@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/hub/socket.d.ts

@@ -0,0 +1,24 @@
+/** A bounded, ownership-fenced WSS link. Socket acceptance is never durable delivery evidence. */
+import { WebSocket } from "ws";
+export type HubLinkCloseCode = "unavailable" | "invalid" | "backpressure" | "replaced" | "revoked";
+export declare class HubSocket<Incoming, Outgoing> {
+    readonly ws: WebSocket;
+    private readonly options;
+    private tail;
+    private queued;
+    private queuedBytes;
+    private alive;
+    private ended;
+    private heartbeat;
+    constructor(ws: WebSocket, options: {
+        current(): boolean;
+        parse(input: Buffer): Incoming;
+        encode(value: Outgoing): string;
+        receive(value: Incoming): Promise<void>;
+        closed(code: HubLinkCloseCode): void;
+    });
+    current(): boolean;
+    send(value: Outgoing): Promise<void>;
+    retire(reason: "replaced" | "revoked"): void;
+    end(code?: HubLinkCloseCode): void;
+}

package/dist/hub/socket.js

@@ -0,0 +1,79 @@
+/** A bounded, ownership-fenced WSS link. Socket acceptance is never durable delivery evidence. */
+import { WebSocket } from "ws";
+import { HUB_LIMITS } from "./protocol.js";
+import { HubProtocolError } from "./validation.js";
+export class HubSocket {
+    ws;
+    options;
+    tail = Promise.resolve();
+    queued = 0;
+    queuedBytes = 0;
+    alive = true;
+    ended = false;
+    heartbeat;
+    constructor(ws, options) {
+        this.ws = ws;
+        this.options = options;
+        ws.on("pong", () => { this.alive = true; });
+        ws.on("message", (data, binary) => {
+            if (binary) {
+                this.end("invalid");
+                return;
+            }
+            const buffer = Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
+            if (++this.queued > HUB_LIMITS.pending || (this.queuedBytes += buffer.length) > HUB_LIMITS.sendQueue) {
+                this.end("backpressure");
+                return;
+            }
+            this.tail = this.tail.then(async () => {
+                if (!this.current())
+                    return;
+                await options.receive(options.parse(buffer));
+            }).catch(error => { this.end(error instanceof HubProtocolError && error.code === "backpressure" ? "backpressure" : "invalid"); })
+                .finally(() => { this.queued--; this.queuedBytes -= buffer.length; });
+        });
+        ws.on("close", (code, reason) => this.end(code === 1008 && ["replaced", "revoked"].includes(reason.toString()) ? reason.toString() : "unavailable"));
+        ws.on("error", () => this.end("unavailable"));
+        this.heartbeat = setInterval(() => {
+            if (!this.current() || !this.alive) {
+                this.end("unavailable");
+                return;
+            }
+            this.alive = false;
+            ws.ping(undefined, undefined, (error) => { if (error)
+                this.end("unavailable"); });
+        }, HUB_LIMITS.heartbeat);
+        this.heartbeat.unref();
+    }
+    current() { return !this.ended && this.ws.readyState === WebSocket.OPEN && this.options.current(); }
+    async send(value) {
+        if (!this.current())
+            throw new HubProtocolError("unavailable");
+        const data = this.options.encode(value);
+        if (Buffer.byteLength(data) > HUB_LIMITS.frame || this.ws.bufferedAmount + Buffer.byteLength(data) > HUB_LIMITS.sendQueue)
+            throw new HubProtocolError("backpressure");
+        await new Promise((resolve, reject) => this.ws.send(data, error => error ? reject(new HubProtocolError("uncertain")) : resolve()));
+        if (!this.current())
+            throw new HubProtocolError("uncertain");
+    }
+    retire(reason) {
+        if (this.ended)
+            return;
+        this.ended = true;
+        clearInterval(this.heartbeat);
+        this.ws.close(1008, reason);
+        const timer = setTimeout(() => this.ws.terminate(), 2_000);
+        timer.unref();
+        this.ws.once("close", () => clearTimeout(timer));
+        this.options.closed(reason);
+    }
+    end(code = "unavailable") {
+        if (this.ended)
+            return;
+        this.ended = true;
+        clearInterval(this.heartbeat);
+        this.ws.terminate();
+        this.options.closed(code);
+    }
+}
+//# sourceMappingURL=socket.js.map

package/dist/hub/socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../src/hub/socket.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,SAAS,EAAgB,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,SAAS;IAOC,EAAE;IAA8B,OAAO;IANpD,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,CAAC,CAAC;IACX,WAAW,GAAG,CAAC,CAAC;IAChB,KAAK,GAAG,IAAI,CAAC;IACb,KAAK,GAAG,KAAK,CAAC;IACd,SAAS,CAAiB;IAClC,YAAqB,EAAa,EAAmB,OAGpD;kBAHoB,EAAE;uBAA8B,OAAO;QAI1D,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,MAAM,EAAE,EAAE;YACzC,IAAI,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5G,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3I,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACpC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;oBAAE,OAAO;gBAC5B,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC9H,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAA4B,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9N,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACxE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,KAAc,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7G,KAAK,CAAC,IAAI,CAAC,KAAe;QACxB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACtK,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,MAA8B;QACnC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5H,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,IAAI,GAAqB,aAAa;QACxC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3H,CAAC;CACF"}

package/dist/hub/store.d.ts

@@ -0,0 +1,77 @@
+/** S1's metadata repository. S5 supplies an already-private SQLite DB and audit writer. */
+import type Database from "better-sqlite3";
+import { z } from "zod";
+import type { HubAuditRecord } from "./types.js";
+declare const stateSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    revision: z.ZodNumber;
+    revocationVersion: z.ZodNumber;
+    nextLinkEpoch: z.ZodNumber;
+    pairings: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        owner: z.ZodObject<{
+            realm: z.ZodString;
+            objectId: z.ZodString;
+        }, z.core.$strict>;
+        codeHash: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNumber;
+        fleetId: z.ZodNullable<z.ZodString>;
+        claimHash: z.ZodNullable<z.ZodString>;
+        fingerprint: z.ZodNullable<z.ZodString>;
+        ownerConfirmed: z.ZodBoolean;
+        adminApproved: z.ZodBoolean;
+        state: z.ZodEnum<{
+            claimed: "claimed";
+            offered: "offered";
+            pending: "pending";
+            revoked: "revoked";
+        }>;
+    }, z.core.$strict>>;
+    fleets: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        owner: z.ZodObject<{
+            realm: z.ZodString;
+            objectId: z.ZodString;
+        }, z.core.$strict>;
+        credentialHash: z.ZodNullable<z.ZodString>;
+        generation: z.ZodNumber;
+        status: z.ZodEnum<{
+            active: "active";
+            revoked: "revoked";
+        }>;
+    }, z.core.$strict>>;
+    buckets: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        since: z.ZodNumber;
+        attempts: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type HubTransportState = z.infer<typeof stateSchema>;
+export interface HubVersionFloor {
+    /** Private durable companion, not part of a restorable older DB snapshot. Missing/corrupt existing state must throw. */
+    read(): number;
+    /** Raise durably BEFORE DB commit. A crash between these writes deliberately freezes the old DB. */
+    raise(revision: number): void;
+}
+export interface HubTransportStoreOptions {
+    floor: HubVersionFloor;
+    /** Must write into this exact DB transaction synchronously; missing/failed audit refuses the mutation. */
+    appendAudit(record: HubAuditRecord, database: Database.Database): void;
+}
+export declare function migrateHubTransportStore(db: Database.Database): void;
+export declare const HUB_TRANSPORT_MIGRATION: Readonly<{
+    component: "s1-transport";
+    version: 1;
+    up: typeof migrateHubTransportStore;
+}>;
+/** No file opening or migration on import/construction; initialization is explicit and belongs to S5. */
+export declare class HubTransportStore {
+    private readonly db;
+    private readonly options;
+    private failed;
+    constructor(db: Database.Database, options: HubTransportStoreOptions);
+    initialize(): void;
+    read(): HubTransportState;
+    mutate<T>(event: Omit<HubAuditRecord, "id" | "sequence" | "policyVersion">, change: (state: HubTransportState) => T): T;
+}
+export {};

package/dist/hub/store.js

@@ -0,0 +1,88 @@
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import { epoch, hash, person, uuid, validated, parseStrictJson, HubProtocolError } from "./validation.js";
+const pairing = z.strictObject({ id: uuid, owner: person, codeHash: hash.nullable(), expiresAt: epoch,
+    fleetId: uuid.nullable(), claimHash: hash.nullable(), fingerprint: hash.nullable(), ownerConfirmed: z.boolean(), adminApproved: z.boolean(),
+    state: z.enum(["offered", "pending", "claimed", "revoked"]) });
+const fleet = z.strictObject({ id: uuid, owner: person, credentialHash: hash.nullable(), generation: epoch,
+    status: z.enum(["active", "revoked"]) });
+const stateSchema = z.strictObject({ v: z.literal(1), revision: epoch, revocationVersion: epoch, nextLinkEpoch: epoch,
+    pairings: z.array(pairing).max(64), fleets: z.array(fleet).max(256),
+    buckets: z.array(z.strictObject({ key: hash, since: epoch, attempts: epoch })).max(1024) });
+export function migrateHubTransportStore(db) {
+    db.exec("CREATE TABLE IF NOT EXISTS hub_transport_state (singleton INTEGER PRIMARY KEY CHECK(singleton=1), state TEXT NOT NULL)");
+}
+export const HUB_TRANSPORT_MIGRATION = Object.freeze({ component: "s1-transport", version: 1, up: migrateHubTransportStore });
+/** No file opening or migration on import/construction; initialization is explicit and belongs to S5. */
+export class HubTransportStore {
+    db;
+    options;
+    failed = false;
+    constructor(db, options) {
+        this.db = db;
+        this.options = options;
+    }
+    initialize() {
+        if (this.db.prepare("SELECT 1 FROM hub_transport_state WHERE singleton=1").get())
+            throw new HubProtocolError("conflict");
+        if (this.options.floor.read() !== 0)
+            throw new HubProtocolError("uncertain");
+        const initial = { v: 1, revision: 0, revocationVersion: 0, nextLinkEpoch: 0, pairings: [], fleets: [], buckets: [] };
+        this.db.prepare("INSERT INTO hub_transport_state(singleton,state) VALUES(1,?)").run(JSON.stringify(initial));
+    }
+    read() {
+        if (this.failed)
+            throw new HubProtocolError("uncertain");
+        try {
+            const row = this.db.prepare("SELECT state FROM hub_transport_state WHERE singleton=1").get();
+            if (!row)
+                throw new HubProtocolError("uncertain");
+            const state = validated(stateSchema, parseStrictJson(row.state, 2 * 1024 * 1024)), floor = this.options.floor.read();
+            if (!Number.isSafeInteger(floor) || floor < 0 || floor !== state.revision
+                || new Set(state.pairings.map(x => x.id)).size !== state.pairings.length
+                || new Set(state.fleets.map(x => x.id)).size !== state.fleets.length)
+                throw new HubProtocolError("uncertain");
+            return state;
+        }
+        catch {
+            this.failed = true;
+            throw new HubProtocolError("uncertain");
+        }
+    }
+    mutate(event, change) {
+        let writing = false;
+        try {
+            return this.db.transaction(() => {
+                const state = this.read(), result = change(state);
+                if (result && typeof result.then === "function")
+                    throw new HubProtocolError();
+                state.revision++;
+                validated(stateSchema, state);
+                writing = true;
+                // The independent floor advances before either transactional write. An audit/DB failure must
+                // remain unconfirmed after restart, rather than silently restoring the prior authorization.
+                this.options.floor.raise(state.revision);
+                const audited = this.options.appendAudit({ ...event, id: randomUUID(), sequence: state.revision, policyVersion: state.revocationVersion }, this.db);
+                if (audited && typeof audited.then === "function") {
+                    void Promise.resolve(audited).catch(() => { });
+                    throw new HubProtocolError("uncertain");
+                }
+                this.db.prepare("UPDATE hub_transport_state SET state=? WHERE singleton=1").run(JSON.stringify(state));
+                return result;
+            }).immediate();
+        }
+        catch (error) {
+            // Validation/refusal may occur before any write. An advanced floor or failed writer freezes every future read.
+            if (writing)
+                this.failed = true;
+            try {
+                this.read();
+            }
+            catch {
+                this.failed = true;
+            }
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/hub/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/hub/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE1G,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK;IACnG,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3I,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;AACjE,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK;IACxG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3C,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK;IACnH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAa9F,MAAM,UAAU,wBAAwB,CAAC,EAAqB;IAC5D,EAAE,CAAC,IAAI,CAAC,wHAAwH,CAAC,CAAC;AACpI,CAAC;AACD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAC9H,yGAAyG;AACzG,MAAM,OAAO,iBAAiB;IAEC,EAAE;IAAsC,OAAO;IADpE,MAAM,GAAG,KAAK,CAAC;IACvB,YAA6B,EAAqB,EAAmB,OAAiC;kBAAzE,EAAE;uBAAsC,OAAO;IAA6B,CAAC;IAC1G,UAAU;QACR,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAsB,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAAmC,CAAC;YAC9H,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ;mBACpE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;mBACrE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAChH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAI,KAAgE,EAAE,MAAuC;QACjH,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClD,IAAI,MAAM,IAAI,OAAQ,MAA6B,CAAC,IAAI,KAAK,UAAU;oBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBACtG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC;gBACf,6FAA6F;gBAC7F,4FAA4F;gBAC5F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzC,MAAM,OAAO,GAAY,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC7J,IAAI,OAAO,IAAI,OAAQ,OAA8B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC1E,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzF,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvG,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+GAA+G;YAC/G,IAAI,OAAO;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC;YAClD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/hub/tls.d.ts

@@ -0,0 +1,31 @@
+import { X509Certificate } from "node:crypto";
+export interface HubProvisionedIdentity {
+    hubId: string;
+    spkiSha256: string;
+    issuerKeyId: string;
+    issuerPublicKey: string;
+}
+export declare function hubOrigin(input: string, protocol?: "https:" | "wss:"): string;
+export declare function verifyHubCertificate(pem: string | Buffer, origin: string, pin: string | undefined, now?: number): X509Certificate;
+/** Persisted certificate evidence may expire; only its key/address binding is retained as the trust anchor. */
+export declare function verifyHubCertificateBinding(pem: string | Buffer, origin: string, pin: string | undefined): X509Certificate;
+/** Fixed executable and argv; no caller-selected command, shell, trust-store edit or overwrite. */
+export declare function provisionHubIdentity(input: {
+    home: string;
+    memberOrigin: string;
+}): Promise<HubProvisionedIdentity>;
+/** Inspection may use the stored origin; all admission/mount callers pass their expected origin explicitly. */
+export declare function readHubIdentity(input: {
+    home: string;
+    memberOrigin?: string;
+}): HubProvisionedIdentity;
+/** Missing means wholly unprovisioned; a partial, untrusted or changed identity is an error, never a fresh start. */
+export declare function readHubIdentityIfPresent(home: string): HubProvisionedIdentity | undefined;
+/** SPKI is the trust anchor. Per-socket verification happens before HTTP can write any credential bytes. */
+export declare function pinnedHubAgent(binding: {
+    memberOrigin: string;
+    spkiSha256: string;
+}, current?: () => boolean): import("node:https").Agent;
+export declare class HubTlsIdentityError extends Error {
+    constructor();
+}

package/dist/hub/tls.js

@@ -0,0 +1,135 @@
+import { Agent as HttpsAgent } from "node:https";
+import { connect as tlsConnect } from "node:tls";
+import { generateKeyPairSync, randomUUID, X509Certificate, createPublicKey, createPrivateKey } from "node:crypto";
+import { execFile } from "../child-process.js";
+import { promisify } from "node:util";
+import { isIP } from "node:net";
+import { existsSync, mkdirSync, openSync, writeFileSync, closeSync, fsyncSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { ensurePrivateDirectory, privatePath, readPrivateFile } from "./private-files.js";
+import { hash, uuid, validated, parseStrictJson } from "./validation.js";
+import { issuerKeyId, sha256 } from "./identity.js";
+const identitySchema = z.strictObject({ v: z.literal(1), hubId: uuid, memberOrigin: z.string(), spkiSha256: hash, issuerKeyId: hash, issuerPublicKey: z.string().max(2048) });
+export function hubOrigin(input, protocol = "https:") {
+    const u = new URL(input);
+    if (u.protocol !== protocol || u.username || u.password || u.pathname !== "/" || u.search || u.hash || u.origin === "null" || u.hostname.endsWith("."))
+        throw Error("Invalid Hub origin");
+    return u.origin;
+}
+function host(origin) { return new URL(hubOrigin(origin)).hostname.replace(/^\[|\]$/g, ""); }
+function privateWrite(path, value) {
+    const fd = openSync(path, "wx", 0o600);
+    try {
+        writeFileSync(fd, value, "utf8");
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function verifyHubCertificate(pem, origin, pin, now = Date.now()) {
+    const cert = new X509Certificate(pem);
+    if (now < Date.parse(cert.validFrom) || now >= Date.parse(cert.validTo))
+        throw Error("Hub TLS identity differs");
+    return verifyHubCertificateBinding(pem, origin, pin);
+}
+/** Persisted certificate evidence may expire; only its key/address binding is retained as the trust anchor. */
+export function verifyHubCertificateBinding(pem, origin, pin) {
+    const cert = new X509Certificate(pem), name = host(origin), digest = sha256(cert.publicKey.export({ type: "spki", format: "der" }));
+    if (!(isIP(name) ? cert.checkIP(name) : cert.checkHost(name, { subject: "never", wildcards: false }))
+        || pin !== undefined && digest !== validated(hash, pin))
+        throw Error("Hub TLS identity differs");
+    return cert;
+}
+/** Fixed executable and argv; no caller-selected command, shell, trust-store edit or overwrite. */
+export async function provisionHubIdentity(input) {
+    const origin = hubOrigin(input.memberOrigin), name = host(origin);
+    ensurePrivateDirectory(input.home, "hub");
+    const keys = join(input.home, "hub/keys");
+    if (existsSync(keys))
+        throw Error("Hub identity already exists");
+    mkdirSync(keys, { mode: 0o700 });
+    privatePath(input.home, "hub/keys", true);
+    const tls = generateKeyPairSync("ec", { namedCurve: "prime256v1" }), issuer = generateKeyPairSync("ed25519");
+    privateWrite(join(keys, "tls-key.pem"), tls.privateKey.export({ type: "pkcs8", format: "pem" }).toString());
+    privateWrite(join(keys, "issuer-key.pem"), issuer.privateKey.export({ type: "pkcs8", format: "pem" }).toString());
+    const issuerPublicKey = issuer.publicKey.export({ type: "spki", format: "pem" }).toString();
+    privateWrite(join(keys, "issuer-public.pem"), issuerPublicKey);
+    // openssl writes only inside our new private directory; no key bytes are command-line arguments or logs.
+    const certFile = join(keys, "tls-cert.pem");
+    privateWrite(certFile, "");
+    await promisify(execFile)("/usr/bin/openssl", ["req", "-new", "-x509", "-sha256", "-days", "365", "-key", join(keys, "tls-key.pem"), "-out", certFile,
+        "-subj", "/CN=AgEnD Hub", "-addext", `subjectAltName=${isIP(name) ? "IP" : "DNS"}:${name}`], { timeout: 10_000, maxBuffer: 16 * 1024, env: { PATH: "/usr/bin:/bin", LANG: "C" } })
+        .catch(() => { throw Error("Hub certificate provisioning failed"); });
+    const cert = verifyHubCertificate(readPrivateFile(input.home, "hub/keys/tls-cert.pem"), origin, undefined);
+    const metadata = { v: 1, hubId: randomUUID(), memberOrigin: origin,
+        spkiSha256: sha256(cert.publicKey.export({ type: "spki", format: "der" })), issuerKeyId: issuerKeyId(issuer.publicKey), issuerPublicKey };
+    privateWrite(join(keys, "identity.json"), JSON.stringify(metadata));
+    return readHubIdentity({ home: input.home, memberOrigin: origin });
+}
+/** Inspection may use the stored origin; all admission/mount callers pass their expected origin explicitly. */
+export function readHubIdentity(input) {
+    const metadata = validated(identitySchema, parseStrictJson(readPrivateFile(input.home, "hub/keys/identity.json")));
+    const origin = hubOrigin(input.memberOrigin ?? metadata.memberOrigin);
+    const cert = verifyHubCertificate(readPrivateFile(input.home, "hub/keys/tls-cert.pem"), origin, metadata.spkiSha256);
+    const issuer = createPublicKey(readPrivateFile(input.home, "hub/keys/issuer-public.pem"));
+    const privateIssuer = createPrivateKey(readPrivateFile(input.home, "hub/keys/issuer-key.pem"));
+    const privateTls = createPrivateKey(readPrivateFile(input.home, "hub/keys/tls-key.pem"));
+    if (metadata.memberOrigin !== origin || issuer.asymmetricKeyType !== "ed25519" || privateIssuer.asymmetricKeyType !== "ed25519"
+        || issuer.export({ type: "spki", format: "pem" }).toString() !== metadata.issuerPublicKey || issuerKeyId(issuer) !== metadata.issuerKeyId
+        || issuerKeyId(privateIssuer) !== metadata.issuerKeyId || sha256(createPublicKey(privateTls).export({ type: "spki", format: "der" })) !== sha256(cert.publicKey.export({ type: "spki", format: "der" })))
+        throw Error("Hub identity files differ");
+    return { hubId: metadata.hubId, spkiSha256: metadata.spkiSha256, issuerKeyId: metadata.issuerKeyId, issuerPublicKey: metadata.issuerPublicKey };
+}
+/** Missing means wholly unprovisioned; a partial, untrusted or changed identity is an error, never a fresh start. */
+export function readHubIdentityIfPresent(home) {
+    try {
+        privatePath(home, "hub/keys", true);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    return readHubIdentity({ home });
+}
+/** SPKI is the trust anchor. Per-socket verification happens before HTTP can write any credential bytes. */
+export function pinnedHubAgent(binding, current = () => true) {
+    const origin = hubOrigin(binding.memberOrigin), hostname = host(origin), pin = validated(hash, binding.spkiSha256);
+    const agent = new HttpsAgent({ keepAlive: false });
+    agent.createConnection = (options, callback) => {
+        let finished = false;
+        const finish = (error, socket) => {
+            if (finished)
+                return;
+            finished = true;
+            if (error)
+                socket?.destroy();
+            else
+                socket?.setTimeout(0);
+            callback?.(error, socket);
+        };
+        // Deliberately no process/global TLS change: only this owned socket uses manual pinned-key authentication.
+        const socket = tlsConnect({ host: hostname, port: Number(new URL(origin).port || 443),
+            servername: isIP(hostname) ? undefined : hostname, rejectUnauthorized: false, minVersion: "TLSv1.2" }, () => {
+            try {
+                if (!current())
+                    throw Error();
+                verifyHubCertificate(socket.getPeerCertificate().raw, origin, pin);
+                finish(null, socket);
+            }
+            catch {
+                finish(new HubTlsIdentityError(), socket);
+            }
+        });
+        socket.setTimeout(5_000, () => { finish(Error("Hub TLS connection unavailable"), socket); });
+        socket.once("error", () => finish(Error("Hub TLS connection unavailable"), socket));
+        return undefined; // Agent receives the socket only through the verified callback.
+    };
+    return agent;
+}
+export class HubTlsIdentityError extends Error {
+    constructor() { super("Hub TLS identity differs"); }
+}
+//# sourceMappingURL=tls.js.map

package/dist/hub/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../src/hub/tls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9K,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,QAAQ,GAAsB,QAAQ;IAC7E,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1L,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AACD,SAAS,IAAI,CAAC,MAAc,IAAY,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7G,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC;QAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACrF,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,MAAc,EAAE,GAAuB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjH,OAAO,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,2BAA2B,CAAC,GAAoB,EAAE,MAAc,EAAE,GAAuB;IACvG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;WAChG,GAAG,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AACD,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAA6C;IACtF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjE,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7G,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5G,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClH,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5F,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/D,yGAAyG;IACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5C,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ;QACnJ,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACjL,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,MAAM;QACzE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5I,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAAC,KAA8C;IAC5E,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,IAAI,aAAa,CAAC,iBAAiB,KAAK,SAAS;WAC1H,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,QAAQ,CAAC,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,WAAW;WACtI,WAAW,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrP,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;AAClJ,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,IAAI,CAAC;QAAC,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACxG,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,cAAc,CAAC,OAAqD,EAAE,OAAO,GAAkB,GAAG,EAAE,CAAC,IAAI;IACvH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACnH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,MAAoC,EAAE,EAAE;YAC3E,IAAI,QAAQ;gBAAE,OAAO;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,IAAI,KAAK;gBAAE,MAAM,EAAE,OAAO,EAAE,CAAC;;gBAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7H,CAAC,CAAC;QACF,2GAA2G;QAC3G,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YACnF,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE;YAC5G,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE;oBAAE,MAAM,KAAK,EAAE,CAAC;gBAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAChI,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,OAAO,SAAoD,CAAC,CAAC,gEAAgE;IAC/H,CAAC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAAG,gBAAgB,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;CAAE"}