@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/hub/init/cli.js

@@ -0,0 +1,83 @@
+/**
+ * Composition for `agend hub init` and quickstart's "team Hub" choice. Real terminal, real files, the existing
+ * service installer. Hub key material comes from S1 (src/hub/tls.ts, hub-s48-init); until that ships, the command
+ * stops before asking anything and changes nothing.
+ */
+import { installedBuildLabel, readInstalledBuild } from "../../build-provenance.js";
+import { ht } from "./text.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { ensureAgendHome } from "../../agend-home.js";
+import { canonicalCliEntry } from "../../cli-entry.js";
+import { getAgendHome } from "../../paths.js";
+import { createHubDirectory } from "../directory/index.js";
+import { realFleetProbe } from "./existing-fleet.js";
+import { hubIdentityProvider } from "./identity.js";
+import { inspectDirectoryCertificate, fetchDirectoryCa } from "./directory-certificate.js";
+import { readHubSecretFile } from "./secret-file.js";
+import { createBrowserCertificate, recoverBrowserCertificate } from "./browser-certificate.js";
+import { createHubInitializer } from "./initializer.js";
+import { terminalIO } from "./prompt.js";
+import { runHubInitWizard } from "./wizard.js";
+const SERVICE_LABEL = "com.agend.fleet";
+async function realService(home) {
+    const installer = await import("../../service-installer.js");
+    return {
+        installed: () => installer.inspectService(SERVICE_LABEL).installed,
+        async install() {
+            const { assertHubServiceInstallIdle } = await import("../service-start.js");
+            try {
+                assertHubServiceInstallIdle(home);
+            }
+            catch {
+                throw Error(ht("service_install_idle"));
+            }
+            const path = installer.installService({
+                label: SERVICE_LABEL,
+                execPath: canonicalCliEntry(),
+                path: process.env.PATH ?? "",
+                workingDirectory: home,
+                logPath: join(home, "fleet.log"),
+                agendHome: home,
+                launchdSessionType: "Background",
+            });
+            installer.activateService(path, join(home, "fleet.pid"), { preservePidFile: true });
+            return path;
+        },
+    };
+}
+export async function runHubInitCommand(identity = hubIdentityProvider()) {
+    if (!process.stdin.isTTY) {
+        console.error("Error: agend hub init needs an interactive terminal (it asks for passwords without echoing them).");
+        process.exitCode = 1;
+        return "refused";
+    }
+    if (!identity.available) {
+        console.error("agend hub init: Hub key generation is not available in this build yet (it ships with the Hub transport). Nothing was changed.");
+        process.exitCode = 1;
+        return "refused";
+    }
+    const home = getAgendHome();
+    ensureAgendHome(home, { create: true, label: "AgEnD home" });
+    const service = await realService(home);
+    const initializer = createHubInitializer({ home, identity, probe: realFleetProbe() });
+    const io = terminalIO();
+    const build = readInstalledBuild();
+    io.say(ht("build_info", installedBuildLabel(build.version, build.source, { source: ht("build_source"), modified: ht("build_modified"), unknown: ht("build_unknown") }), build.version));
+    const outcome = await runHubInitWizard({
+        io,
+        home,
+        initializer,
+        createDirectory: createHubDirectory,
+        readFile: (path) => readFileSync(path, "utf8"),
+        createBrowserCertificate: origin => createBrowserCertificate(home, origin),
+        recoverBrowserCertificate: plan => recoverBrowserCertificate(home, plan.webOrigin, plan.webTls),
+        directoryCertificates: { inspect: inspectDirectoryCertificate, fetch: fetchDirectoryCa },
+        readSecretFile: readHubSecretFile,
+        service,
+    });
+    if (outcome === "refused")
+        process.exitCode = 1;
+    return outcome;
+}
+//# sourceMappingURL=cli.js.map

package/dist/hub/init/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/hub/init/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAiD,MAAM,aAAa,CAAC;AAE9F,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC7D,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,SAAS;QAClE,KAAK,CAAC,OAAO;YACX,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC5E,IAAI,CAAC;gBAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC;YAAC,CAAC;YAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,cAAc,CAAC;gBACpC,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE,iBAAiB,EAAE;gBAC7B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;gBAChC,SAAS,EAAE,IAAI;gBACf,kBAAkB,EAAE,YAAY;aACjC,CAAC,CAAC;YACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAQ,GAAwB,mBAAmB,EAAE;IAC3F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,+HAA+H,CAAC,CAAC;QAC/I,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EACrE,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;QACrC,EAAE;QACF,IAAI;QACJ,WAAW;QACX,eAAe,EAAE,kBAAkB;QACnC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,wBAAwB,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1E,yBAAyB,EAAE,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/F,qBAAqB,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACxF,cAAc,EAAE,iBAAiB;QACjC,OAAO;KACR,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/hub/init/directory-certificate.d.ts

@@ -0,0 +1,24 @@
+export interface DirectoryCertificateInfo {
+    fingerprint256: string;
+    subject: string;
+    issuer: string;
+    validTo: string;
+}
+export interface DirectoryCertificateProbe {
+    url: string;
+    leafPem: string;
+    chain: string[];
+    certificate: DirectoryCertificateInfo;
+}
+export interface DirectoryCaBundle {
+    pem: string;
+    certificates: DirectoryCertificateInfo[];
+}
+export declare function sameDirectoryFingerprint(expected: string, supplied: string): boolean;
+export declare function directoryCaInfo(pem: string, now?: number): DirectoryCaBundle;
+/** Inspect TLS only: no LDAP client exists and no application bytes or credentials are sent. */
+export declare function inspectDirectoryCertificate(url: string): Promise<DirectoryCertificateProbe>;
+export declare function fetchDirectoryCa(probe: DirectoryCertificateProbe, confirmedLeafFingerprint: string, credentials?: {
+    bindDn: string;
+    password: string;
+}): Promise<DirectoryCaBundle>;

package/dist/hub/init/directory-certificate.js

@@ -0,0 +1,222 @@
+/** Local initializer bootstrap only. No runtime directory-verification switch, credential-bearing inspection or URL fetching. */
+import { X509Certificate } from "node:crypto";
+import { isIP } from "node:net";
+import * as tls from "node:tls";
+import { resolveDirectoryConfig } from "../directory/config.js";
+import { pemCertificates } from "./browser-tls.js";
+const TIMEOUT = 5000, MAX_BYTES = 256 * 1024;
+const error = (code = "directory_ca_unavailable") => Error(code);
+const clean = (s) => s.replace(/[\p{C}\p{Zl}\p{Zp}]/gu, " ").slice(0, 512);
+const fingerprint = (s) => s.replace(/[ :]/g, "").toUpperCase();
+export function sameDirectoryFingerprint(expected, supplied) {
+    return /^[0-9A-F]{64}$/.test(fingerprint(supplied)) && fingerprint(expected) === fingerprint(supplied);
+}
+const endpoint = (url) => resolveDirectoryConfig({ realm: "bootstrap", url, baseDn: "cn=bootstrap", bindDn: "cn=bootstrap", profile: "ad" });
+const info = (c) => ({ fingerprint256: c.fingerprint256, subject: clean(c.subject), issuer: clean(c.issuer), validTo: c.validTo });
+function valid(c, now = Date.now()) {
+    if (Date.parse(c.validFrom) > now || Date.parse(c.validTo) <= now)
+        throw error("directory_ca_expired");
+}
+export function directoryCaInfo(pem, now = Date.now()) {
+    if (Buffer.byteLength(pem) > 64 * 1024)
+        throw error("directory_ca_invalid");
+    const certificates = pemCertificates(pem);
+    if (!certificates.length || certificates.length > 4 || pem.replace(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g, "").trim())
+        throw error("directory_ca_invalid");
+    return { pem, certificates: certificates.map(p => {
+            const c = new X509Certificate(p);
+            valid(c, now);
+            if (!c.ca)
+                throw error("directory_ca_invalid");
+            return info(c);
+        }) };
+}
+function host(c, name) {
+    if (!(isIP(name) ? c.checkIP(name) : c.checkHost(name, { subject: "never" })))
+        throw error("directory_ca_hostname");
+    valid(c);
+}
+/** Inspect TLS only: no LDAP client exists and no application bytes or credentials are sent. */
+export async function inspectDirectoryCertificate(url) {
+    const cfg = endpoint(url);
+    const socket = tls.connect({ host: cfg.host, port: cfg.port, ...(isIP(cfg.host) ? {} : { servername: cfg.host }), minVersion: "TLSv1.2", rejectUnauthorized: false });
+    try {
+        await connected(socket);
+        const peer = socket.getPeerCertificate(true);
+        if (!peer.raw || peer.raw.length > 64 * 1024)
+            throw error();
+        const leaf = new X509Certificate(peer.raw);
+        host(leaf, cfg.host);
+        const chain = [], seen = new Set();
+        let next = peer.issuerCertificate;
+        while (next?.raw && chain.length < 4) {
+            if (next.raw.length > 64 * 1024)
+                throw error();
+            const c = new X509Certificate(next.raw);
+            if (seen.has(c.fingerprint256) || c.fingerprint256 === leaf.fingerprint256)
+                break;
+            seen.add(c.fingerprint256);
+            chain.push(c.toString());
+            next = next.issuerCertificate;
+        }
+        return { url: cfg.url, leafPem: leaf.toString(), chain, certificate: info(leaf) };
+    }
+    catch (err) {
+        throw known(err);
+    }
+    finally {
+        socket.destroy();
+    }
+}
+function known(err) {
+    return err instanceof Error && /^directory_ca_(?:unavailable|invalid|expired|hostname|pin|auth_required|unsupported|aia)$/.test(err.message) ? err : error();
+}
+async function connected(socket) {
+    await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => { socket.destroy(); reject(error()); }, TIMEOUT);
+        const failed = () => { clearTimeout(timeout); reject(error()); };
+        socket.once("error", failed);
+        socket.once("close", failed);
+        socket.once("secureConnect", () => { clearTimeout(timeout); socket.removeListener("close", failed); resolve(); });
+    });
+}
+/** LDAP AIA is a base DN on this same directory. Never follow a host, referral, HTTP URL or arbitrary query. */
+function issuerDn(c, name) {
+    const locations = (c.infoAccess ?? "").split("\n").filter(s => s.startsWith("CA Issuers - URI:ldap:"));
+    if (locations.length !== 1)
+        throw error("directory_ca_aia");
+    let uri;
+    try {
+        uri = new URL(locations[0].slice("CA Issuers - URI:".length));
+    }
+    catch {
+        throw error("directory_ca_aia");
+    }
+    const [attribute, scope, filter, extension] = uri.search.slice(1).split("?");
+    if (uri.protocol !== "ldap:" || uri.username || uri.password || uri.hash || uri.hostname && uri.hostname.toLowerCase() !== name.toLowerCase()
+        || uri.port && uri.port !== "389" || attribute?.toLowerCase() !== "cacertificate" || scope !== "base"
+        || filter && filter !== "objectClass=certificationAuthority" && filter !== "(objectClass=certificationAuthority)" || extension)
+        throw error("directory_ca_aia");
+    let dn;
+    try {
+        dn = decodeURIComponent(uri.pathname.slice(1));
+    }
+    catch {
+        throw error("directory_ca_aia");
+    }
+    if (!dn || dn.length > 1024 || /[\x00-\x1f\x7f]/.test(dn))
+        throw error("directory_ca_aia");
+    return dn;
+}
+async function pinned(probe, pin) {
+    const cfg = endpoint(probe.url), leaf = new X509Certificate(probe.leafPem);
+    if (!sameDirectoryFingerprint(leaf.fingerprint256, pin))
+        throw error("directory_ca_pin");
+    host(leaf, cfg.host);
+    const [major, minor] = process.versions.node.split(".").map(Number);
+    if (major < 22 || major === 22 && minor < 9)
+        throw error("directory_ca_unsupported");
+    // The owner explicitly trusted this exact leaf. Normal TLS verification remains ON before any LDAP bytes.
+    // Node's partial-chain support: https://nodejs.org/download/release/v22.23.3/docs/api/tls.html#tlscreatesecurecontextoptions
+    const socket = tls.connect({ host: cfg.host, port: cfg.port, ...(isIP(cfg.host) ? {} : { servername: cfg.host }), minVersion: "TLSv1.2",
+        ca: leaf.toString(), allowPartialTrustChain: true, rejectUnauthorized: true,
+        checkServerIdentity(name, cert) {
+            if (!cert.raw || fingerprint(new X509Certificate(cert.raw).fingerprint256) !== fingerprint(pin))
+                return error("directory_ca_pin");
+            return tls.checkServerIdentity(name, cert);
+        } });
+    try {
+        await connected(socket);
+        if (!socket.authorized || !socket.encrypted || socket.destroyed || !socket.getPeerCertificate().raw
+            || fingerprint(new X509Certificate(socket.getPeerCertificate().raw).fingerprint256) !== fingerprint(pin))
+            throw error("directory_ca_pin");
+        return socket;
+    }
+    catch (err) {
+        socket.destroy();
+        throw known(err);
+    }
+}
+export async function fetchDirectoryCa(probe, confirmedLeafFingerprint, credentials) {
+    const cfg = endpoint(probe.url), leaf = new X509Certificate(probe.leafPem);
+    if (credentials && (!credentials.bindDn || credentials.bindDn.length > 1024 || /[\x00-\x1f\x7f]/.test(credentials.bindDn)
+        || !credentials.password || credentials.password.length > 1024 || credentials.password.includes("\0")))
+        throw error("directory_ca_invalid");
+    if (!Array.isArray(probe.chain) || probe.chain.length > 4 || probe.chain.some(p => typeof p !== "string" || Buffer.byteLength(p) > 64 * 1024))
+        throw error("directory_ca_invalid");
+    const socket = await pinned(probe, confirmedLeafFingerprint);
+    let client, claimed = false;
+    const assert = () => { if (socket.destroyed || !socket.authorized || !socket.encrypted)
+        throw error(); };
+    try {
+        const { Client } = await import("ldapts");
+        client = new Client({ url: cfg.url, timeout: TIMEOUT, connectTimeout: TIMEOUT, strictDN: true, autoRebind: false,
+            createConnection: (() => { throw error(); }),
+            createSecureConnection: (() => { assert(); if (claimed)
+                throw error(); claimed = true; return socket; }) });
+        let read = 0;
+        socket.on("data", chunk => { read += chunk.length; if (read > MAX_BYTES)
+            socket.destroy(error()); });
+        const chain = [], seen = new Set();
+        let current = leaf;
+        for (let depth = 0; depth < 4; depth++) {
+            valid(current);
+            if (current.ca && current.subject === current.issuer && current.verify(current.publicKey)) {
+                if (!chain.length)
+                    chain.push(current);
+                break;
+            }
+            let issuers = probe.chain.map(p => new X509Certificate(p)).filter(c => c.ca && current.checkIssued(c) && current.verify(c.publicKey));
+            if (!issuers.length) {
+                const base = issuerDn(current, cfg.host);
+                assert();
+                if (!client.isConnected)
+                    await client.bind(credentials?.bindDn ?? "", credentials?.password ?? "");
+                assert();
+                const result = await client.search(base, { scope: "base", filter: "(objectClass=*)", derefAliases: "never", sizeLimit: 1, timeLimit: 3,
+                    attributes: ["cACertificate;binary", "cACertificate"], explicitBufferAttributes: ["cACertificate;binary", "cACertificate"] });
+                assert();
+                if (result.searchReferences.length || result.searchEntries.length !== 1)
+                    throw error("directory_ca_aia");
+                const values = Object.entries(result.searchEntries[0]).filter(([name]) => /^(?:cacertificate)(?:;binary)?$/i.test(name))
+                    .flatMap(([, value]) => Array.isArray(value) ? value : [value]);
+                if (!values.length || values.length > 4 || values.some(v => !Buffer.isBuffer(v) || v.length > 64 * 1024))
+                    throw error("directory_ca_invalid");
+                issuers = values.map(v => new X509Certificate(v)).filter(c => c.ca && current.checkIssued(c) && current.verify(c.publicKey));
+            }
+            issuers = [...new Map(issuers.map(c => [c.fingerprint256, c])).values()];
+            if (issuers.length !== 1 || seen.has(issuers[0].fingerprint256))
+                throw error("directory_ca_invalid");
+            current = issuers[0];
+            valid(current);
+            seen.add(current.fingerprint256);
+            chain.push(current);
+        }
+        if (!chain.length || !current.ca || current.subject !== current.issuer || !current.verify(current.publicKey))
+            throw error("directory_ca_invalid");
+        const bundle = directoryCaInfo(chain.map(c => c.toString()).join("\n"));
+        // Prove normal runtime verification with the fetched CA before returning it for owner confirmation/configuration.
+        const verified = tls.connect({ host: cfg.host, port: cfg.port, ...(isIP(cfg.host) ? {} : { servername: cfg.host }), minVersion: "TLSv1.2",
+            ca: bundle.pem, rejectUnauthorized: true });
+        try {
+            await connected(verified);
+            if (!verified.authorized)
+                throw error();
+        }
+        finally {
+            verified.destroy();
+        }
+        return bundle;
+    }
+    catch (err) {
+        if (!credentials && [1, 48, 50].includes(Number(err.code)))
+            throw error("directory_ca_auth_required");
+        throw known(err);
+    }
+    finally {
+        socket.destroy();
+        if (client)
+            await client.unbind().catch(() => { });
+    }
+}
+//# sourceMappingURL=directory-certificate.js.map

package/dist/hub/init/directory-certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-certificate.js","sourceRoot":"","sources":["../../../src/hub/init/directory-certificate.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKnD,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;AAC7C,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,0BAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACjE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACxE,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,QAAgB;IACzE,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACrJ,MAAM,IAAI,GAAG,CAAC,CAAkB,EAA4B,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9K,SAAS,KAAK,CAAC,CAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG;QAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,+DAA+D,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACpL,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC/C,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AACD,SAAS,IAAI,CAAC,CAAkB,EAAE,IAAY;IAC5C,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACpH,KAAK,CAAC,CAAC,CAAC,CAAC;AACX,CAAC;AACD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAW;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;IACtK,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,KAAK,GAAa,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QACrD,IAAI,IAAI,GAA4C,IAAI,CAAC,iBAAiB,CAAC;QAC3E,OAAO,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;gBAAE,MAAM,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;gBAAE,MAAM;YAClF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACnE,CAAC;AACD,SAAS,KAAK,CAAC,GAAY;IACzB,OAAO,GAAG,YAAY,KAAK,IAAI,2FAA2F,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAC/J,CAAC;AACD,KAAK,UAAU,SAAS,CAAC,MAAqB;IAC5C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;AACL,CAAC;AACD,gHAAgH;AAChH,SAAS,QAAQ,CAAC,CAAkB,EAAE,IAAY;IAChD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACvG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;IAClH,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;WACxI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,EAAE,WAAW,EAAE,KAAK,eAAe,IAAI,KAAK,KAAK,MAAM;WAClG,MAAM,IAAI,MAAM,KAAK,oCAAoC,IAAI,MAAM,KAAK,sCAAsC,IAAI,SAAS;QAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClK,IAAI,EAAU,CAAC;IAAC,IAAI,CAAC;QAAC,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;IAClH,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC3F,OAAO,EAAE,CAAC;AACZ,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,KAAgC,EAAE,GAAW;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,KAAM,GAAG,EAAE,IAAI,KAAK,KAAK,EAAE,IAAI,KAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACvF,0GAA0G;IAC1G,6HAA6H;IAC7H,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS;QACrI,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;QAC3E,mBAAmB,CAAC,IAAI,EAAE,IAAI;YAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAClI,OAAO,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC,EAAE,CAAC,CAAC;IACP,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,GAAG;eAC9F,WAAW,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC5I,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;AACvD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAgC,EAAE,wBAAgC,EACvG,WAAkD;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;WACpH,CAAC,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC9I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACnL,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC7D,IAAI,MAA0B,EAAE,OAAO,GAAG,KAAK,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK;YAC9G,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,CAAU;YACrD,sBAAsB,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,OAAO;gBAAE,MAAM,KAAK,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAU,EAAE,CAAC,CAAC;QACvH,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,SAAS;YAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,KAAK,GAAsB,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9D,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,OAAO,CAAC,CAAC;YACf,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;YAC7I,IAAI,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACtI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,EAAE,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,WAAW;oBAAE,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;gBACnG,MAAM,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;oBACpI,UAAU,EAAE,CAAC,sBAAsB,EAAE,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC,sBAAsB,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;gBAChI,MAAM,EAAE,CAAC;gBACT,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACzG,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBACtH,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC;oBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC9I,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,CAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACzI,CAAC;YACD,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,cAAc,CAAC;gBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,kHAAkH;QAClH,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS;YACvI,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC;YAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,UAAU;gBAAE,MAAM,KAAK,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAC3G,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC7H,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,CAAC;AACpF,CAAC"}

package/dist/hub/init/existing-fleet.d.ts

@@ -0,0 +1,6 @@
+export interface FleetProbe {
+    /** True when the pid in fleet.pid is a live process. */
+    pidAlive(pid: number): boolean;
+}
+export declare function existingFleetEvidence(home: string, probe: FleetProbe): string[];
+export declare const realFleetProbe: () => FleetProbe;

package/dist/hub/init/existing-fleet.js

@@ -0,0 +1,58 @@
+/**
+ * Is there already a personal fleet in this OS account? (hub.md §1 "Web entry and same-machine trust"; #3095 addendum
+ * "Hub and a personal fleet on one machine".) A Hub in the same account shares the UID with that fleet's full-tool
+ * agents, so the wizard warns, recommends a dedicated account and needs an explicit confirmation.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import yaml from "js-yaml";
+import { isSetupComplete } from "../../setup-marker.js";
+export function existingFleetEvidence(home, probe) {
+    const evidence = [];
+    const fleetYaml = join(home, "fleet.yaml");
+    if (existsSync(fleetYaml)) {
+        let cfg;
+        try {
+            const loaded = yaml.load(readFileSync(fleetYaml, "utf8"));
+            cfg = loaded && typeof loaded === "object" ? loaded : undefined;
+        }
+        catch {
+            evidence.push("fleet.yaml (unreadable)");
+        }
+        if (cfg) {
+            const instances = cfg.instances && typeof cfg.instances === "object" ? Object.keys(cfg.instances).length : 0;
+            if (instances > 0)
+                evidence.push(`fleet.yaml with ${instances} agent(s)`);
+            const channels = Array.isArray(cfg.channels) ? cfg.channels.length : 0;
+            if (cfg.channel || channels > 0)
+                evidence.push("fleet.yaml with a chat channel");
+        }
+    }
+    try {
+        if (isSetupComplete(home))
+            evidence.push("a completed fleet setup");
+    }
+    catch {
+        /* unreadable marker: other evidence decides */
+    }
+    const pidFile = join(home, "fleet.pid");
+    if (existsSync(pidFile)) {
+        const pid = Number.parseInt(readFileSync(pidFile, "utf8").trim(), 10);
+        if (Number.isInteger(pid) && pid > 0 && probe.pidAlive(pid))
+            evidence.push(`a running fleet (pid ${pid})`);
+    }
+    return evidence;
+}
+// An installed AgEnD service alone is not evidence: a dedicated Hub account runs the same service with no agents.
+export const realFleetProbe = () => ({
+    pidAlive(pid) {
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch (err) {
+            return err.code === "EPERM";
+        }
+    },
+});
+//# sourceMappingURL=existing-fleet.js.map

package/dist/hub/init/existing-fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"existing-fleet.js","sourceRoot":"","sources":["../../../src/hub/init/existing-fleet.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAOxD,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAiB;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,IAAI,GAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,GAAG,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACvH,IAAI,SAAS,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,SAAS,WAAW,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAe,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;QACzD,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/hub/init/handoff.d.ts

@@ -0,0 +1,8 @@
+import { type HubInstallationInventory } from "./inventory.js";
+export interface HubHandoffService {
+    installed: boolean;
+    path?: string | null;
+    manager?: string | null;
+}
+export declare function hubHandoffLines(home: string, inventory: HubInstallationInventory, service?: HubHandoffService): string[];
+export declare function runHubHandoffCommand(): Promise<void>;

package/dist/hub/init/handoff.js

@@ -0,0 +1,36 @@
+/** Local-owner display only: no lifecycle commands, networking, secret reads or deletion. */
+import { join } from "node:path";
+import { getAgendHome } from "../../paths.js";
+import { ht } from "./text.js";
+import { HUB_INVENTORY_REL, HUB_INVENTORY_PATHS, readHubInstallationInventory } from "./inventory.js";
+const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+export function hubHandoffLines(home, inventory, service) {
+    if (/[\u0000-\u001f\u007f]/.test(home))
+        throw Error("invalid_hub_handoff_home");
+    const command = (args) => `AGEND_HOME=${quote(home)} agend ${args}`;
+    return [ht("handoff_title", inventory.recordedAt), ht("handoff_snapshot"),
+        ht("handoff_record", join(home, HUB_INVENTORY_REL)),
+        ...HUB_INVENTORY_PATHS.map((path, i) => ht(['handoff_config', 'handoff_data', 'handoff_log'][i], join(home, path))),
+        ...(service?.installed && service.path ? [ht("handoff_service", JSON.stringify(service.path), service.manager ?? "AgEnD")] : []),
+        ht("handoff_scope"), ht("handoff_stop", command("stop")), ht("handoff_restart", command("restart")),
+        ht("handoff_uninstall", command("uninstall")), ht("handoff_preserve"),
+        ht("handoff_repeat", command("hub handoff")), ht("pairing_title"),
+        ht("pairing_steps", inventory.webOrigin, inventory.memberOrigin, inventory.spkiSha256)];
+}
+export async function runHubHandoffCommand() {
+    try {
+        const home = getAgendHome(), inventory = readHubInstallationInventory(home);
+        let service;
+        try {
+            const { inspectService } = await import("../../service-installer.js");
+            service = inspectService("com.agend.fleet");
+        }
+        catch { /* Optional service observation must not hide the recorded handoff. */ }
+        console.log(hubHandoffLines(home, inventory, service).join("\n"));
+    }
+    catch {
+        console.error(ht("handoff_unavailable"));
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=handoff.js.map

package/dist/hub/init/handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.js","sourceRoot":"","sources":["../../../src/hub/init/handoff.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,4BAA4B,EAAiC,MAAM,gBAAgB,CAAC;AAGrI,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAErE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAmC,EAAE,OAA2B;IAC5G,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5E,OAAO,CAAC,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACvE,EAAE,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACnD,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAW,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/H,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChI,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACnG,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC;QACrE,EAAE,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;QACjE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,EAAE,EAAE,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,OAAsC,CAAC;QAC3C,IAAI,CAAC;YAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QAC3H,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/hub/init/identity.d.ts

@@ -0,0 +1,5 @@
+/** The quickstart can inspect availability without loading key, filesystem or network modules. */
+import { type HubIdentityProvider } from "./types.js";
+/** Explicit unsupported-build/platform provider; initialization refuses before writing anything. */
+export declare const UNAVAILABLE_IDENTITY: HubIdentityProvider;
+export declare function hubIdentityProvider(): HubIdentityProvider;

package/dist/hub/init/identity.js

@@ -0,0 +1,24 @@
+/** The quickstart can inspect availability without loading key, filesystem or network modules. */
+import { HubInitError } from "./types.js";
+/** Explicit unsupported-build/platform provider; initialization refuses before writing anything. */
+export const UNAVAILABLE_IDENTITY = {
+    available: false,
+    provision: async () => {
+        throw new HubInitError("Hub key generation is not available in this build yet");
+    },
+    read: async () => undefined,
+    seal: () => {
+        throw new HubInitError("Hub key generation is not available in this build yet");
+    },
+};
+const S1_IDENTITY = {
+    available: true,
+    provision: async (input) => (await import("../tls.js")).provisionHubIdentity(input),
+    read: async (home) => (await import("../tls.js")).readHubIdentityIfPresent(home),
+    seal: async (input) => (await import("../initialization.js")).sealHubInitialization(input),
+};
+export function hubIdentityProvider() {
+    // Native Windows needs a verified private-file ACL adapter. WSL uses its POSIX owner/mode boundary.
+    return process.platform === "win32" ? UNAVAILABLE_IDENTITY : S1_IDENTITY;
+}
+//# sourceMappingURL=identity.js.map

package/dist/hub/init/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/hub/init/identity.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AAEpE,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,KAAK,IAAI,EAAE;QACpB,MAAM,IAAI,YAAY,CAAC,uDAAuD,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;IAC3B,IAAI,EAAE,GAAG,EAAE;QACT,MAAM,IAAI,YAAY,CAAC,uDAAuD,CAAC,CAAC;IAClF,CAAC;CACF,CAAC;AAEF,MAAM,WAAW,GAAwB;IACvC,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC;IACjF,IAAI,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;IAC9E,IAAI,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;CACzF,CAAC;AACF,MAAM,UAAU,mBAAmB;IACjC,oGAAoG;IACpG,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC;AAC3E,CAAC"}

package/dist/hub/init/initializer.d.ts

@@ -0,0 +1,24 @@
+import { type FleetProbe } from "./existing-fleet.js";
+import { type HubIdentityProvider, type HubIdentitySummary, type HubInitializer, type HubInitPlan } from "./types.js";
+export declare const STAGES: readonly ["started", "identity", "web-tls", "secret", "config", "manifest", "enabled"];
+export type HubInitStage = (typeof STAGES)[number];
+export interface HubInitializerDeps {
+    home: string;
+    identity: HubIdentityProvider;
+    probe: FleetProbe;
+    now?: () => number;
+    /** The owner private directories must have (default: this process's uid). A seam for the other-owner refusal. */
+    uid?: number;
+    /** Test seam: called after each stage is durably recorded; a throw simulates an interruption there. */
+    afterStage?: (stage: HubInitStage) => void;
+}
+export declare function originProblems(label: string, text: string): string[];
+/** A listener names one interface: an IP address or host name, never a wildcard (no implicit all-interface exposure). */
+export declare function listenProblems(label: string, listen: {
+    host: string;
+    port: number;
+} | undefined): string[];
+export declare function createHubInitializer(deps: HubInitializerDeps): HubInitializer;
+/** The hub.* settings exactly as hubConfigPatches writes them (for the sealed digest). */
+export declare function hubSettingsFor(plan: HubInitPlan, identity: HubIdentitySummary): Record<string, unknown>;
+export { UNAVAILABLE_IDENTITY } from "./identity.js";