "hub-directory-secret", "hub-member-pairing", "hub-provider-unavailable", "service-unavailable"];
+export type HubHoldCode = (typeof HUB_HOLD_CODES)[number];
+export declare class HubStateError extends Error {
+    readonly code: HubHoldCode;
+    constructor(code: HubHoldCode, message: string);
+}
+/** One slice's schema step. `up` must be idempotent for its own version (CREATE … IF NOT EXISTS). */
+export interface HubMigration {
+    readonly component: string;
+    readonly version: number;
+    up(db: Database.Database): void;
+}
+/**
+ * The files composition creates together on one side (§3), relative to the AgEnD home. Prerequisites written earlier
+ * (S1's identity keys, the sealed manifest, pairing files) are never part of a set.
+ */
+export interface HubStateSet {
+    readonly database: string;
+    readonly floors: readonly string[];
+    readonly keys: readonly string[];
+}
+export type HubSetState = "new" | "complete";
+/** "new" when no member of the set exists, "complete" when all do; anything else is hub-state-mismatch. */
+export declare function inspectStateSet(home: string, set: HubStateSet): HubSetState;
+/**
+ * Open (or, with `create`, first create) a private SQLite database at `rel` under `home`. The file is created 0600
+ * before SQLite touches it; its directory is a private, owned, non-symlink chain (S1's privatePath). WAL/SHM files are
+ * checked to be private after the journal mode is set.
+ */
+export declare function openHubDatabase(home: string, rel: string, options: {
+    create: boolean;
+}): Database.Database;
+/**
+ * Apply every slice's migrations in one immediate transaction. A component stored with a higher version than this
+ * build knows, or a component this build does not know at all, means a newer build wrote the database: refuse.
+ */
+export declare function applyHubMigrations(db: Database.Database, migrations: readonly HubMigration[]): void;
+/** The database's Hub (or member's Hub) id: written once at creation, compared on every open. */
+export declare const HUB_INSTANCE_MIGRATION: HubMigration;
+export declare function bindHubInstance(db: Database.Database, hubId: string, mode: HubSetState, now: number): void;
+/**
+ * The database behind a live transaction, for a slice's own statements (S3's repositories). Throws once the
+ * transaction has committed or rolled back, so a leaked handle cannot write outside a transaction.
+ */
+export declare function hubTxDatabase(tx: HubTx): Database.Database;
+/** HubUnitOfWork over one database: immediate transactions; nested calls are savepoints; async work is refused. */
+export declare function createHubUnitOfWork(db: Database.Database): HubUnitOfWork;