@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/hub/init/initializer.js

@@ -0,0 +1,385 @@
+/**
+ * HubInitializer (S-48 / S5a; hub.md §5). Validates a plan, binds the local owner's confirmation to that exact plan,
+ * then commits in durable stages under an operation receipt:
+ *
+ *   started → identity (S1 keys) → web-tls → secret → config (hub.* with enabled: false) → manifest → enabled
+ *
+ * `hub.enabled: true` is the last write. An interrupted commit leaves the Hub off and a visible repair state; it can
+ * be resumed only with the same plan (the saved answers) and never overwrites another Hub identity, never repoints
+ * credentials, never installs a service (the wizard asks for that separately, afterwards).
+ */
+import { createHash, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
+import { isIP } from "node:net";
+import { existsSync, lstatSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+import yaml from "js-yaml";
+import { atomicWriteFileSync } from "../../atomic-write.js";
+import { applyFleetYamlPatches } from "../../fleet-yaml-patch.js";
+import { HubDirectoryConfigError, resolveDirectoryConfig } from "../directory/index.js";
+import { isCanonicalObjectId } from "../directory/profiles.js";
+import { checkBrowserTls } from "./browser-tls.js";
+import { existingFleetEvidence } from "./existing-fleet.js";
+import { BIND_PASSWORD_REF, ENABLE_PATCH, WEB_TLS_CONFIG, hubConfigPatches, hubPaths } from "./layout.js";
+import { hubPlanDigest } from "./plan-digest.js";
+import { HubInitError, } from "./types.js";
+import { hubInstallationInventory } from "./inventory.js";
+export const STAGES = ["started", "identity", "web-tls", "secret", "config", "manifest", "enabled"];
+const CONFIRMATION_TTL_MS = 10 * 60_000;
+const MAX_PEM_BYTES = 1024 * 1024;
+const NAME = /^[^\u0000-\u001f\u007f]{1,64}$/;
+const TLS_TEXT = {
+    "cert-unreadable": "the certificate file is not a PEM certificate",
+    "key-unreadable": "the key file is not an unencrypted PEM private key",
+    "key-mismatch": "the private key does not belong to the certificate",
+    "host-not-covered": "the certificate does not name the web address's host",
+    "not-yet-valid": "the certificate is not valid yet",
+    expired: "the certificate has expired",
+    "ca-certificate": "the first certificate is a CA certificate, not the server's",
+};
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value).filter(([, v]) => v !== undefined);
+        entries.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+function readPem(path, label, problems) {
+    try {
+        const st = statSync(path);
+        if (!st.isFile()) {
+            problems.push(`${label}: not a file`);
+            return undefined;
+        }
+        if (st.size > MAX_PEM_BYTES) {
+            problems.push(`${label}: larger than 1 MB`);
+            return undefined;
+        }
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        problems.push(`${label}: cannot be read`);
+        return undefined;
+    }
+}
+export function originProblems(label, text) {
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        return [`${label}: not a URL`];
+    }
+    const problems = [];
+    if (url.protocol !== "https:")
+        problems.push(`${label}: must be https:// (there is no plaintext sign-in)`);
+    if (url.username || url.password)
+        problems.push(`${label}: must not carry credentials`);
+    if ((url.pathname && url.pathname !== "/") || url.search || url.hash)
+        problems.push(`${label}: must be https://host[:port] only`);
+    if (!url.hostname)
+        problems.push(`${label}: has no host`);
+    if (problems.length === 0 && url.origin !== text.replace(/\/$/, ""))
+        problems.push(`${label}: write it as ${url.origin}`);
+    return problems;
+}
+const HOSTNAME = /^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+/** A listener names one interface: an IP address or host name, never a wildcard (no implicit all-interface exposure). */
+export function listenProblems(label, listen) {
+    if (!listen || typeof listen !== "object")
+        return [`${label}: required`];
+    const problems = [];
+    const host = typeof listen.host === "string" ? listen.host : "";
+    if (host === "0.0.0.0" || host === "::" || host === "*" || host === "") {
+        problems.push(`${label}: name one interface address (a wildcard would listen on every network)`);
+    }
+    else if (!isIP(host) && !HOSTNAME.test(host)) {
+        problems.push(`${label}: "${host}" is not an IP address or host name`);
+    }
+    if (!Number.isInteger(listen.port) || listen.port < 1 || listen.port > 65535)
+        problems.push(`${label}: port must be 1–65535`);
+    return problems;
+}
+/** Private directory: created 0700, never a symlink, owned by `uid`. */
+function ensurePrivateDir(path, uid) {
+    let st;
+    try {
+        st = lstatSync(path);
+    }
+    catch {
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+        st = lstatSync(path);
+    }
+    if (st.isSymbolicLink() || !st.isDirectory())
+        throw new HubInitError(`${path} is not a private directory (a symlink or not a directory)`);
+    if (uid !== undefined && st.uid !== uid)
+        throw new HubInitError(`${path} is owned by another user`);
+    if ((st.mode & 0o077) !== 0)
+        throw new HubInitError(`${path} is readable by other users (mode ${(st.mode & 0o777).toString(8)})`);
+}
+function writePrivate(path, content, uid) {
+    ensurePrivateDir(dirname(path), uid);
+    atomicWriteFileSync(path, content, { mode: 0o600 });
+    const mode = statSync(path).mode & 0o777;
+    if ((mode & 0o077) !== 0)
+        throw new HubInitError(`${path} could not be made private (mode ${mode.toString(8)})`);
+}
+export function createHubInitializer(deps) {
+    const paths = hubPaths(deps.home);
+    const now = deps.now ?? Date.now;
+    const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : undefined);
+    const pending = new Map();
+    const readReceipt = () => {
+        if (!existsSync(paths.operation))
+            return undefined;
+        try {
+            const parsed = JSON.parse(readFileSync(paths.operation, "utf8"));
+            if (parsed?.version !== 1 || typeof parsed.planDigest !== "string" || !Array.isArray(parsed.done))
+                throw new Error("shape");
+            return parsed;
+        }
+        catch {
+            throw new HubInitError(`the initialization receipt ${paths.operation} is unreadable; inspect ${paths.hub} before trying again`);
+        }
+    };
+    const writeReceipt = (receipt) => writePrivate(paths.operation, `${JSON.stringify(receipt, null, 2)}\n`, uid);
+    const hubConfigured = () => {
+        if (!existsSync(paths.fleetYaml))
+            return false;
+        try {
+            return /^hub:\s*$/m.test(readFileSync(paths.fleetYaml, "utf8")) && /^\s+hubId:/m.test(readFileSync(paths.fleetYaml, "utf8"));
+        }
+        catch {
+            return false;
+        }
+    };
+    const inspect = async () => {
+        const fleetEvidence = existingFleetEvidence(deps.home, deps.probe);
+        const receipt = readReceipt();
+        // An unfinished receipt means incomplete, even when its manifest is already written (enabled comes after it).
+        const complete = receipt ? receipt.done.includes("enabled") : existsSync(paths.manifest) || hubConfigured();
+        const keysPresent = existsSync(paths.keys) || (await deps.identity.read(deps.home).catch(() => undefined)) !== undefined;
+        const incomplete = receipt && !complete ? { startedAt: receipt.startedAt, stage: receipt.done[receipt.done.length - 1] ?? "started", plan: receipt.plan } : undefined;
+        return {
+            existingFleet: fleetEvidence.length > 0,
+            existingHub: complete || (!receipt && keysPresent),
+            fleetEvidence,
+            ...(incomplete ? { incomplete } : {}),
+        };
+    };
+    /** All problems with the plan; reads the certificate files. */
+    const problemsOf = async (plan, inspection) => {
+        const problems = [];
+        if (!deps.identity.available) {
+            problems.push("Hub key generation is not available in this build yet: it ships with the Hub transport. Nothing was changed.");
+        }
+        if (inspection.existingHub)
+            problems.push(`a Hub is already initialized under ${deps.home}; initialization never replaces a Hub identity`);
+        if (typeof plan.name !== "string" || !NAME.test(plan.name.trim()) || plan.name !== plan.name.trim())
+            problems.push("name: 1–64 characters, no control characters, no leading or trailing spaces");
+        problems.push(...originProblems("web address", plan.webOrigin), ...originProblems("member address", plan.memberOrigin));
+        problems.push(...listenProblems("member listener", plan.memberListen), ...listenProblems("web listener", plan.webListen));
+        if (plan.memberListen && plan.webListen && plan.memberListen.host === plan.webListen.host && plan.memberListen.port === plan.webListen.port) {
+            problems.push("the member listener and the web listener must use different addresses");
+        }
+        if (plan.webOrigin === plan.memberOrigin)
+            problems.push("the web address and the member address must differ (browsers and members use separate origins)");
+        try {
+            resolveDirectoryConfig(plan.directory);
+        }
+        catch (err) {
+            problems.push(err instanceof HubDirectoryConfigError ? err.message : "directory: invalid settings");
+        }
+        if (plan.bindPasswordRef !== BIND_PASSWORD_REF)
+            problems.push(`bindPasswordRef must be ${BIND_PASSWORD_REF}`);
+        const admin = plan.administrator;
+        if (!admin || admin.realm !== plan.directory?.realm || !isCanonicalObjectId(admin.objectId ?? "")) {
+            problems.push("administrator: must be the designated directory identity (same realm, immutable object id)");
+        }
+        for (const [key, value] of Object.entries(plan.retention ?? {})) {
+            if (!Number.isInteger(value) || value < 1 || value > 3650)
+                problems.push(`retention.${key}: a whole number of days from 1 to 3650`);
+        }
+        if (!plan.retention || !("contentDays" in plan.retention) || !("eventDays" in plan.retention))
+            problems.push("retention: both contentDays and eventDays are required (there is no default)");
+        if (plan.coexistence === "dedicated" && inspection.existingFleet) {
+            problems.push(`this account already runs a fleet (${inspection.fleetEvidence.join(", ")}): use a dedicated account, or confirm the same-account pilot`);
+        }
+        else if (plan.coexistence === "same-user-pilot" && !inspection.existingFleet) {
+            problems.push('coexistence "same-user-pilot" is only for an account that already runs a fleet');
+        }
+        else if (plan.coexistence !== "dedicated" && plan.coexistence !== "same-user-pilot") {
+            problems.push('coexistence must be "dedicated" or "same-user-pilot"');
+        }
+        let digestExtra;
+        let pems;
+        const certPem = readPem(plan.webTls?.certFile ?? "", "browser certificate", problems);
+        const keyPem = readPem(plan.webTls?.keyFile ?? "", "browser private key", problems);
+        if (certPem !== undefined && keyPem !== undefined && originProblems("web address", plan.webOrigin).length === 0) {
+            const check = checkBrowserTls(certPem, keyPem, plan.webOrigin, now());
+            for (const p of check.problems)
+                problems.push(`browser certificate: ${TLS_TEXT[p]}`);
+            if (check.ok) {
+                const spki = createPublicKey(createPrivateKey(keyPem)).export({ type: "spki", format: "der" });
+                digestExtra = { webCertSha256: sha256(certPem), webKeySpkiSha256: sha256(spki) };
+                pems = { cert: certPem, key: keyPem };
+            }
+        }
+        return { problems, ...(digestExtra ? { digestExtra } : {}), ...(pems ? { pems } : {}) };
+    };
+    const digestOf = (plan, extra) => sha256(canonical({ plan, ...extra }));
+    /** Validation for a commit that may resume this plan's own interrupted operation. */
+    const inspectionFor = async (plan) => {
+        const inspection = await inspect();
+        const receipt = readReceipt();
+        if (receipt && inspection.incomplete) {
+            // The plan's own interrupted operation is not "another Hub"; anything else is.
+            const fresh = await problemsOf(plan, { ...inspection, existingHub: false });
+            if (fresh.digestExtra && digestOf(plan, fresh.digestExtra) === receipt.planDigest)
+                return { ...inspection, existingHub: false };
+            return { ...inspection, existingHub: true };
+        }
+        return inspection;
+    };
+    const validate = async (plan) => {
+        const { problems } = await problemsOf(plan, await inspectionFor(plan));
+        if (problems.length > 0)
+            throw new HubInitError(problems[0], problems);
+    };
+    return {
+        inspect,
+        validate,
+        async prepareConfirmation(plan, secrets) {
+            const inspection = await inspectionFor(plan);
+            const { problems, digestExtra } = await problemsOf(plan, inspection);
+            if (!secrets || typeof secrets.bindPassword !== "string" || secrets.bindPassword.length === 0)
+                problems.push("the directory service account password is missing");
+            if (problems.length > 0 || !digestExtra)
+                throw new HubInitError(problems[0] ?? "the plan is not valid", problems);
+            const planDigest = digestOf(plan, digestExtra);
+            const reference = randomBytes(16).toString("hex");
+            pending.set(reference, { planDigest, secrets: { bindPassword: secrets.bindPassword }, expiresAt: now() + CONFIRMATION_TTL_MS });
+            const summary = [
+                `Hub name: ${plan.name}`,
+                `Web address (browsers): ${plan.webOrigin}`,
+                `Member address (fleets connect here): ${plan.memberOrigin}`,
+                `Listeners: web ${plan.webListen.host}:${plan.webListen.port}, members ${plan.memberListen.host}:${plan.memberListen.port}`,
+                `Browser certificate: ${plan.webTls.certFile}`,
+                `Directory: ${plan.directory.url} (realm ${plan.directory.realm}, ${plan.directory.profile})`,
+                `Hub administrator: ${plan.administrator.realm}/${plan.administrator.objectId}`,
+                `Retention: question/answer content ${plan.retention.contentDays} days, event records ${plan.retention.eventDays} days`,
+                `Placement: ${plan.coexistence === "dedicated" ? "dedicated account" : "same account as an existing fleet (pilot only)"}`,
+            ].join("\n");
+            return { reference, planDigest, summary };
+        },
+        async commit(plan, localOwnerConfirmation) {
+            const held = pending.get(localOwnerConfirmation);
+            pending.delete(localOwnerConfirmation); // single use, whatever happens next
+            if (!held)
+                throw new HubInitError("this confirmation is unknown or was already used; confirm the plan again");
+            if (held.expiresAt <= now())
+                throw new HubInitError("this confirmation expired; confirm the plan again");
+            const inspection = await inspectionFor(plan);
+            const { problems, digestExtra, pems } = await problemsOf(plan, inspection);
+            if (problems.length > 0 || !digestExtra || !pems)
+                throw new HubInitError(problems[0] ?? "the plan is not valid", problems);
+            const planDigest = digestOf(plan, digestExtra);
+            if (planDigest !== held.planDigest)
+                throw new HubInitError("the plan or its certificate files changed after confirmation; confirm again");
+            ensurePrivateDir(paths.hub, uid);
+            let receipt = readReceipt();
+            if (receipt && receipt.planDigest !== planDigest)
+                throw new HubInitError("another initialization is in progress with different answers");
+            if (!receipt) {
+                receipt = { version: 1, operationId: randomBytes(8).toString("hex"), planDigest, startedAt: new Date(now()).toISOString(), plan, done: ["started"] };
+                writeReceipt(receipt);
+                deps.afterStage?.("started");
+            }
+            const r = receipt;
+            const mark = (stage) => {
+                if (!r.done.includes(stage))
+                    r.done.push(stage);
+                writeReceipt(r);
+                deps.afterStage?.(stage);
+            };
+            // identity: S1 creates the keys; a resumed operation must find exactly the identity it created.
+            let identity;
+            if (r.done.includes("identity")) {
+                const found = await deps.identity.read(deps.home);
+                if (!found || !r.identity || found.hubId !== r.identity.hubId || found.spkiSha256 !== r.identity.spkiSha256) {
+                    throw new HubInitError("the Hub identity on disk is not the one this initialization created; nothing more was changed");
+                }
+                identity = found;
+            }
+            else {
+                if (await deps.identity.read(deps.home))
+                    throw new HubInitError("a Hub identity already exists that this initialization did not create; nothing was replaced");
+                identity = await deps.identity.provision({ home: deps.home, memberOrigin: plan.memberOrigin });
+                r.identity = identity;
+                mark("identity");
+            }
+            if (!r.done.includes("web-tls")) {
+                // The exact PEM text that was checked and bound to the confirmation (certificate hash and key SPKI): no re-read.
+                writePrivate(paths.webCert, pems.cert, uid);
+                writePrivate(paths.webKey, pems.key, uid);
+                mark("web-tls");
+            }
+            // On resume the password typed now wins: an earlier run's file is rewritten when it differs.
+            const storedSecret = r.done.includes("secret") && existsSync(paths.bindSecret) ? readFileSync(paths.bindSecret, "utf8") : undefined;
+            if (storedSecret !== held.secrets.bindPassword) {
+                writePrivate(paths.bindSecret, held.secrets.bindPassword, uid);
+                mark("secret");
+            }
+            if (!r.done.includes("config")) {
+                if (!existsSync(paths.fleetYaml))
+                    atomicWriteFileSync(paths.fleetYaml, "hub:\n  enabled: false\n", { mode: 0o600 });
+                // An existing fleet's file without hub: create the block (off) first; the patcher writes leaves under it.
+                const current = yaml.load(readFileSync(paths.fleetYaml, "utf8"));
+                if (!current || typeof current !== "object" || !("hub" in current))
+                    applyFleetYamlPatches(paths.fleetYaml, [{ path: ["hub"], value: { enabled: false } }]);
+                applyFleetYamlPatches(paths.fleetYaml, hubConfigPatches(plan, identity));
+                mark("config");
+            }
+            if (!r.done.includes("manifest")) {
+                // Sealed by S1 with the issuer key over the normalized settings now in fleet.yaml; the mount re-checks both.
+                const sealedDigest = hubPlanDigest({ ...hubSettingsFor(plan, identity) });
+                const committedAt = new Date(now()).toISOString();
+                const confirmationId = sha256(localOwnerConfirmation).slice(0, 32);
+                const signature = await deps.identity.seal({ home: deps.home, planDigest: sealedDigest, confirmationId, committedAt });
+                const manifest = { v: 1, hubId: identity.hubId, planDigest: sealedDigest, committedAt, confirmationId, signature };
+                writePrivate(paths.manifest, `${JSON.stringify(manifest, null, 2)}\n`, uid);
+                mark("manifest");
+            }
+            if (!r.done.includes("enabled")) {
+                // An unsigned, informational record alongside the sealed runtime manifest; enabled is still the last patch.
+                // Also creates the record when resuming a pre-inventory operation that already completed the manifest stage.
+                writePrivate(paths.inventory, `${JSON.stringify(hubInstallationInventory(plan, identity, new Date(now()).toISOString()), null, 2)}\n`, uid);
+                applyFleetYamlPatches(paths.fleetYaml, [ENABLE_PATCH]);
+                mark("enabled");
+            }
+            held.secrets.bindPassword = "";
+            return { hubId: identity.hubId, spkiSha256: identity.spkiSha256, issuerKeyId: identity.issuerKeyId, configPath: paths.fleetYaml };
+        },
+    };
+}
+/** The hub.* settings exactly as hubConfigPatches writes them (for the sealed digest). */
+export function hubSettingsFor(plan, identity) {
+    return {
+        name: plan.name,
+        hubId: identity.hubId,
+        webOrigin: plan.webOrigin,
+        memberOrigin: plan.memberOrigin,
+        memberListen: plan.memberListen,
+        webListen: plan.webListen,
+        webTls: WEB_TLS_CONFIG,
+        directory: { ...plan.directory, bindPasswordRef: plan.bindPasswordRef },
+        administrator: plan.administrator,
+        retention: plan.retention,
+        coexistence: plan.coexistence,
+    };
+}
+export { UNAVAILABLE_IDENTITY } from "./identity.js";
+//# sourceMappingURL=initializer.js.map

package/dist/hub/init/initializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initializer.js","sourceRoot":"","sources":["../../../src/hub/init/initializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAA0B,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAmB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,YAAY,GASb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;AAwB7G,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AACxC,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;AAClC,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAE9C,MAAM,QAAQ,GAAsC;IAClD,iBAAiB,EAAE,+CAA+C;IAClE,gBAAgB,EAAE,oDAAoD;IACtE,cAAc,EAAE,oDAAoD;IACpE,kBAAkB,EAAE,sDAAsD;IAC1E,eAAe,EAAE,kCAAkC;IACnD,OAAO,EAAE,6BAA6B;IACtC,gBAAgB,EAAE,6DAA6D;CAChF,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAqB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE1F,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,QAAkB;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAC3G,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACxF,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAClI,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1H,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,QAAQ,GAAG,kHAAkH,CAAC;AAEpI,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAkD;IAC9F,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,yEAAyE,CAAC,CAAC;IACnG,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IAC9H,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,IAAY,EAAE,GAAuB;IAC7D,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;IAC1I,IAAI,GAAG,KAAK,SAAS,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACpG,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,qCAAqC,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpI,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe,EAAE,GAAuB;IAC1E,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,oCAAoC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8E,CAAC;IAEtG,MAAM,WAAW,GAAG,GAAiC,EAAE;QACrD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAqB,CAAC;YACrF,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5H,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,8BAA8B,KAAK,CAAC,SAAS,2BAA2B,KAAK,CAAC,GAAG,sBAAsB,CAAC,CAAC;QAClI,CAAC;IACH,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhI,MAAM,aAAa,GAAG,GAAY,EAAE;QAClC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAgC,EAAE;QACrD,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,8GAA8G;QAC9G,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;QAC5G,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,CAAC;QACzH,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrJ,OAAO;YACL,aAAa,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;YACvC,WAAW,EAAE,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC;YAClD,aAAa;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC;IAEF,+DAA+D;IAC/D,MAAM,UAAU,GAAG,KAAK,EACtB,IAAiB,EACjB,UAA6B,EACgF,EAAE;QAC/G,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,8GAA8G,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,UAAU,CAAC,WAAW;YAAE,QAAQ,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,IAAI,gDAAgD,CAAC,CAAC;QAC3I,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAClM,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACxH,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1H,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC5I,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC1J,IAAI,CAAC;YACH,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,KAAK,iBAAiB;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,iBAAiB,EAAE,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,yCAAyC,CAAC,CAAC;QACtI,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC7L,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,sCAAsC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC1J,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,KAAK,iBAAiB,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAC/E,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAClG,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,WAA+C,CAAC;QACpD,IAAI,IAA+C,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QACpF,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChH,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/F,WAAW,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,IAAiB,EAAE,KAA6B,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IAE7G,qFAAqF;IACrF,MAAM,aAAa,GAAG,KAAK,EAAE,IAAiB,EAA8B,EAAE;QAC5E,MAAM,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACrC,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,UAAU;gBAAE,OAAO,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAChI,OAAO,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAiB,EAAiB,EAAE;QAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,QAAQ;QAER,KAAK,CAAC,mBAAmB,CAAC,IAAiB,EAAE,OAAuB;YAClE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAClK,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;YAClH,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;YAChI,MAAM,OAAO,GAAG;gBACd,aAAa,IAAI,CAAC,IAAI,EAAE;gBACxB,2BAA2B,IAAI,CAAC,SAAS,EAAE;gBAC3C,yCAAyC,IAAI,CAAC,YAAY,EAAE;gBAC5D,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,aAAa,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;gBAC3H,wBAAwB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC9C,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG;gBAC7F,sBAAsB,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE;gBAC/E,sCAAsC,IAAI,CAAC,SAAS,CAAC,WAAW,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,OAAO;gBACvH,cAAc,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gDAAgD,EAAE;aAC1H,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,sBAA8B;YAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACjD,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,oCAAoC;YAC5E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,YAAY,CAAC,0EAA0E,CAAC,CAAC;YAC9G,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,mDAAmD,CAAC,CAAC;YAEzG,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;YAC3H,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,YAAY,CAAC,6EAA6E,CAAC,CAAC;YAE1I,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;YAC5B,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;gBAAE,MAAM,IAAI,YAAY,CAAC,8DAA8D,CAAC,CAAC;YACzI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrJ,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,CAAC,GAAG,OAAO,CAAC;YAClB,MAAM,IAAI,GAAG,CAAC,KAAmB,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChD,YAAY,CAAC,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC;YAEF,gGAAgG;YAChG,IAAI,QAA4B,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC5G,MAAM,IAAI,YAAY,CAAC,+FAA+F,CAAC,CAAC;gBAC1H,CAAC;gBACD,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,YAAY,CAAC,6FAA6F,CAAC,CAAC;gBAC/J,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC/F,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACtB,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,iHAAiH;gBACjH,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5C,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,CAAC;YAClB,CAAC;YAED,6FAA6F;YAC7F,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpI,IAAI,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC/C,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;oBAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpH,0GAA0G;gBAC1G,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAmC,CAAC;gBACnG,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC;oBAAE,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3J,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,6GAA6G;gBAC7G,MAAM,YAAY,GAAG,aAAa,CAAC,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1E,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClD,MAAM,cAAc,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvH,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;gBACnH,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5E,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,4GAA4G;gBAC5G,6GAA6G;gBAC7G,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5I,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;gBACvD,IAAI,CAAC,SAAS,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpI,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,IAAiB,EAAE,QAA4B;IAC5E,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;QACvE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/hub/init/inventory.d.ts

@@ -0,0 +1,17 @@
+import type { HubIdentitySummary, HubInitPlan } from "./types.js";
+export declare const HUB_INVENTORY_REL = "hub/install-inventory.json";
+export declare const HUB_INVENTORY_PATHS: readonly ["fleet.yaml", "hub/", "fleet.log"];
+export interface HubInstallationInventory {
+    v: 1;
+    purpose: "installation-record";
+    recordedAt: string;
+    hubId: string;
+    webOrigin: string;
+    memberOrigin: string;
+    spkiSha256: string;
+    coexistence: HubInitPlan["coexistence"];
+    serviceLabel: "com.agend.fleet";
+    paths: readonly string[];
+}
+export declare function hubInstallationInventory(plan: HubInitPlan, identity: HubIdentitySummary, recordedAt: string): HubInstallationInventory;
+export declare function readHubInstallationInventory(home: string): HubInstallationInventory;

package/dist/hub/init/inventory.js

@@ -0,0 +1,33 @@
+/** Informational installation inventory. Never used for admission, runtime authority or file removal. */
+import { readPrivateFile } from "../private-files.js";
+export const HUB_INVENTORY_REL = "hub/install-inventory.json";
+export const HUB_INVENTORY_PATHS = ["fleet.yaml", "hub/", "fleet.log"];
+export function hubInstallationInventory(plan, identity, recordedAt) {
+    // Select only public setup metadata. Never copy directory config, passwords, PEMs, imported paths or admin identity.
+    return { v: 1, purpose: "installation-record", recordedAt, hubId: identity.hubId, webOrigin: plan.webOrigin,
+        memberOrigin: plan.memberOrigin, spkiSha256: identity.spkiSha256, coexistence: plan.coexistence,
+        serviceLabel: "com.agend.fleet", paths: [...HUB_INVENTORY_PATHS] };
+}
+function origin(value) {
+    if (typeof value !== "string" || /[\u0000-\u0020\u007f]/.test(value))
+        return false;
+    try {
+        const u = new URL(value);
+        return u.protocol === "https:" && u.origin === value && !u.username && !u.password;
+    }
+    catch {
+        return false;
+    }
+}
+export function readHubInstallationInventory(home) {
+    const x = JSON.parse(readPrivateFile(home, HUB_INVENTORY_REL, 8192));
+    if (x?.v !== 1 || x.purpose !== "installation-record" || typeof x.recordedAt !== "string"
+        || !Number.isFinite(Date.parse(x.recordedAt)) || new Date(x.recordedAt).toISOString() !== x.recordedAt
+        || typeof x.hubId !== "string" || !/^[a-zA-Z0-9._:-]{1,128}$/.test(x.hubId)
+        || !origin(x.webOrigin) || !origin(x.memberOrigin) || !/^[a-f0-9]{64}$/.test(x.spkiSha256)
+        || !["dedicated", "same-user-pilot"].includes(x.coexistence) || x.serviceLabel !== "com.agend.fleet"
+        || JSON.stringify(x.paths) !== JSON.stringify(HUB_INVENTORY_PATHS))
+        throw Error("invalid_hub_installation_inventory");
+    return x;
+}
+//# sourceMappingURL=inventory.js.map

package/dist/hub/init/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../../../src/hub/init/inventory.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAchF,MAAM,UAAU,wBAAwB,CAAC,IAAiB,EAAE,QAA4B,EAAE,UAAkB;IAC1G,qHAAqH;IACrH,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;QACzG,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC/F,YAAY,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAAC,CAAC;IACrH,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,CAAC,GAA6B,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;WACpF,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,UAAU;WACnG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;WACxE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;WACvF,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,iBAAiB;WACjG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/hub/init/layout.d.ts

@@ -0,0 +1,32 @@
+import type { RawConfigPatch } from "../../settings-api.js";
+import type { HubIdentitySummary, HubInitPlan } from "./types.js";
+export declare const HUB_DIR = "hub";
+export declare const BIND_SECRET_REL = "hub/secrets/directory-bind";
+export declare const BIND_PASSWORD_REF = "file:hub/secrets/directory-bind";
+export declare function hubPaths(home: string): {
+    hub: string;
+    keys: string;
+    initDir: string;
+    operation: string;
+    manifest: string;
+    inventory: string;
+    secrets: string;
+    bindSecret: string;
+    webTlsDir: string;
+    webCert: string;
+    webKey: string;
+    fleetYaml: string;
+};
+/** Resolve a bindPasswordRef the initializer wrote. Only the one private file scheme is accepted. */
+export declare function bindSecretPath(home: string, ref: string): string | undefined;
+/**
+ * The hub.* settings, written with enabled: false. `enabled: true` is a separate, last patch (hub.md §5: "commits
+ * hub.enabled last"). Paths are relative to the AgEnD home.
+ */
+export declare function hubConfigPatches(plan: HubInitPlan, identity: HubIdentitySummary): RawConfigPatch[];
+/** The copied browser certificate, as hub.webTls names it (relative to the AgEnD home). */
+export declare const WEB_TLS_CONFIG: {
+    readonly certificateFile: "hub/web-tls/cert.pem";
+    readonly keyFile: "hub/web-tls/key.pem";
+};
+export declare const ENABLE_PATCH: RawConfigPatch;

package/dist/hub/init/layout.js

@@ -0,0 +1,53 @@
+/**
+ * Where initialization puts things, and the fleet.yaml keys it writes. Everything Hub-private lives under
+ * <home>/hub (0700); key material under hub/keys is S1's (hub.md §4).
+ */
+import { join } from "node:path";
+export const HUB_DIR = "hub";
+export const BIND_SECRET_REL = "hub/secrets/directory-bind";
+export const BIND_PASSWORD_REF = `file:${BIND_SECRET_REL}`;
+export function hubPaths(home) {
+    const hub = join(home, HUB_DIR);
+    return {
+        hub,
+        keys: join(hub, "keys"),
+        initDir: join(hub, "init"),
+        operation: join(hub, "init", "operation.json"),
+        manifest: join(hub, "init-manifest.json"),
+        inventory: join(hub, "install-inventory.json"),
+        secrets: join(hub, "secrets"),
+        bindSecret: join(home, BIND_SECRET_REL),
+        webTlsDir: join(hub, "web-tls"),
+        webCert: join(hub, "web-tls", "cert.pem"),
+        webKey: join(hub, "web-tls", "key.pem"),
+        fleetYaml: join(home, "fleet.yaml"),
+    };
+}
+/** Resolve a bindPasswordRef the initializer wrote. Only the one private file scheme is accepted. */
+export function bindSecretPath(home, ref) {
+    return ref === BIND_PASSWORD_REF ? join(home, BIND_SECRET_REL) : undefined;
+}
+/**
+ * The hub.* settings, written with enabled: false. `enabled: true` is a separate, last patch (hub.md §5: "commits
+ * hub.enabled last"). Paths are relative to the AgEnD home.
+ */
+export function hubConfigPatches(plan, identity) {
+    return [
+        { path: ["hub", "enabled"], value: false },
+        { path: ["hub", "name"], value: plan.name },
+        { path: ["hub", "hubId"], value: identity.hubId },
+        { path: ["hub", "webOrigin"], value: plan.webOrigin },
+        { path: ["hub", "memberOrigin"], value: plan.memberOrigin },
+        { path: ["hub", "memberListen"], value: { host: plan.memberListen.host, port: plan.memberListen.port } },
+        { path: ["hub", "webListen"], value: { host: plan.webListen.host, port: plan.webListen.port } },
+        { path: ["hub", "webTls"], value: { ...WEB_TLS_CONFIG } },
+        { path: ["hub", "directory"], value: { ...plan.directory, bindPasswordRef: plan.bindPasswordRef } },
+        { path: ["hub", "administrator"], value: { realm: plan.administrator.realm, objectId: plan.administrator.objectId } },
+        { path: ["hub", "retention"], value: { contentDays: plan.retention.contentDays, eventDays: plan.retention.eventDays } },
+        { path: ["hub", "coexistence"], value: plan.coexistence },
+    ];
+}
+/** The copied browser certificate, as hub.webTls names it (relative to the AgEnD home). */
+export const WEB_TLS_CONFIG = { certificateFile: "hub/web-tls/cert.pem", keyFile: "hub/web-tls/key.pem" };
+export const ENABLE_PATCH = { path: ["hub", "enabled"], value: true };
+//# sourceMappingURL=layout.js.map

package/dist/hub/init/layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../../src/hub/init/layout.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,CAAC;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,eAAe,EAAE,CAAC;AAE3D,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO;QACL,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC;QAC9C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QAC7B,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC;QACzC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,OAAO,GAAG,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,QAA4B;IAC9E,OAAO;QACL,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;QAC1C,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;QAC3C,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;QACjD,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;QACrD,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;QAC3D,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;QACxG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QAC/F,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE;QACzD,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE;QACnG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE;QACrH,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE;QACvH,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,eAAe,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,EAAW,CAAC;AAEnH,MAAM,CAAC,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC"}

package/dist/hub/init/network.d.ts

@@ -0,0 +1,18 @@
+import type { HubInitPlan, HubListen } from "./types.js";
+export type HubInitListeners = Pick<HubInitPlan, "webListen" | "memberListen">;
+export type HubNetworkReason = "invalid" | "unresolved" | "interface" | "occupied" | "permission" | "reserved" | "unavailable";
+export interface HubNetworkProblem {
+    listener: "web" | "member";
+    reason: HubNetworkReason;
+}
+export type HubNetworkCheck = (listeners: HubInitListeners) => Promise<HubNetworkProblem[]>;
+export interface HubNetworkOptions {
+    /** The daemon's own loopback dashboard/preview listeners, even before it starts. */
+    reserved?: readonly HubListen[];
+    /** DNS seam: tests never resolve an external name. Numeric listener IPs do not use DNS. */
+    resolve?: (host: string) => Promise<string>;
+}
+/** Refresh config at each preflight; the Hub also starts the daemon's existing local dashboard/preview. */
+export declare function checkHubInitNetworkForHome(home: string, listeners: HubInitListeners): Promise<HubNetworkProblem[]>;
+/** Hold both sockets together to detect alias conflicts; close every successful bind before returning. */
+export declare function checkHubInitNetwork(listeners: HubInitListeners, options?: HubNetworkOptions): Promise<HubNetworkProblem[]>;