@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/hub/http/core.js

@@ -0,0 +1,124 @@
+/**
+ * AgEnD Hub P1, slice 3: the pieces every S3 service shares — the clock, one atomic unit with its audit, the person
+ * rows and the fresh directory check (with its concurrency bound). No I/O on import.
+ */
+import { randomUUID } from "node:crypto";
+import { HubProtocolError } from "../validation.js";
+import { personKeyString } from "../identity.js";
+/** At most this many directory checks in flight per person, and in all; more is backpressure (429), never a cached allow. */
+export const DIRECTORY_PER_PERSON = 4;
+export const DIRECTORY_TOTAL = 32;
+export class HubCore {
+    deps;
+    sql;
+    inflight = new Map();
+    total = 0;
+    constructor(deps, sql) {
+        this.deps = deps;
+        this.sql = sql;
+    }
+    now() { return this.deps.now?.() ?? Date.now(); }
+    /** Refuses once the server is fenced (and before every write: a stale continuation never commits). */
+    live() { try {
+        return this.deps.current().serverEnabled() === true;
+    }
+    catch {
+        return false;
+    } }
+    check() { if (!this.live())
+        throw new HubProtocolError("unavailable"); }
+    /** One synchronous unit of work on the Hub DB; a promise returned from `work` is refused. */
+    atomic(work) {
+        this.check();
+        return this.deps.uow.atomic((tx) => {
+            this.check();
+            const out = work(this.sql(tx), tx);
+            if (out && typeof out.then === "function")
+                throw new HubProtocolError("invalid");
+            return out;
+        });
+    }
+    /** Audit inside the caller's transaction: a failed append aborts the whole unit (hub.md §4). */
+    audit(tx, event) {
+        const { at, ...rest } = event;
+        let policyVersion = 0;
+        try {
+            policyVersion = this.deps.store.read().revocationVersion;
+        }
+        catch {
+            throw new HubProtocolError("uncertain");
+        }
+        this.deps.audit.append(tx, { ...rest, id: randomUUID(), sequence: 0, at: at ?? this.now(), policyVersion });
+    }
+    revocationVersion() {
+        try {
+            return this.deps.store.read().revocationVersion;
+        }
+        catch {
+            throw new HubProtocolError("uncertain");
+        }
+    }
+    /**
+     * A fresh directory eligibility check (no allow-cache). Ineligible or unreachable is denied; the person's row records
+     * what was seen. Bounded per person and in all — over the bound is "backpressure".
+     */
+    async eligible(person) { return (await this.current(person)) !== null; }
+    /**
+     * The person as the directory has them now (its current login and name), or null when they are not eligible. The
+     * person's row takes the current login label, so a rename never leaves an old label pointing at them.
+     */
+    async current(person) {
+        const id = personKeyString(person);
+        const mine = this.inflight.get(id) ?? 0;
+        if (mine >= DIRECTORY_PER_PERSON || this.total >= DIRECTORY_TOTAL)
+            throw new HubProtocolError("backpressure");
+        this.inflight.set(id, mine + 1);
+        this.total++;
+        try {
+            const r = await this.deps.directory.checkEligibility(person);
+            const ok = r.eligible && personKeyString(r.person.key) === id;
+            this.check();
+            this.atomic((db) => {
+                db.prepare("UPDATE hub_people SET status=?, last_checked_at=? WHERE person=?")
+                    .run(ok ? "active" : r.eligible ? "unknown" : r.reason === "unavailable" ? "unknown" : "disabled", this.now(), id);
+                if (ok && r.eligible && typeof r.person.login === "string" && r.person.login)
+                    db.prepare("UPDATE hub_people SET login_label=? WHERE person=?").run(r.person.login.slice(0, 256), id);
+                if (!ok && !(!r.eligible && r.reason === "unavailable"))
+                    db.prepare("UPDATE hub_sessions SET state='ended' WHERE person=? AND state='active'").run(id);
+            });
+            return ok && r.eligible ? { login: r.person.login, ...(r.person.displayName ? { displayName: r.person.displayName } : {}) } : null;
+        }
+        finally {
+            const n = (this.inflight.get(id) ?? 1) - 1;
+            if (n > 0)
+                this.inflight.set(id, n);
+            else
+                this.inflight.delete(id);
+            this.total--;
+        }
+    }
+}
+export const personFromRow = (row) => ({ realm: row.realm, objectId: row.object_id });
+export function personFromString(id) {
+    const at = id.indexOf("/");
+    return { realm: id.slice(0, at), objectId: id.slice(at + 1) };
+}
+/**
+ * A login label → the one Hub person it names NOW: exactly one row carries it (a shared or unknown label is refused),
+ * and the directory's current login for that person is still that label (a rename — and a colleague later given the old
+ * login — never redirects a grant or a pairing to the wrong person). Null otherwise.
+ */
+export async function personByLogin(core, login) {
+    const label = login.trim();
+    if (!label)
+        return null;
+    const id = core.atomic((db) => {
+        const rows = db.prepare("SELECT person FROM hub_people WHERE login_label=? COLLATE NOCASE").all(label);
+        return rows.length === 1 ? rows[0].person : null;
+    });
+    if (!id)
+        return null;
+    const person = personFromString(id), now = await core.current(person);
+    return now && now.login.toLowerCase() === label.toLowerCase() ? person : null;
+}
+//# sourceMappingURL=core.js.map

package/dist/hub/http/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/hub/http/core.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMjD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,MAAM,OAAO,OAAO;IAGG,IAAI;IAAgC,GAAG;IAF3C,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,GAAG,CAAC,CAAC;IAClB,YAAqB,IAAiB,EAAmB,GAAkB;oBAAtD,IAAI;mBAAgC,GAAG;IAAkB,CAAC;IAC/E,GAAG,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzD,sGAAsG;IACtG,IAAI,KAAc,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC,CAAC,CAAC;IACxG,KAAK,KAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9E,6FAA6F;IAC7F,MAAM,CAAI,IAA6C;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,GAAG,IAAI,OAAQ,GAA0B,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACzG,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IACD,gGAAgG;IAChG,KAAK,CAAC,EAAS,EAAE,KAAoB;QACnC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC;YAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QACpH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,iBAAiB;QACf,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;IAC7G,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAiB,IAAsB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACrG;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAiB;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,IAAI,oBAAoB,IAAI,IAAI,CAAC,KAAK,IAAI,eAAe;YAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;gBACjB,EAAE,CAAC,OAAO,CAAC,kEAAkE,CAAC;qBAC3E,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;gBACrH,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK;oBAAE,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrL,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;oBAAE,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzJ,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrI,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;;gBAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAyC,EAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AACvI,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,KAAa;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,kEAAkE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAyB,CAAC;QAC/H,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC"}

package/dist/hub/http/deps.d.ts

@@ -0,0 +1,61 @@
+/**
+ * AgEnD Hub P1, slice 3 (server side): what S5's server factory hands `createHubHttp` (docs/design/hub-composition.md §5
+ * step 5, agreed with S5 on cid-hub-s3b-deps). Types only — importing this file creates no state.
+ */
+import type Database from "better-sqlite3";
+import type { HubAskerEnvelope, HubAuditSink, HubDirectory, HubMode, HubServerTransport, HubTx, HubUnitOfWork, PersonKey } from "../types.js";
+import type { HubPairingService } from "../pairing.js";
+import type { HubTransportStore } from "../store.js";
+import type { HubAnswerButtons } from "../types.js";
+import type { HubPollBallot } from "../types.js";
+/** The `hub` section the sealed manifest covers — frozen, validated, never re-read from a request. */
+export interface HubHttpConfig {
+    readonly hubId: string;
+    readonly name: string;
+    readonly webOrigin: string;
+    readonly administrator: PersonKey;
+}
+/** S1's `signAsker` over `hub/keys/issuer-key.pem`; S3 never opens a key file. */
+export interface HubIssuer {
+    readonly keyId: string;
+    sign(envelope: Omit<HubAskerEnvelope, "signature">): HubAskerEnvelope;
+}
+/** Encrypted question/answer payloads (S5, under content.key). One payload per record; S5 chooses the ref. */
+export interface HubContentStore {
+    put(tx: HubTx, payload: {
+        question?: string;
+        answer?: string;
+        buttons?: HubAnswerButtons;
+        pollBallot?: HubPollBallot;
+    }): string;
+    /** S3's own room projection only, after its audience check. Undefined: retention removed it (shown as expired). */
+    get(ref: string): {
+        question?: string;
+        answer?: string;
+        buttons?: HubAnswerButtons;
+        pollBallot?: HubPollBallot;
+    } | undefined;
+}
+export interface HubHttpDeps {
+    uow: HubUnitOfWork;
+    audit: HubAuditSink;
+    directory: HubDirectory;
+    pairing: HubPairingService;
+    store: HubTransportStore;
+    config: HubHttpConfig;
+    preview?: Readonly<import("../preview.js").HubPreviewView>;
+    issuer: HubIssuer;
+    /** Re-read on every use: null before HubServer exists and after fence/close — then work is unavailable, never queued. */
+    transport(): Pick<HubServerTransport, "send"> | null;
+    content: HubContentStore;
+    /** attachments-v1 files (absent: this Hub stores none, and offers no upload). */
+    attachments?: import("../attachments/store.js").HubAttachmentStore;
+    /** The server's mode (S5): `serverEnabled()` false once fenced — every request and continuation refuses from then on. */
+    current(): HubMode;
+    now?: () => number;
+}
+/**
+ * S5's `hubTxDatabase(tx)` (db.ts): the DB behind a tx, valid only while that tx's `atomic` callback runs. Passed in
+ * until S5's db.ts lands, then imported by compose.ts.
+ */
+export type HubTxDatabase = (tx: HubTx) => Database.Database;

package/dist/hub/http/deps.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deps.js.map

package/dist/hub/http/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/hub/http/deps.ts"],"names":[],"mappings":""}

package/dist/hub/http/schema.d.ts

@@ -0,0 +1,14 @@
+/**
+ * AgEnD Hub P1, slice 3: S3's own tables in the Hub server DB (`hub/hub.sqlite`), as S5 `HubMigration`s (component
+ * "s3-http"). Nothing migrates on import; S5 runs `up` inside its immediate migration transaction.
+ *
+ * No question or answer text lives here: rooms keep S5 content refs (encrypted under content.key). Session and CSRF
+ * secrets are kept only as SHA-256 digests.
+ */
+import type Database from "better-sqlite3";
+export interface HubHttpMigration {
+    readonly component: string;
+    readonly version: number;
+    up(db: Database.Database): void;
+}
+export declare const HUB_HTTP_MIGRATIONS: readonly HubHttpMigration[];

package/dist/hub/http/schema.js

@@ -0,0 +1,80 @@
+import { HUB_BUTTONS_MIGRATION } from "../buttons.js";
+const V1 = `
+CREATE TABLE hub_people (
+  person TEXT PRIMARY KEY,                       -- personKeyString(key)
+  realm TEXT NOT NULL, object_id TEXT NOT NULL,
+  display_name TEXT NOT NULL, login_label TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('active','disabled','unknown')),
+  last_checked_at INTEGER NOT NULL
+);
+CREATE INDEX hub_people_login ON hub_people(login_label);
+CREATE TABLE hub_sessions (
+  token_hash TEXT PRIMARY KEY,
+  id TEXT NOT NULL UNIQUE,
+  person TEXT NOT NULL REFERENCES hub_people(person),
+  created_at INTEGER NOT NULL, seen_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('active','ended'))
+);
+CREATE INDEX hub_sessions_person ON hub_sessions(person, state);
+CREATE TABLE hub_catalog_cursor (
+  fleet_id TEXT PRIMARY KEY, revision INTEGER NOT NULL, digest TEXT NOT NULL, at INTEGER NOT NULL
+);
+CREATE TABLE hub_exposures (
+  id TEXT PRIMARY KEY, fleet_id TEXT NOT NULL, owner TEXT NOT NULL,
+  display_name TEXT NOT NULL, revision INTEGER NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('published','withdrawn','frozen')),
+  data_view_id TEXT NOT NULL, allowed_tools TEXT NOT NULL, policy_digest TEXT NOT NULL,
+  frozen_through INTEGER NOT NULL DEFAULT -1,     -- a Hub-side freeze holds every revision up to this one
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX hub_exposures_owner ON hub_exposures(owner);
+CREATE INDEX hub_exposures_fleet ON hub_exposures(fleet_id);
+CREATE TABLE hub_grants (
+  id TEXT PRIMARY KEY, revision INTEGER NOT NULL, owner TEXT NOT NULL,
+  exposure_id TEXT NOT NULL REFERENCES hub_exposures(id), exposure_revision INTEGER NOT NULL,
+  approved_by TEXT NOT NULL, approved_at INTEGER NOT NULL, subject TEXT NOT NULL,
+  permissions TEXT NOT NULL, starts_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('active','revoked'))
+);
+CREATE INDEX hub_grants_subject ON hub_grants(subject, state);
+CREATE INDEX hub_grants_exposure ON hub_grants(exposure_id, state);
+CREATE TABLE hub_rooms (
+  id TEXT PRIMARY KEY, asker TEXT NOT NULL, exposure_id TEXT NOT NULL, owner_at_creation TEXT NOT NULL,
+  grant_id TEXT NOT NULL REFERENCES hub_grants(id),
+  state TEXT NOT NULL CHECK (state IN ('active','held','closed')), created_at INTEGER NOT NULL,
+  UNIQUE (asker, exposure_id, grant_id)
+);
+CREATE TABLE hub_messages (
+  id TEXT PRIMARY KEY, room_id TEXT NOT NULL REFERENCES hub_rooms(id),
+  idempotency_key TEXT NOT NULL, sequence INTEGER NOT NULL,
+  fleet_id TEXT NOT NULL, exposure_id TEXT NOT NULL, exposure_revision INTEGER NOT NULL,
+  grant_id TEXT NOT NULL, grant_revision INTEGER NOT NULL, asker TEXT NOT NULL, owner TEXT NOT NULL,
+  content_digest TEXT NOT NULL, question_ref TEXT NOT NULL,
+  stage TEXT NOT NULL, member_sequence INTEGER NOT NULL DEFAULT 0, reason_code TEXT, stage_at INTEGER NOT NULL,
+  sent_epoch INTEGER NOT NULL DEFAULT 0,
+  answer_id TEXT, answer_digest TEXT, answer_ref TEXT,
+  created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+  UNIQUE (room_id, idempotency_key), UNIQUE (room_id, sequence)
+);
+CREATE INDEX hub_messages_fleet ON hub_messages(fleet_id, stage);
+CREATE TABLE hub_receipts (
+  fleet_id TEXT NOT NULL, sequence INTEGER NOT NULL, message_id TEXT NOT NULL, content_digest TEXT NOT NULL,
+  stage TEXT NOT NULL, at INTEGER NOT NULL, member_delivery_id TEXT, reason_code TEXT,
+  PRIMARY KEY (fleet_id, sequence)
+);
+CREATE TABLE hub_leases (
+  decision_id TEXT PRIMARY KEY, fleet_id TEXT NOT NULL, link_epoch INTEGER NOT NULL,
+  message_id TEXT NOT NULL, operation_id TEXT NOT NULL, phase TEXT NOT NULL, operation_digest TEXT NOT NULL,
+  exposure_revision INTEGER NOT NULL, revocation_version INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+  consumed INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX hub_leases_message ON hub_leases(message_id);
+`;
+export const HUB_HTTP_MIGRATIONS = Object.freeze([
+    Object.freeze({ component: "s3-http", version: 1, up: (db) => { db.exec(V1); } }),
+    Object.freeze({ component: "s3-quota", version: 1, up: (db) => {
+            db.exec("CREATE TABLE hub_quota_preferences(exposure_id TEXT PRIMARY KEY REFERENCES hub_exposures(id), visible INTEGER NOT NULL CHECK(visible IN (0,1)))");
+        } }),
+    HUB_BUTTONS_MIGRATION,
+]);
+//# sourceMappingURL=schema.js.map

package/dist/hub/http/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/hub/http/schema.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAItD,MAAM,EAAE,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEV,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAqB,EAAE,EAAE;YACxF,EAAE,CAAC,IAAI,CAAC,iJAAiJ,CAAC,CAAC;QAC7J,CAAC,EAAE,CAAC;IACJ,qBAAqB;CACtB,CAAC,CAAC"}

package/dist/hub/identity.d.ts

@@ -0,0 +1,32 @@
+import { type KeyObject } from "node:crypto";
+import type { HubAskerEnvelope, HubAttachmentRef, HubAuthorizationRequest, HubAuthorizationLease, PersonKey } from "./types.js";
+export declare const sha256: (input: string | Buffer) => string;
+/** The canonical digest of an attachments-v1 file list, in its order. */
+export declare function attachmentsDigest(refs: readonly HubAttachmentRef[]): string;
+/** A message's contentDigest. With nothing but text it is sha256(text), as before. With files (D) and/or reply buttons
+ * (F, its own canonical digest) it also binds them, so the asker signature, receipts and the release lease cover them
+ * with no new envelope or lease field. */
+export declare function messageContentDigest(kind: "question" | "answer", text: string, extras?: {
+    attachments?: readonly HubAttachmentRef[];
+    buttonsDigest?: string;
+}): string;
+export declare function personKeyString(input: PersonKey): string;
+export declare function signAsker(input: Omit<HubAskerEnvelope, "signature">, key: KeyObject): HubAskerEnvelope;
+export interface HubIdentityBinding {
+    hubId: string;
+    issuerKeyId: string;
+    issuerPublicKey: KeyObject;
+    fleetId: string;
+    owner: PersonKey;
+    revocationVersion: number;
+    now: number;
+}
+export declare function verifyAsker(input: unknown, text: string, binding: HubIdentityBinding, attachments?: readonly HubAttachmentRef[]): HubAskerEnvelope;
+export declare function operationDigest(input: HubAuthorizationRequest): string;
+export declare function verifyLease(input: HubAuthorizationLease, request: HubAuthorizationRequest, expected: {
+    linkEpoch: number;
+    revocationVersion: number;
+    now: number;
+}): HubAuthorizationLease;
+export declare function canonicalArguments(input: unknown): string;
+export declare function issuerKeyId(key: KeyObject): string;

package/dist/hub/identity.js

@@ -0,0 +1,80 @@
+import { createHash, createPublicKey, sign, verify } from "node:crypto";
+import { person, validated, parseStrictJson, HubProtocolError } from "./validation.js";
+import { leaseSchema, validateAsker, validateAuthorization } from "./protocol.js";
+export const sha256 = (input) => createHash("sha256").update(input).digest("hex");
+/** The canonical digest of an attachments-v1 file list, in its order. */
+export function attachmentsDigest(refs) {
+    return sha256(JSON.stringify(refs.map(r => [r.id, r.name, r.size, r.mime, r.sha256])));
+}
+/** A message's contentDigest. With nothing but text it is sha256(text), as before. With files (D) and/or reply buttons
+ * (F, its own canonical digest) it also binds them, so the asker signature, receipts and the release lease cover them
+ * with no new envelope or lease field. */
+export function messageContentDigest(kind, text, extras) {
+    const files = extras?.attachments?.length ? attachmentsDigest(extras.attachments) : null, buttons = extras?.buttonsDigest ?? null;
+    if (files === null && buttons === null)
+        return sha256(text);
+    return sha256(JSON.stringify([`agend-hub-${kind}-extras-v1`, sha256(text), files, buttons]));
+}
+export function personKeyString(input) { const p = validated(person, input); return `${p.realm}/${p.objectId}`; }
+function tuple(e) {
+    return JSON.stringify(["agend-hub-ask-v1", e.v, e.issuer, e.issuerKeyId, e.messageId, e.asker.realm, e.asker.objectId,
+        e.owner.realm, e.owner.objectId, e.destinationFleetId, e.exposureId, e.roomId, e.grantId, e.grantRevision,
+        e.exposureRevision, e.revocationVersion, e.contentDigest, e.issuedAt, e.expiresAt, e.nonce]);
+}
+export function signAsker(input, key) {
+    const e = validateAsker({ ...input, signature: "A".repeat(86) });
+    if (key.asymmetricKeyType !== "ed25519" || key.type !== "private")
+        throw new HubProtocolError();
+    return { ...e, signature: sign(null, Buffer.from(tuple(e)), key).toString("base64url") };
+}
+export function verifyAsker(input, text, binding, attachments) {
+    const e = validateAsker(input), key = binding.issuerPublicKey;
+    if (key.type !== "public" || key.asymmetricKeyType !== "ed25519" || e.issuer !== binding.hubId || e.issuerKeyId !== binding.issuerKeyId
+        || e.destinationFleetId !== binding.fleetId || personKeyString(e.owner) !== personKeyString(binding.owner)
+        || e.contentDigest !== messageContentDigest("question", text, { attachments }) || e.revocationVersion !== binding.revocationVersion
+        || !Number.isSafeInteger(binding.now) || e.expiresAt <= binding.now || e.issuedAt > binding.now + 5_000
+        || e.expiresAt <= e.issuedAt || e.expiresAt - e.issuedAt > 120_000
+        || Buffer.from(e.signature, "base64url").toString("base64url") !== e.signature
+        || !verify(null, Buffer.from(tuple(e)), key, Buffer.from(e.signature, "base64url")))
+        throw new HubProtocolError("denied");
+    return e;
+}
+export function operationDigest(input) {
+    const r = validateAuthorization(input);
+    return sha256(JSON.stringify(["agend-hub-operation-v1", r.messageId, r.operationId, r.phase, r.exposureRevision,
+        r.phase === "tool" ? r.tool.name : null, r.phase === "tool" ? r.tool.argumentsDigest : null,
+        r.phase === "release-answer" ? r.answer.answerId : null, r.phase === "release-answer" ? r.answer.contentDigest : null]));
+}
+export function verifyLease(input, request, expected) {
+    const lease = validated(leaseSchema, input), r = validateAuthorization(request);
+    if (lease.messageId !== r.messageId || lease.operationId !== r.operationId || lease.phase !== r.phase
+        || lease.exposureRevision !== r.exposureRevision || lease.operationDigest !== operationDigest(r)
+        || lease.linkEpoch !== expected.linkEpoch || lease.revocationVersion !== expected.revocationVersion
+        || lease.expiresAt <= expected.now || lease.expiresAt > expected.now + 5_000)
+        throw new HubProtocolError("stale");
+    return lease;
+}
+export function canonicalArguments(input) {
+    const canonical = (v, depth) => {
+        if (depth > 32)
+            throw new HubProtocolError();
+        if (v === null || typeof v === "boolean" || typeof v === "number" && Number.isFinite(v) && Math.abs(v) <= Number.MAX_SAFE_INTEGER)
+            return JSON.stringify(v);
+        if (typeof v === "string") {
+            parseStrictJson(JSON.stringify(v));
+            return JSON.stringify(v);
+        }
+        if (Array.isArray(v))
+            return `[${v.map(x => canonical(x, depth + 1)).join(",")}]`;
+        if (v && typeof v === "object" && Object.getPrototypeOf(v) === Object.prototype) {
+            return `{${Object.keys(v).sort().map(k => `${canonical(k, depth + 1)}:${canonical(v[k], depth + 1)}`).join(",")}}`;
+        }
+        throw new HubProtocolError();
+    };
+    const out = canonical(input, 0);
+    if (Buffer.byteLength(out) > 64 * 1024)
+        throw new HubProtocolError();
+    return out;
+}
+export function issuerKeyId(key) { return sha256((key.type === "public" ? key : createPublicKey(key)).export({ type: "spki", format: "der" })); }
+//# sourceMappingURL=identity.js.map

package/dist/hub/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/hub/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAElF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3G,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,IAAiC;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AACD;;0CAE0C;AAC1C,MAAM,UAAU,oBAAoB,CAAC,IAA2B,EAAE,IAAY,EAAE,MAA8E;IAC5J,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC;IAClI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,IAAI,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAAgB,IAAY,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACpI,SAAS,KAAK,CAAC,CAAmB;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;QACnH,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa;QACzG,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACjG,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,KAA0C,EAAE,GAAc;IAClF,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAChG,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC3F,CAAC;AAKD,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,IAAY,EAAE,OAA2B,EAAE,WAAyC;IAC9H,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;WAClI,CAAC,CAAC,kBAAkB,KAAK,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC;WACvG,CAAC,CAAC,aAAa,KAAK,oBAAoB,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB;WAChI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,GAAG,KAAK;WACpG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,GAAG,OAAO;WAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS;WAC3E,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5H,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB;QAC7G,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;QAC3F,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAA4B,EAAE,OAAgC,EAAE,QAAuE;IACjK,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;WAChG,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC,eAAe,KAAK,eAAe,CAAC,CAAC,CAAC;WAC7F,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;WAChG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,IAAI,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,SAAS,GAAG,CAAC,CAAU,EAAE,KAAa,EAAU,EAAE;QACtD,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClF,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAChF,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,IAAI,SAAS,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClJ,CAAC;QACD,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC/B,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAAC,OAAO,GAAG,CAAC;AACpH,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,GAAc,IAAY,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/hub/init/browser-certificate.d.ts

@@ -0,0 +1,9 @@
+import type { HubInitPlan } from "./types.js";
+export interface HubBrowserMaterial {
+    certFile: string;
+    keyFile: string;
+    cleanup(): void;
+}
+/** Recover only material explicitly generated for this saved init plan; imported files are never owned here. */
+export declare function recoverBrowserCertificate(home: string, origin: string, files: HubInitPlan["webTls"]): HubBrowserMaterial | null;
+export declare function createBrowserCertificate(home: string, origin: string): Promise<HubBrowserMaterial>;

package/dist/hub/init/browser-certificate.js

@@ -0,0 +1,78 @@
+/** Explicit owner-requested browser certificate preparation; no network, shell, trust-store or Hub identity changes. */
+import { generateKeyPairSync, createHash } from "node:crypto";
+import { mkdtempSync, writeFileSync, rmSync, lstatSync, unlinkSync } from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { isIP } from "node:net";
+import { promisify } from "node:util";
+import { execFile } from "../../child-process.js";
+import { privatePath, readPrivateFile } from "../private-files.js";
+import { checkBrowserTls } from "./browser-tls.js";
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+/** Recover only material explicitly generated for this saved init plan; imported files are never owned here. */
+export function recoverBrowserCertificate(home, origin, files) {
+    if (files.generated !== true)
+        return null;
+    const dir = dirname(files.certFile);
+    if (dirname(dir) !== resolve(home) || !/^\.hub-browser-[a-zA-Z0-9]{6}$/.test(basename(dir))
+        || files.certFile !== join(dir, "cert.pem") || files.keyFile !== join(dir, "key.pem"))
+        throw Error("browser_certificate_staging_changed");
+    const suffix = relative(home, dir);
+    privatePath(home, suffix, true);
+    const identity = lstatSync(dir);
+    const validate = () => {
+        const marker = JSON.parse(readPrivateFile(home, `${suffix}/material.json`, 1024));
+        const cert = readPrivateFile(home, `${suffix}/cert.pem`), key = readPrivateFile(home, `${suffix}/key.pem`);
+        if (marker?.v !== 1 || marker.origin !== origin || marker.certSha256 !== digest(cert) || marker.keySha256 !== digest(key))
+            throw Error("browser_certificate_staging_changed");
+    };
+    validate();
+    return { certFile: files.certFile, keyFile: files.keyFile, cleanup() {
+            let current;
+            try {
+                current = lstatSync(dir);
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    return;
+                throw err;
+            }
+            if (!current.isDirectory() || current.isSymbolicLink() || current.ino !== identity.ino || current.dev !== identity.dev || current.uid !== identity.uid)
+                throw Error("browser_certificate_staging_changed");
+            validate();
+            rmSync(dir, { recursive: true });
+        } };
+}
+export async function createBrowserCertificate(home, origin) {
+    const u = new URL(origin), host = u.hostname.replace(/^\[|\]$/g, "");
+    const dns = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+    if (u.protocol !== "https:" || u.username || u.password || u.search || u.hash || u.pathname !== "/"
+        || u.origin !== origin.replace(/\/$/, "") || (!isIP(host) && !dns.test(host)))
+        throw Error("invalid_browser_origin");
+    privatePath(home, "", true);
+    const key = generateKeyPairSync("ec", { namedCurve: "prime256v1" }).privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    const dir = mkdtempSync(join(home, ".hub-browser-")), identity = lstatSync(dir);
+    const files = { certFile: join(dir, "cert.pem"), keyFile: join(dir, "key.pem"), generated: true };
+    try {
+        // OpenSSL's key loader needs a file on supported builds. Only its private path is in argv, never key bytes.
+        writeFileSync(files.keyFile, key, { flag: "wx", mode: 0o600 });
+        // LibreSSL requires a real distinguished-name section. Keep all extensions in this private, self-contained
+        // config instead of depending on the host's openssl.cnf or optional command-line extension flags.
+        const configFile = join(dir, "openssl.cnf");
+        writeFileSync(configFile, `[req]\nprompt=no\ndistinguished_name=dn\nx509_extensions=server\n[dn]\nCN=AgEnD Hub\n[server]\nsubjectAltName=${isIP(host) ? "IP" : "DNS"}:${host}\nbasicConstraints=critical,CA:FALSE\nkeyUsage=critical,digitalSignature\nextendedKeyUsage=serverAuth\n`, { flag: "wx", mode: 0o600 });
+        const { stdout: cert } = await promisify(execFile)("/usr/bin/openssl", ["req", "-new", "-x509", "-sha256", "-days", "30", "-config", configFile,
+            "-key", files.keyFile], { timeout: 10_000, maxBuffer: 64 * 1024, env: { PATH: "/usr/bin:/bin", LANG: "C" } }).catch(() => { throw Error("browser_certificate_generation_failed"); });
+        unlinkSync(configFile);
+        if (!checkBrowserTls(cert, key, u.origin, Date.now()).ok)
+            throw Error("browser_certificate_generation_failed");
+        writeFileSync(files.certFile, cert, { flag: "wx", mode: 0o600 });
+        writeFileSync(join(dir, "material.json"), JSON.stringify({ v: 1, origin: u.origin, certSha256: digest(cert), keySha256: digest(key) }), { flag: "wx", mode: 0o600 });
+        return recoverBrowserCertificate(home, u.origin, files);
+    }
+    catch (err) {
+        const current = lstatSync(dir);
+        if (current.isDirectory() && !current.isSymbolicLink() && current.ino === identity.ino && current.dev === identity.dev)
+            rmSync(dir, { recursive: true });
+        throw err;
+    }
+}
+//# sourceMappingURL=browser-certificate.js.map

package/dist/hub/init/browser-certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-certificate.js","sourceRoot":"","sources":["../../../src/hub/init/browser-certificate.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAInD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnF,gHAAgH;AAChH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,MAAc,EAAE,KAA4B;IAClG,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACtF,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5I,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,MAAM,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,CAAC;QAC3G,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG,CAAC;YACvH,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO;YAChE,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBAAC,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAAC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO;gBAAC,MAAM,GAAG,CAAC;YAAC,CAAC;YAC1H,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;gBACpJ,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,QAAQ,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC,EAAE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAc;IACzE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,iGAAiG,CAAC;IAC9G,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;WAC9F,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvH,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnI,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC;IAC3G,IAAI,CAAC;QACH,4GAA4G;QAC5G,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,2GAA2G;QAC3G,kGAAkG;QAClG,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC5C,aAAa,CAAC,UAAU,EAAE,iHAAiH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,yGAAyG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpT,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU;YAC7I,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EACxB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7J,UAAU,CAAC,UAAU,CAAC,CAAC;QACvB,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE;YAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC/G,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrK,OAAO,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzJ,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/hub/init/browser-tls.d.ts

@@ -0,0 +1,18 @@
+export type BrowserTlsProblem = "cert-unreadable" | "key-unreadable" | "key-mismatch" | "host-not-covered" | "not-yet-valid" | "expired" | "ca-certificate";
+export interface BrowserTlsCheck {
+    readonly ok: boolean;
+    readonly problems: readonly BrowserTlsProblem[];
+    /** Advisory only: browsers will warn unless this certificate is trusted some other way. */
+    readonly selfSigned: boolean;
+    readonly subject?: string;
+    readonly issuer?: string;
+    readonly validTo?: string;
+    readonly fingerprint256?: string;
+}
+/** Split a PEM bundle into its certificates (leaf first, as servers send them). */
+export declare function pemCertificates(pem: string): string[];
+/**
+ * Check a certificate chain + private key for the Hub's web address. Pure: the caller reads the files. The key text is
+ * never echoed or returned.
+ */
+export declare function checkBrowserTls(certPem: string, keyPem: string, webOrigin: string, nowMs?: number): BrowserTlsCheck;

package/dist/hub/init/browser-tls.js

@@ -0,0 +1,62 @@
+/**
+ * The Hub's browser-facing HTTPS certificate (S-48, hub.md §2 "Origins, keys and bootstrap"). It is separate from the
+ * member transport certificate S1 generates: colleagues' browsers must trust it, so it comes from the operator
+ * (an organisation-issued certificate, or one their browsers are otherwise set up to trust). There is no plaintext
+ * fallback: without a usable certificate the wizard stops and the Hub stays off.
+ */
+import { X509Certificate, createPrivateKey } from "node:crypto";
+import { isIP } from "node:net";
+/** Split a PEM bundle into its certificates (leaf first, as servers send them). */
+export function pemCertificates(pem) {
+    return pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? [];
+}
+/**
+ * Check a certificate chain + private key for the Hub's web address. Pure: the caller reads the files. The key text is
+ * never echoed or returned.
+ */
+export function checkBrowserTls(certPem, keyPem, webOrigin, nowMs = Date.now()) {
+    const problems = [];
+    const pems = pemCertificates(certPem);
+    let leaf;
+    try {
+        if (pems.length > 0)
+            leaf = new X509Certificate(pems[0]);
+    }
+    catch {
+        leaf = undefined;
+    }
+    if (!leaf)
+        return { ok: false, problems: ["cert-unreadable"], selfSigned: false };
+    let key;
+    try {
+        key = createPrivateKey({ key: keyPem, format: "pem" });
+    }
+    catch {
+        problems.push("key-unreadable");
+    }
+    if (key && !leaf.checkPrivateKey(key))
+        problems.push("key-mismatch");
+    const host = new URL(webOrigin).hostname.replace(/^\[(.*)\]$/, "$1");
+    const covered = isIP(host) ? leaf.checkIP(host) !== undefined : leaf.checkHost(host, { subject: "never" }) !== undefined;
+    if (!covered)
+        problems.push("host-not-covered");
+    if (Date.parse(leaf.validFrom) > nowMs)
+        problems.push("not-yet-valid");
+    if (Date.parse(leaf.validTo) <= nowMs)
+        problems.push("expired");
+    const selfSigned = leaf.issuer === leaf.subject && leaf.verify(leaf.publicKey);
+    // A CA-issued leaf that is itself a CA is the wrong certificate (usually the chain in the wrong order). Self-signed
+    // server certificates commonly carry CA:TRUE (openssl's default), so for them it is not a problem by itself.
+    if (leaf.ca && !selfSigned)
+        problems.push("ca-certificate");
+    return {
+        ok: problems.length === 0,
+        problems,
+        selfSigned,
+        subject: leaf.subject,
+        issuer: leaf.issuer,
+        validTo: leaf.validTo,
+        fingerprint256: leaf.fingerprint256,
+    };
+}
+//# sourceMappingURL=browser-tls.js.map

package/dist/hub/init/browser-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-tls.js","sourceRoot":"","sources":["../../../src/hub/init/browser-tls.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAsBhC,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,KAAK,CAAC,+DAA+D,CAAC,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB,EAAE,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAC5G,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAiC,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAElF,IAAI,GAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,SAAS,CAAC;IACzH,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAEhD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/E,oHAAoH;IACpH,6GAA6G;IAC7G,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5D,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,QAAQ;QACR,UAAU;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC"}

package/dist/hub/init/cli.d.ts

@@ -0,0 +1,3 @@
+import type { HubIdentityProvider } from "./types.js";
+import { type HubWizardOutcome } from "./wizard.js";
+export declare function runHubInitCommand(identity?: HubIdentityProvider): Promise<HubWizardOutcome>;