@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/hub/browser-certificate.js

@@ -0,0 +1,247 @@
+import { createHash, randomUUID, X509Certificate } from "node:crypto";
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, rmSync, writeFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { createSecureContext } from "node:tls";
+import { parseHubBrowserCertificateApply, parseHubBrowserCertificatePrepare } from "../hub-browser-certificate-policy.js";
+import { createBrowserCertificate } from "./init/browser-certificate.js";
+import { checkBrowserTls, pemCertificates } from "./init/browser-tls.js";
+import { ensurePrivateDirectory, privatePath, readPrivateFile } from "./private-files.js";
+const HUB_BROWSER_CERTIFICATE_MIGRATION = { component: "s5-browser-tls", version: 1, up(db) {
+        db.exec(`CREATE TABLE hub_browser_tls(singleton INTEGER PRIMARY KEY CHECK(singleton=1), hub_id TEXT NOT NULL,
+    revision INTEGER NOT NULL CHECK(revision>=1), material_id TEXT, material_digest TEXT);`);
+    } };
+const hash = (text) => createHash("sha256").update(text).digest("hex");
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export function createHubBrowserCertificateControl(options) {
+    const { db, home } = options, clock = options.monotonic ?? (() => performance.now());
+    let closed = false, active = null, activeDigest = null;
+    const candidates = new Map(), owned = new Set(), stages = new Set(), work = new Set();
+    const assert = (current = () => true) => { if (closed || !options.current() || !current())
+        throw Error("unavailable"); };
+    const materialInfo = (material) => {
+        const leaf = new X509Certificate(pemCertificates(material.cert)[0]);
+        return { fingerprint256: leaf.fingerprint256, validFrom: leaf.validFrom, validTo: leaf.validTo,
+            selfSigned: leaf.subject === leaf.issuer && leaf.verify(leaf.publicKey) };
+    };
+    const validate = (material) => {
+        if (!checkBrowserTls(material.cert, material.key, options.origin, options.now()).ok)
+            throw Error("invalid_browser_certificate");
+        try {
+            createSecureContext(material);
+        }
+        catch {
+            throw Error("invalid_browser_certificate");
+        } // Check the entire PEM chain, not just the first leaf.
+        return material;
+    };
+    const row = () => {
+        const r = db.prepare("SELECT * FROM hub_browser_tls WHERE singleton=1").get();
+        if (!r || r.hub_id !== options.hubId || !Number.isSafeInteger(r.revision) || r.revision < 1
+            || (r.material_id === null ? r.material_digest !== null : !uuid.test(r.material_id) || !/^[0-9a-f]{64}$/.test(r.material_digest ?? "")))
+            throw Error("browser_certificate_unavailable");
+        return r;
+    };
+    const load = (r) => {
+        const text = r.material_id === null ? JSON.stringify({ cert: readPrivateFile(home, options.initial.certificateFile), key: readPrivateFile(home, options.initial.keyFile) })
+            : readPrivateFile(home, `hub/web-tls/versions/${r.material_id}/material.json`, 128 * 1024);
+        const digest = hash(text);
+        if (r.material_digest !== null && digest !== r.material_digest)
+            throw Error("browser_certificate_unavailable");
+        const material = JSON.parse(text);
+        if (typeof material.cert !== "string" || typeof material.key !== "string")
+            throw Error("browser_certificate_unavailable");
+        // Permit an expired selected certificate to be displayed and renewed. A new selection must be currently valid.
+        createSecureContext(material);
+        materialInfo(material);
+        return { material, digest };
+    };
+    const snapshot = () => { assert(); const r = row(), m = load(r); return { ...m, row: r, revision: hash(JSON.stringify([r.revision, m.digest])) }; };
+    const read = () => {
+        const s = snapshot(), selected = materialInfo(s.material);
+        return { revision: s.revision, selected, activeFingerprint256: active, restartRequired: activeDigest !== s.digest };
+    };
+    const remove = (o) => {
+        const dir = join(home, o.suffix);
+        let stat;
+        try {
+            stat = lstatSync(dir);
+        }
+        catch (err) {
+            if (err.code === "ENOENT") {
+                owned.delete(o);
+                return;
+            }
+            throw err;
+        }
+        privatePath(home, o.suffix, true);
+        if (stat.ino !== o.ino || stat.dev !== o.dev || stat.uid !== o.uid || hash(readPrivateFile(home, `${o.suffix}/material.json`, 128 * 1024)) !== o.digest)
+            throw Error("browser_certificate_staging_changed");
+        rmSync(dir, { recursive: true });
+        owned.delete(o);
+    };
+    const prune = () => { for (const [id, c] of candidates)
+        if (clock() >= c.deadline) {
+            remove(c);
+            candidates.delete(id);
+        } };
+    const candidate = (input, binding) => {
+        assert();
+        const p = parseHubBrowserCertificateApply(input), c = candidates.get(p.reference);
+        if (!c || !binding || c.binding !== binding || clock() >= c.deadline || c.revision !== p.revision || snapshot().revision !== p.revision)
+            throw Error("conflict");
+        if (hash(readPrivateFile(home, `${c.suffix}/material.json`, 128 * 1024)) !== c.digest)
+            throw Error("conflict");
+        return c;
+    };
+    const preview = (input, binding) => {
+        const c = candidate(input, binding), material = JSON.parse(readPrivateFile(home, `${c.suffix}/material.json`, 128 * 1024));
+        validate(material);
+        return { reference: c.reference, revision: c.revision, certificate: materialInfo(material) };
+    };
+    snapshot(); // Existing initialized DB state must be present and intact; never silently reset it.
+    const control = {
+        read, preview,
+        prepare(input, binding, current) {
+            try {
+                assert(current);
+                prune();
+            }
+            catch (err) {
+                return Promise.reject(err);
+            }
+            if (work.size + candidates.size >= 8)
+                return Promise.reject(Error("browser_certificate_busy"));
+            // Own physical work BEFORE a generator callback can synchronously re-enter close().
+            const job = Promise.resolve().then(async () => {
+                assert(current);
+                prune();
+                const p = parseHubBrowserCertificatePrepare(input);
+                if (!binding || snapshot().revision !== p.revision)
+                    throw Error("conflict");
+                if (candidates.size >= 8)
+                    throw Error("browser_certificate_busy");
+                let generated;
+                let c;
+                try {
+                    let material;
+                    if (p.mode === "generate") {
+                        generated = await (options.generate ?? createBrowserCertificate)(home, options.origin);
+                        stages.add(generated);
+                        assert(current);
+                        material = { cert: readPrivateFile(home, relative(home, generated.certFile)), key: readPrivateFile(home, relative(home, generated.keyFile)) };
+                    }
+                    else
+                        material = { cert: readPrivateFile(home, p.certificateFile), key: readPrivateFile(home, p.keyFile) };
+                    validate(material);
+                    assert(current);
+                    if (snapshot().revision !== p.revision)
+                        throw Error("conflict");
+                    const reference = randomUUID(), suffix = `hub/web-tls/versions/${reference}`, text = JSON.stringify(material);
+                    if (Buffer.byteLength(text) > 128 * 1024)
+                        throw Error("invalid_browser_certificate");
+                    ensurePrivateDirectory(home, "hub/web-tls/versions");
+                    const dir = join(home, suffix);
+                    mkdirSync(dir, { mode: 0o700 });
+                    const stat = lstatSync(dir);
+                    c = { suffix, digest: hash(text), ino: stat.ino, dev: stat.dev, uid: stat.uid, reference, revision: p.revision, binding, deadline: clock() + 600_000 };
+                    // Material becomes durable before its DB pointer can be committed. An incomplete write is never selected.
+                    owned.add(c);
+                    const fd = openSync(join(dir, "material.json"), "wx", 0o600);
+                    try {
+                        writeFileSync(fd, text);
+                        fsyncSync(fd);
+                    }
+                    finally {
+                        closeSync(fd);
+                    }
+                    for (const path of [dir, join(home, "hub/web-tls/versions"), join(home, "hub/web-tls"), join(home, "hub"), home]) {
+                        const fd = openSync(path, "r");
+                        try {
+                            fsyncSync(fd);
+                        }
+                        finally {
+                            closeSync(fd);
+                        }
+                    }
+                    assert(current);
+                    if (generated) {
+                        generated.cleanup();
+                        stages.delete(generated);
+                        generated = undefined;
+                    }
+                    candidates.set(reference, c);
+                    return preview({ reference, revision: p.revision }, binding);
+                }
+                catch (err) {
+                    if (c && owned.has(c))
+                        remove(c);
+                    throw err;
+                }
+                finally {
+                    if (generated) {
+                        generated.cleanup();
+                        stages.delete(generated);
+                    }
+                }
+            });
+            work.add(job);
+            void job.then(() => work.delete(job), () => work.delete(job));
+            return job;
+        },
+        apply(input, binding, current) {
+            const c = candidate(input, binding);
+            const material = validate(JSON.parse(readPrivateFile(home, `${c.suffix}/material.json`, 128 * 1024)));
+            const info = materialInfo(material);
+            db.transaction(() => {
+                assert(current);
+                candidate(input, binding);
+                const before = row();
+                if (before.revision >= Number.MAX_SAFE_INTEGER)
+                    throw Error("conflict");
+                const result = options.audit.appendInTransaction({ id: randomUUID(), sequence: before.revision + 1, at: options.now(), requestId: randomUUID(),
+                    actor: { kind: "local-host" }, action: "browser-certificate.selected", result: "completed", policyVersion: before.revision + 1,
+                    reasonCode: info.fingerprint256 }, db);
+                if (result && typeof result.then === "function")
+                    throw Error("browser_certificate_audit_unavailable");
+                assert(current);
+                candidate(input, binding);
+                db.prepare("UPDATE hub_browser_tls SET revision=?, material_id=?, material_digest=? WHERE singleton=1").run(before.revision + 1, c.reference, c.digest);
+            }).immediate();
+            candidates.delete(c.reference);
+            owned.delete(c); // Selected versions survive shutdown and restart.
+            try {
+                options.activate(material);
+                active = info.fingerprint256;
+                activeDigest = c.digest;
+            }
+            catch { /* Selection is saved; read() truthfully reports restartRequired. */ }
+            return read();
+        },
+    };
+    return Object.assign(control, {
+        material: () => snapshot().material,
+        activate() { const s = snapshot(); options.activate(s.material); active = materialInfo(s.material).fingerprint256; activeDigest = s.digest; },
+        async close() {
+            closed = true;
+            await Promise.allSettled([...work]);
+            for (const stage of stages) {
+                stage.cleanup();
+                stages.delete(stage);
+            }
+            for (const o of owned) {
+                remove(o);
+                for (const [id, c] of candidates)
+                    if (c === o)
+                        candidates.delete(id);
+            }
+        },
+    });
+}
+/** Seed only when the migration itself runs, including an older initialized Hub's first upgrade. */
+export function browserCertificateMigration(hubId) {
+    return { ...HUB_BROWSER_CERTIFICATE_MIGRATION, up(db) {
+            HUB_BROWSER_CERTIFICATE_MIGRATION.up(db);
+            db.prepare("INSERT INTO hub_browser_tls VALUES(1, ?, 1, NULL, NULL)").run(hubId);
+        } };
+}
+//# sourceMappingURL=browser-certificate.js.map

package/dist/hub/browser-certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-certificate.js","sourceRoot":"","sources":["../../src/hub/browser-certificate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,+BAA+B,EAAE,iCAAiC,EAC2B,MAAM,sCAAsC,CAAC;AAGnJ,OAAO,EAAE,wBAAwB,EAA2B,MAAM,+BAA+B,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAS1F,MAAM,iCAAiC,GAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE;QACtG,EAAE,CAAC,IAAI,CAAC;2FACiF,CAAC,CAAC;IAC7F,CAAC,EAAE,CAAC;AACJ,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/E,MAAM,IAAI,GAAG,uEAAuE,CAAC;AAKrF,MAAM,UAAU,kCAAkC,CAAC,OAMlD;IACC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACrF,IAAI,MAAM,GAAG,KAAK,EAAE,MAAM,GAAkB,IAAI,EAAE,YAAY,GAAkB,IAAI,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,EAAE,KAAK,GAAG,IAAI,GAAG,EAAS,EAAE,MAAM,GAAG,IAAI,GAAG,EAAsB,EAAE,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtJ,MAAM,MAAM,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;QAAE,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,YAAY,GAAG,CAAC,QAAoC,EAA6B,EAAE;QACvF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACrE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YAC5F,UAAU,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,QAAoC,EAAE,EAAE;QACxD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChI,IAAI,CAAC;YAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAAC,CAAC,CAAC,uDAAuD;QACpJ,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,GAAQ,EAAE;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAAqB,CAAC;QACjG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;eACtF,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YACvI,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAM,EAA4D,EAAE;QAChF,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACzK,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,WAAW,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,CAAC,eAAe;YAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+B,CAAC;QAChE,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1H,+GAA+G;QAC/G,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpJ,MAAM,IAAI,GAAG,GAA8B,EAAE;QAC3C,MAAM,CAAC,GAAG,QAAQ,EAAE,EAAE,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IACtH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAQ,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAAC,MAAM,GAAG,CAAC;QAAC,CAAC;QAC5I,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;YACrJ,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU;QAAE,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,OAAe,EAAa,EAAE;QAC/D,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACjK,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,OAAe,EAAiC,EAAE;QACjF,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3H,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnB,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/F,CAAC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,qFAAqF;IACjG,MAAM,OAAO,GAAiC;QAC5C,IAAI,EAAE,OAAO;QACb,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO;YAC7B,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAAC,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAC/F,oFAAoF;YACpF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5C,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC5E,IAAI,UAAU,CAAC,IAAI,IAAI,CAAC;oBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAClE,IAAI,SAAyC,CAAC;gBAC9C,IAAI,CAAwB,CAAC;gBAC7B,IAAI,CAAC;oBACH,IAAI,QAAoC,CAAC;oBACzC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC1B,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;wBACvF,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;wBACtB,MAAM,CAAC,OAAO,CAAC,CAAC;wBAChB,QAAQ,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAChJ,CAAC;;wBAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5G,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACpC,IAAI,QAAQ,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;wBAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;oBAChE,MAAM,SAAS,GAAG,UAAU,EAAE,EAAE,MAAM,GAAG,wBAAwB,SAAS,EAAE,EAAE,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;oBAC9G,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI;wBAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBACrF,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;oBACvJ,0GAA0G;oBAC1G,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACb,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC7D,IAAI,CAAC;wBAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;wBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;4BAAS,CAAC;wBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;oBAC1E,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;wBACjH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;wBAAC,IAAI,CAAC;4BAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAAC,CAAC;gCAAS,CAAC;4BAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAAC,CAAC;oBACnF,CAAC;oBACD,MAAM,CAAC,OAAO,CAAC,CAAC;oBAChB,IAAI,SAAS,EAAE,CAAC;wBAAC,SAAS,CAAC,OAAO,EAAE,CAAC;wBAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAAC,SAAS,GAAG,SAAS,CAAC;oBAAC,CAAC;oBACxF,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;oBAC7B,OAAO,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,MAAM,CAAC,CAAC,CAAC,CAAC;oBACjC,MAAM,GAAG,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBAAC,IAAI,SAAS,EAAE,CAAC;wBAAC,SAAS,CAAC,OAAO,EAAE,CAAC;wBAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;gBAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7E,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO;YAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtG,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACpC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAClB,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;gBAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB;oBAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC9F,MAAM,MAAM,GAAY,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;oBACrJ,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC;oBAC9H,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,OAAQ,MAA6B,CAAC,IAAI,KAAK,UAAU;oBAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC9H,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC3C,EAAE,CAAC,OAAO,CAAC,2FAA2F,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1J,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACf,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,kDAAkD;YACnG,IAAI,CAAC;gBAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;gBAAC,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;YACzK,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;QACnC,QAAQ,KAAK,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7I,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACtE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU;oBAAE,IAAI,CAAC,KAAK,CAAC;wBAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QAC7G,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,OAAO,EAAE,GAAG,iCAAiC,EAAE,EAAE,CAAC,EAAE;YAClD,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzC,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnF,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/hub/buttons-model.d.ts

@@ -0,0 +1,9 @@
+import { type ReplyButton } from "../reply-buttons.js";
+import { type PollConfig } from "../reply-polls.js";
+import type { HubAnswerButtons } from "./types.js";
+/** The wire uses normalized reply models. Reject noncanonical fields rather than silently changing signed bytes. */
+export declare function validHubAnswerButtons(b: HubAnswerButtons): boolean;
+/** Covers every choice, its order, the exact set and all poll settings. Absent values remain distinct from present. */
+export declare function buttonsDigest(b: HubAnswerButtons | undefined): string | undefined;
+/** Snapshot before any lease/network await; caller mutation cannot alter the answer after it is authorized. */
+export declare function prepareHubAnswerButtons(buttons: readonly ReplyButton[] | undefined, poll?: PollConfig): HubAnswerButtons | undefined;

package/dist/hub/buttons-model.js

@@ -0,0 +1,42 @@
+/** Pure, bounded buttons-v1 data. No timers, stores, connections or identity/authority on import. */
+import { createHash, randomBytes } from "node:crypto";
+import { parseReplyButtons } from "../reply-buttons.js";
+import { parsePoll } from "../reply-polls.js";
+import { HubProtocolError, scalarString } from "./validation.js";
+/** The wire uses normalized reply models. Reject noncanonical fields rather than silently changing signed bytes. */
+export function validHubAnswerButtons(b) {
+    if (!/^[a-f0-9]{32}$/.test(b.id) || !Array.isArray(b.labels) || b.labels.length === 0
+        || b.values !== undefined && (!Array.isArray(b.values) || b.values.length !== b.labels.length))
+        return false;
+    if (b.labels.some(v => typeof v !== "string" || !scalarString(v)) || b.values?.some(v => typeof v !== "string" || !scalarString(v)))
+        return false;
+    const raw = b.labels.map((label, i) => ({ label, ...(b.values ? { value: b.values[i] } : {}) }));
+    const parsed = parseReplyButtons(raw, { text: "buttons-v1" });
+    if (!parsed || "error" in parsed || parsed.buttons.some((v, i) => v.label !== b.labels[i] || v.value !== (b.values?.[i] ?? b.labels[i])))
+        return false;
+    if (!b.poll)
+        return true;
+    if (typeof b.poll.question !== "string" || !scalarString(b.poll.question))
+        return false;
+    const p = parsePoll({ seconds: b.poll.seconds, multi: b.poll.multi, reveal: b.poll.reveal, show_voters: b.poll.showVoters }, parsed.buttons, b.poll.question);
+    return !!p && "poll" in p && p.poll.question === b.poll.question;
+}
+/** Covers every choice, its order, the exact set and all poll settings. Absent values remain distinct from present. */
+export function buttonsDigest(b) {
+    if (!b)
+        return undefined;
+    const p = b.poll;
+    return createHash("sha256").update(JSON.stringify(["agend-hub-answer-buttons-v1", b.id, b.labels, b.values ?? null,
+        p ? [p.seconds, p.multi, p.reveal, p.showVoters, p.question] : null])).digest("hex");
+}
+/** Snapshot before any lease/network await; caller mutation cannot alter the answer after it is authorized. */
+export function prepareHubAnswerButtons(buttons, poll) {
+    if (!buttons?.length)
+        return undefined;
+    const b = { id: randomBytes(16).toString("hex"), labels: Object.freeze(buttons.map(v => v.label)),
+        values: Object.freeze(buttons.map(v => v.value)), ...(poll ? { poll: Object.freeze({ ...poll }) } : {}) };
+    if (!validHubAnswerButtons(b))
+        throw new HubProtocolError("invalid");
+    return Object.freeze(b);
+}
+//# sourceMappingURL=buttons-model.js.map

package/dist/hub/buttons-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buttons-model.js","sourceRoot":"","sources":["../../src/hub/buttons-model.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAmB,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEjE,oHAAoH;AACpH,MAAM,UAAU,qBAAqB,CAAC,CAAmB;IACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;WAChF,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/G,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClJ,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvJ,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9J,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,aAAa,CAAC,CAA+B;IAC3D,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QAChH,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,uBAAuB,CAAC,OAA2C,EAAE,IAAiB;IACpG,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,CAAC,GAAqB,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5G,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/hub/buttons.d.ts

@@ -0,0 +1,54 @@
+/** buttons-v1: durable per-answer choices. A button is data, never a human approval or a fleet-admin capability. */
+import type Database from "better-sqlite3";
+import type { ReplyButtonsView } from "../reply-buttons-controller.js";
+import type { HubAnswer, HubAuditRecord, HubReceipt, HubRequestContext, HubTx, PersonKey } from "./types.js";
+import { type MessageRow } from "./policy.js";
+import { type HubCore } from "./http/core.js";
+export { buttonsDigest } from "./buttons-model.js";
+export declare const HUB_BUTTONS_MIGRATION: Readonly<{
+    component: "s8-buttons";
+    version: 1;
+    up(db: Database.Database): void;
+}>;
+export interface HubButtonQuestion {
+    roomId: string;
+    asker: PersonKey;
+    idempotencyKey: string;
+    text: string;
+    requestId: string;
+    actor: HubAuditRecord["actor"];
+}
+export interface HubButtonsQueue {
+    /** The SAME synchronous insertion/audit/caps path as rooms.ask, inside the supplied transaction. */
+    insert(db: Database.Database, tx: HubTx, input: HubButtonQuestion): HubReceipt;
+    flush(fleetId: string): void;
+}
+export declare class HubButtonsService {
+    private readonly core;
+    private readonly queue;
+    private timer;
+    private stopped;
+    private draining;
+    private deadlineBackoffUntil;
+    private resultsBackoffUntil;
+    constructor(core: HubCore, queue: HubButtonsQueue);
+    private row;
+    private check;
+    /** Called with the accepted answer's own transaction. Metadata has already been bound by its exact release lease. */
+    record(db: Database.Database, tx: HubTx, msg: MessageRow, answer: HubAnswer, now: number): void;
+    private source;
+    /** A published answer's continuation has its own bounded lifetime; current source identities/revisions never change. */
+    private authorized;
+    private ballot;
+    private audit;
+    view(db: Database.Database, messageId: string): ReplyButtonsView | undefined;
+    click(ctx: HubRequestContext, roomId: string, input: Record<string, unknown>): Promise<HubReceipt>;
+    private closeRow;
+    private queueResults;
+    /** Synchronous closure/arming is independent of LDAP, delivery and every previous poll's pending result. */
+    sweep(): Promise<void>;
+    private drainResults;
+    arm(): void;
+    start(): void;
+    close(): Promise<void>;
+}