@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/hub/member/pairing-api.js

@@ -0,0 +1,385 @@
+/**
+ * S3c PR B (S-55): the member's "Connect to a Hub" backend — thin, local-admin wrappers over S1's pairing client
+ * (pairing-client.ts beginHubPairing / claimHubPairing, profile.ts HubMemberProfileStore), as Sentinel specified:
+ * - The projection says only what is known: paired (from the profile: the Hub key's spkiSha256, its origins; no stored
+ *   name; the link from S5's client lifecycle, else offline), pending (the transcript fingerprint and expiry; the Hub
+ *   owner's and administrator's confirmations are the Hub's and unknown here: null), held (a local fact), unpaired.
+ *   Never key_changed or revoked inferred from an I/O failure; missing or malformed private state holds, never reads as
+ *   unpaired.
+ * - The local owner's own fingerprint check is a separate private receipt (localConfirmed), never ownerConfirmed. Its
+ *   continuation claims, and claims again only after an exact "pending", within the same generation, fingerprint,
+ *   profile digest and expiry — bounded and sequential. Any unknown claim outcome stops and holds (no retry).
+ * - cancel invalidates the in-flight generation first, then clears the local pending (no Hub cancellation).
+ * - disconnect fences the client, saves a local tombstone (the profile is kept: S1 has no revoke; S5 refuses to
+ *   reconnect from a disconnected binding), withdraws every exposure, and answers remote "pending" until the Hub's
+ *   administrator revokes the fleet there.
+ * State: hub-member/state.json (0600, atomic): { hubId, localConfirmed?, held?, disconnected? }.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteFileSync } from "../../atomic-write.js";
+import { ensurePrivateDirectory, privatePath, readPrivateFile } from "../private-files.js";
+import { beginHubPairing as realBegin, claimHubPairing as realClaim } from "../pairing-client.js";
+import { HubMemberProfileStore } from "../profile.js";
+import { httpsOrigin } from "../../hub-pairing-summary.js";
+export { httpsOrigin, pairingSummary } from "../../hub-pairing-summary.js";
+const STATE = "hub-member/state.json";
+const HUB_ID = /^[0-9a-f-]{36}$/;
+/** The code's shape S1 accepts (pairing-client.ts): checked here only to say "code" rather than "refused". */
+const CODE = /^[a-f0-9]{12}$/;
+export function createHubMemberPairingApi(deps) {
+    const now = () => (deps.now ?? Date.now)();
+    const begin = deps.begin ?? realBegin, claim = deps.claim ?? realClaim;
+    const profiles = deps.profiles ?? ((home, hubId) => new HubMemberProfileStore(home, hubId));
+    let generation = 0;
+    // #3115 r1 P4: an unknown claim outcome is held in memory too — a failed save of the hold must not reopen a retry.
+    let unknown = null;
+    const read = () => {
+        if (!existsSync(join(deps.home, STATE)))
+            return {};
+        const s = JSON.parse(readPrivateFile(deps.home, STATE)); // malformed: throws (held "unsaved")
+        if (!s || typeof s !== "object" || (s.hubId !== undefined && !HUB_ID.test(s.hubId)))
+            throw new Error("state");
+        return s;
+    };
+    const write = (s) => {
+        const dir = ensurePrivateDirectory(deps.home, "hub-member");
+        if (existsSync(join(deps.home, STATE)))
+            privatePath(deps.home, STATE); // an existing one: owned, private, no symlink
+        atomicWriteFileSync(join(dir, "state.json"), `${JSON.stringify(s)}\n`, { mode: 0o600 });
+    };
+    /** #3115 r2: the exact pairing a disconnect is confirmed for — its hub and saved profile (a re-pair is another). */
+    const bindingIdOf = (hubId, store) => {
+        const d = store.profileDigest();
+        return d ? createHash("sha256").update(JSON.stringify(["agend-hub-binding-v1", hubId, d])).digest("hex") : null;
+    };
+    const boundHub = () => {
+        try {
+            const h = read().hubId;
+            return h ? { hubId: h, binding: bindingIdOf(h, profiles(deps.home, h)) } : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const changed = () => { try {
+        deps.bindingChanged?.();
+    }
+    catch { /* S5's own failure */ } };
+    const files = (hubId) => ({ pairing: existsSync(join(deps.home, "hub-member", hubId, "pairing.json")), pending: existsSync(join(deps.home, "hub-member", hubId, "pending.json")) });
+    function view() {
+        let s;
+        try {
+            s = read();
+        }
+        catch {
+            return { state: "held", hold: "unsaved" };
+        }
+        if (!s.hubId) {
+            // No state yet: a member home with Hub files but no state is not "unpaired" (held), an empty one is.
+            let dirs = [];
+            try {
+                dirs = existsSync(join(deps.home, "hub-member")) ? readdirSync(join(deps.home, "hub-member")).filter((d) => HUB_ID.test(d) && !(s.retired ?? []).some((r) => r.hubId === d) && (files(d).pairing || files(d).pending)) : [];
+            }
+            catch {
+                return { state: "held", hold: "unsaved" };
+            }
+            return dirs.length ? { state: "held", hold: "unsaved" } : { state: "unpaired" };
+        }
+        const store = profiles(deps.home, s.hubId), f0 = files(s.hubId);
+        // A retired binding's own profile (unchanged since it was retired) is not this pairing's: as if absent.
+        let retiredProfile = false;
+        try {
+            const r = (s.retired ?? []).find((x) => x.hubId === s.hubId);
+            retiredProfile = !!r && f0.pairing && store.profileDigest() === r.profile;
+        }
+        catch {
+            return { state: "held", hold: "unsaved" };
+        }
+        const f = { pairing: f0.pairing && !retiredProfile, pending: f0.pending };
+        let origin;
+        const memHold = unknown && unknown.hubId === s.hubId ? "unknown_outcome" : null;
+        try {
+            if (f.pairing) {
+                const p = store.readProfile();
+                origin = p.hub.memberOrigin;
+                const binding = bindingIdOf(s.hubId, store) ?? undefined;
+                if (s.disconnected)
+                    return { state: "held", hold: "disconnected", memberOrigin: origin, hubId: s.hubId, binding };
+                // #3115 r2: a saved profile whose claim never finished settling (the local receipt or the pending claim still
+                // there) is not a pairing yet — for every reader, after a restart too: held, never paired.
+                const unfinished = !!s.localConfirmed || f.pending ? "unknown_outcome" : null;
+                const held = memHold ?? s.held ?? unfinished ?? deps.hold?.() ?? null;
+                if (held)
+                    return { state: "held", hold: held, memberOrigin: origin, hubId: s.hubId, binding };
+                return { state: "paired", binding, hub: { hubId: p.hub.hubId, name: null, memberOrigin: p.hub.memberOrigin, webOrigin: p.hub.webOrigin, fingerprint: { kind: "hub-key", digest: p.hub.spkiSha256 } },
+                    link: deps.link?.() === "online" ? "online" : "offline" };
+            }
+            if (f.pending) {
+                const p = store.readPending();
+                origin = p.hub.memberOrigin;
+                const held = memHold ?? s.held ?? deps.hold?.() ?? (p.expiresAt <= now() ? "expired" : null);
+                if (held)
+                    return { state: "held", hold: held, memberOrigin: origin, hubId: s.hubId };
+                return { state: "pending", memberOrigin: origin, fingerprint: { kind: "pairing", digest: p.fingerprint }, expiresAt: p.expiresAt, ownerConfirmed: null, adminApproved: null,
+                    localConfirmed: s.localConfirmed?.digest === p.fingerprint };
+            }
+        }
+        catch {
+            return { state: "held", hold: "unsaved", ...(origin ? { memberOrigin: origin } : {}) };
+        }
+        if (memHold ?? s.held)
+            return { state: "held", hold: (memHold ?? s.held) };
+        return { state: "unpaired" };
+    }
+    /** The local owner's claim loop: one generation, exact "pending" only, bounded and sequential; anything else holds. */
+    async function poll(gen, hubId, digest) {
+        const store = profiles(deps.home, hubId), expected = store.profileDigest();
+        // #3115 r1 P1: the loop outlives the Settings request that started it. Its authority is the owner's saved local
+        // receipt for exactly this fingerprint (revocable: cancel, disconnect, a hold or hub_member off end it), never
+        // that request's execution, which closes when the change is applied.
+        const consent = () => { try {
+            const st = read();
+            return st.hubId === hubId && st.localConfirmed?.digest === digest && !st.disconnected && !st.held;
+        }
+        catch {
+            return false;
+        } };
+        const live = () => gen === generation && !unknown && (deps.enabled?.() ?? true) && consent();
+        for (let i = 0; i < (deps.maxPolls ?? 120); i++) {
+            if (!live())
+                return;
+            let r;
+            try {
+                r = await claim({ home: deps.home, hubId, approvedFingerprint: digest, expectedProfileDigest: expected, current: live });
+            }
+            catch {
+                if (gen === generation) {
+                    unknown = { hubId };
+                    try {
+                        write({ ...read(), held: "unknown_outcome" });
+                    }
+                    catch { /* the memory hold stands */ }
+                }
+                return;
+            }
+            if (r.status === "paired") {
+                // #3115 r2: settling the claim is part of the claim — a failure here leaves the receipt (unfinished: held) and
+                // holds in memory too; never an unhandled rejection.
+                if (gen === generation) {
+                    try {
+                        const s = read();
+                        delete s.localConfirmed;
+                        write(s);
+                    }
+                    catch {
+                        unknown = { hubId };
+                        try {
+                            write({ ...read(), held: "unknown_outcome" });
+                        }
+                        catch { /* the receipt and the memory hold stand */ }
+                    }
+                }
+                changed();
+                return;
+            }
+            if (r.status !== "pending")
+                return;
+            let pending;
+            try {
+                pending = store.readPending();
+            }
+            catch {
+                return;
+            }
+            if (pending.fingerprint !== digest || pending.expiresAt <= now() || store.profileDigest() !== expected)
+                return;
+            await (deps.sleep ?? ((ms) => new Promise((ok) => setTimeout(ok, ms))))(deps.pollMs ?? 5000);
+        }
+    }
+    return {
+        view,
+        /** Start pairing (a confirmed Settings replay's continuation): S1 persists the pending claim at once. */
+        async connect(input, current) {
+            const origin = typeof input.address === "string" ? httpsOrigin(input.address) : null;
+            if (!origin)
+                return { ok: false, error: "address" };
+            const code = typeof input.code === "string" ? input.code.trim().toLowerCase().replace(/[\s-]/g, "") : "";
+            if (!CODE.test(code))
+                return { ok: false, error: "code" };
+            const v = view();
+            if (v.state !== "unpaired")
+                return { ok: false, error: "busy" };
+            const gen = ++generation;
+            try {
+                const p = await begin({ home: deps.home, memberOrigin: origin, code, current: () => gen === generation && current() });
+                const prior = read();
+                write({ hubId: p.hub.hubId, ...(prior.retired ? { retired: prior.retired } : {}) });
+                return { ok: true, pairing: view() };
+            }
+            catch (err) {
+                const code2 = err.code;
+                return { ok: false, error: code2 === "conflict" ? "busy" : code2 === "unavailable" ? "unreachable" : "refused" };
+            }
+        },
+        /** The local owner compared the fingerprint (confirmed in Settings): save the receipt, then claim (see poll). */
+        async confirmFingerprint(digest, current) {
+            const v = view();
+            if (v.state === "held" && v.hold === "expired")
+                return { ok: false, error: "expired" };
+            if (v.state !== "pending" || typeof digest !== "string" || digest !== v.fingerprint.digest)
+                return { ok: false, error: "conflict" };
+            if (!current())
+                return { ok: false, error: "conflict" };
+            const s = read();
+            try {
+                write({ ...s, localConfirmed: { digest, at: now() } });
+            }
+            catch {
+                return { ok: false, error: "unsaved" };
+            }
+            const gen = ++generation;
+            void poll(gen, s.hubId, digest);
+            return { ok: true, pairing: view() };
+        },
+        /** Withdraw the local pending request (or clear an expired/refused hold): the in-flight generation first. */
+        cancel() {
+            generation++;
+            let s;
+            try {
+                s = read();
+            }
+            catch {
+                return view();
+            }
+            // Start over after a disconnect: back to unpaired; the old binding stays retired (never reconnected automatically).
+            if (s.disconnected && s.hubId) {
+                let digest = null;
+                try {
+                    digest = profiles(deps.home, s.hubId).profileDigest();
+                }
+                catch {
+                    return view();
+                }
+                write({ retired: [...(s.retired ?? []).filter((r) => r.hubId !== s.hubId), { hubId: s.hubId, profile: digest }] });
+                changed();
+                return view();
+            }
+            // #3115 r1 P4: after an unknown claim outcome, abandon the binding without retrying it: the pending claim goes, and
+            // the hub is retired with whatever profile it has now (a credential saved meanwhile never connects automatically).
+            const unfinished = !!s.hubId && files(s.hubId).pairing && (!!s.localConfirmed || files(s.hubId).pending);
+            if (s.hubId && (s.held === "unknown_outcome" || (unknown && unknown.hubId === s.hubId) || unfinished)) {
+                const hubId = s.hubId;
+                try {
+                    const store = profiles(deps.home, hubId);
+                    if (files(hubId).pending)
+                        store.clearPending();
+                    write({ retired: [...(s.retired ?? []).filter((r) => r.hubId !== hubId), { hubId, profile: store.profileDigest() }] });
+                }
+                catch {
+                    return view();
+                }
+                unknown = null;
+                changed();
+                return view();
+            }
+            if (s.hubId && files(s.hubId).pending) {
+                try {
+                    profiles(deps.home, s.hubId).clearPending();
+                }
+                catch {
+                    return view();
+                }
+            }
+            delete s.localConfirmed;
+            if (s.held === "expired" || s.held === "refused")
+                delete s.held;
+            if (s.hubId && !files(s.hubId).pairing && !s.held) {
+                write(s.retired ? { retired: s.retired } : {});
+                changed();
+                return view();
+            }
+            write(s);
+            changed();
+            return view();
+        },
+        /** Leave the Hub (a confirmed Settings replay): fence, tombstone, withdraw every exposure; the Hub revokes later. */
+        async disconnect(expected = {}) {
+            // #3115 r1 P2 / r2: only the exact pairing the owner confirmed — its hub AND its saved profile (bindingId); a
+            // replacement Hub, or a re-pair of the same Hub since, is another pairing.
+            const b = boundHub();
+            if (!b || expected.hubId !== b.hubId || !b.binding || expected.binding !== b.binding)
+                return { ok: false, error: "conflict" };
+            const v = view();
+            if (v.state !== "paired" && !(v.state === "held" && v.hold !== "disconnected" && v.memberOrigin))
+                return { ok: false, error: "conflict" };
+            generation++;
+            try {
+                deps.fence?.();
+            }
+            catch { /* fenced on the tombstone below either way */ }
+            try {
+                write({ ...read(), disconnected: { at: now() } });
+            }
+            catch {
+                return { ok: false, error: "unsaved" };
+            }
+            changed();
+            try {
+                await deps.withdrawAll?.();
+            }
+            catch {
+                return { ok: false, error: "unsaved" };
+            }
+            return { ok: true, remote: "pending" };
+        },
+        /**
+         * Whether S5 must refuse to connect with `hubId`'s profile (#3115 r1 P5: fails closed). It may connect only while
+         * the state names exactly this hub, unheld and not disconnected, and its profile is not a retired one; anything
+         * else — no state, another hub, unreadable state — refuses.
+         */
+        disconnected(hubId) {
+            try {
+                const s = read();
+                if (s.hubId !== hubId || s.disconnected || s.held || s.localConfirmed || files(hubId).pending || (unknown && unknown.hubId === hubId))
+                    return true;
+                const r = (s.retired ?? []).find((x) => x.hubId === hubId);
+                return !!r && profiles(deps.home, hubId).profileDigest() === r.profile;
+            }
+            catch {
+                return true;
+            }
+        },
+        /** The current binding (for a disconnect's confirmation): its hub and bindingId (null: no profile), or null. */
+        boundHub,
+    };
+}
+/**
+ * S5's member factory reads this (dev-claude): the hub a member service may be built for — the state names it, its
+ * profile exists and reads, and it is neither disconnected, held, nor a retired profile; else null. The same checks as
+ * the pairing API's view() and disconnected(); a fresh read of the files (no memory of this process).
+ */
+export function currentBinding(home, profiles = (h, id) => new HubMemberProfileStore(h, id)) {
+    try {
+        if (!existsSync(join(home, STATE)))
+            return null;
+        const st = JSON.parse(readPrivateFile(home, STATE));
+        if (!st || typeof st !== "object" || typeof st.hubId !== "string" || !HUB_ID.test(st.hubId) || st.disconnected || st.held || st.localConfirmed)
+            return null;
+        if (existsSync(join(home, "hub-member", st.hubId, "pending.json")))
+            return null; // a claim not settled yet
+        if (!existsSync(join(home, "hub-member", st.hubId, "pairing.json")))
+            return null;
+        const store = profiles(home, st.hubId);
+        store.readProfile();
+        const r = (st.retired ?? []).find((x) => x.hubId === st.hubId);
+        if (r && store.profileDigest() === r.profile)
+            return null;
+        return { hubId: st.hubId };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=pairing-api.js.map

package/dist/hub/member/pairing-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-api.js","sourceRoot":"","sources":["../../../src/hub/member/pairing-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,eAAe,IAAI,SAAS,EAAE,eAAe,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,WAAW,EAAkE,MAAM,8BAA8B,CAAC;AAC3H,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAO3E,MAAM,KAAK,GAAG,uBAAuB,CAAC;AACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,8GAA8G;AAC9G,MAAM,IAAI,GAAG,gBAAgB,CAAC;AA2B9B,MAAM,UAAU,yBAAyB,CAAC,IAA0B;IAClE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5G,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,mHAAmH;IACnH,IAAI,OAAO,GAA6B,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAgB,EAAE;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAgB,CAAC,CAAM,qCAAqC;QAClH,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9G,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,CAAc,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAU,8CAA8C;QAC9H,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC;IACF,oHAAoH;IACpH,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAyC,EAAE,EAAE;QAC/E,MAAM,CAAC,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClH,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAqD,EAAE;QACtE,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IACzI,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC;IAE5L,SAAS,IAAI;QACX,IAAI,CAAc,CAAC;QACnB,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,CAAC;QACxE,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,qGAAqG;YACrG,IAAI,IAAI,GAAa,EAAE,CAAC;YACxB,IAAI,CAAC;gBAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAAC,CAAC;YACzR,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,wGAAwG;QACxG,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,CAAC;QACrM,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1E,IAAI,MAA0B,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;QACzF,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9B,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC;gBACzD,IAAI,CAAC,CAAC,YAAY;oBAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;gBAClH,8GAA8G;gBAC9G,2FAA2F;gBAC3F,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvF,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;gBACtE,IAAI,IAAI;oBAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;gBAC9F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE;oBAClM,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9B,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC5B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7F,IAAI,IAAI;oBAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBACrF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;oBACzK,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,MAAM,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAAC,CAAC;QACnG,IAAI,OAAO,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAE,EAAE,CAAC;QAC5E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uHAAuH;IACvH,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,MAAc;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3E,gHAAgH;QAChH,+GAA+G;QAC/G,qEAAqE;QACrE,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAChL,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO;YACpB,IAAI,CAAmC,CAAC;YACxC,IAAI,CAAC;gBAAC,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YACjI,MAAM,CAAC;gBACL,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;oBAAC,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC;wBAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;gBAAC,CAAC;gBAC9I,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1B,+GAA+G;gBAC/G,qDAAqD;gBACrD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;oBACvB,IAAI,CAAC;wBAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;wBAAC,OAAO,CAAC,CAAC,cAAc,CAAC;wBAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC;oBAC5D,MAAM,CAAC;wBAAC,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC;wBAAC,IAAI,CAAC;4BAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,2CAA2C,CAAC,CAAC;oBAAC,CAAC;gBAC7I,CAAC;gBACD,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO;YACnC,IAAI,OAAO,CAAC;YAAC,IAAI,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO;YAAC,CAAC;YACrE,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,KAAK,QAAQ;gBAAE,OAAO;YAC/G,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,yGAAyG;QACzG,KAAK,CAAC,OAAO,CAAC,KAA0C,EAAE,OAAsB;YAC9E,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrF,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;gBACvH,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;gBACrB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAI,GAAyB,CAAC,IAAI,CAAC;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACnH,CAAC;QACH,CAAC;QACD,iHAAiH;QACjH,KAAK,CAAC,kBAAkB,CAAC,MAAe,EAAE,OAAsB;YAC9D,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YACpI,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YACxD,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC;gBAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAAC,CAAC;YACjH,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC;YACzB,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAM,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,6GAA6G;QAC7G,MAAM;YACJ,UAAU,EAAE,CAAC;YACb,IAAI,CAAc,CAAC;YACnB,IAAI,CAAC;gBAAC,CAAC,GAAG,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,EAAE,CAAC;YAAC,CAAC;YAC5C,oHAAoH;YACpH,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;gBACjC,IAAI,CAAC;oBAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,EAAE,CAAC;gBAAC,CAAC;gBACvF,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnH,OAAO,EAAE,CAAC;gBACV,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,oHAAoH;YACpH,mHAAmH;YACnH,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YACzG,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC;gBACtG,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACzC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO;wBAAE,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC/C,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzH,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAC1B,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,EAAE,CAAC;gBAAC,CAAC;YAAC,CAAC;YACxH,OAAO,CAAC,CAAC,cAAc,CAAC;YACxB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAChE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,IAAI,EAAE,CAAC;YAAC,CAAC;YAChI,KAAK,CAAC,CAAC,CAAC,CAAC;YACT,OAAO,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,qHAAqH;QACrH,KAAK,CAAC,UAAU,CAAC,QAAQ,GAA2C,EAAE;YACpE,8GAA8G;YAC9G,2EAA2E;YAC3E,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC9H,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,YAAY,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC1I,UAAU,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;YAChF,IAAI,CAAC;gBAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAAC,CAAC;YAC5G,OAAO,EAAE,CAAC;YACV,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAAC,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;QACD;;;;WAIG;QACH,YAAY,CAAC,KAAa;YACxB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,cAAc,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACnJ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;gBAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;QAC1B,CAAC;QACD,gHAAgH;QAChH,QAAQ;KACT,CAAC;AACJ,CAAC;AAGD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAQ,GAAkG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC,EAAE,EAAE,CAAC;IAChM,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAgB,CAAC;QACnE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC5J,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAM,0BAA0B;QAChH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC"}

package/dist/hub/member/quota.d.ts

@@ -0,0 +1,20 @@
+import type { ProviderUsage } from "../../usage/providers.js";
+import type { HubQuota } from "../types.js";
+import type { HubMemberLink } from "../client.js";
+export declare const HUB_QUOTA_INTERVAL_MS = 30000;
+export declare const HUB_QUOTA_CAPABILITY = "quota-band-v1";
+/** Never trusts last-good fallback as current capacity. A known quota pause wins even when usage cannot be read. */
+export declare function quotaBand(provider: ProviderUsage | undefined, paused?: boolean, now?: number): HubQuota;
+/** One bounded, coalesced pass per interval; repeated readings in a band send nothing. A new link gets a baseline. */
+export declare function createQuotaPublisher(deps: {
+    exposures(): readonly {
+        exposureId: string;
+        agent: string;
+    }[];
+    read(agent: string): Promise<HubQuota>;
+    now?: () => number;
+}): {
+    refresh: () => Promise<void>;
+    start(l: HubMemberLink): void;
+    stop: () => void;
+};

package/dist/hub/member/quota.js

@@ -0,0 +1,98 @@
+/** The member's only quota export. Uses the fleet's cached usage provider, never an independent vendor poll. */
+import { randomUUID } from "node:crypto";
+export const HUB_QUOTA_INTERVAL_MS = 30_000;
+export const HUB_QUOTA_CAPABILITY = "quota-band-v1";
+const ROUND_MS = 5 * 60_000;
+/** Never trusts last-good fallback as current capacity. A known quota pause wins even when usage cannot be read. */
+export function quotaBand(provider, paused = false, now = Date.now()) {
+    const usable = provider?.status === "ok" && !provider.stale;
+    const windows = usable ? provider.metrics.filter(m => m.type === "percent" && m.resetKind !== "expiry" && !m.resetPassed
+        && typeof m.used === "number" && Number.isFinite(m.used) && m.used >= 0
+        && !(m.resetsAt && Date.parse(m.resetsAt) <= now)) : [];
+    if (paused || windows.some(m => m.used >= 100)) {
+        const resets = windows.filter(m => m.resetKind !== "expiry").map(m => Date.parse(m.resetsAt ?? ""))
+            .filter(n => Number.isFinite(n) && n > now && n <= 8.64e15);
+        return { band: "exhausted", ...(resets.length ? { resetsAt: Math.round(Math.min(...resets) / ROUND_MS) * ROUND_MS } : {}) };
+    }
+    if (!usable)
+        return { band: "unknown" };
+    if (provider.unlimited)
+        return { band: "available" };
+    if (!windows.length)
+        return { band: "unknown" };
+    return { band: windows.some(m => m.used >= 80) ? "near_limit" : "available" };
+}
+/** One bounded, coalesced pass per interval; repeated readings in a band send nothing. A new link gets a baseline. */
+export function createQuotaPublisher(deps) {
+    const now = deps.now ?? Date.now;
+    let link = null, running = null;
+    let lastRead = -Infinity;
+    const sent = new Map();
+    let timer = null;
+    async function pass(captured) {
+        if (link !== captured || !captured.current() || !captured.features?.has(HUB_QUOTA_CAPABILITY))
+            return;
+        const at = now();
+        if (at >= lastRead && at - lastRead < HUB_QUOTA_INTERVAL_MS)
+            return;
+        lastRead = at;
+        const entries = deps.exposures();
+        const ids = new Set(entries.map(e => e.exposureId));
+        for (const id of sent.keys())
+            if (!ids.has(id))
+                sent.delete(id);
+        for (const entry of entries) {
+            let quota;
+            try {
+                quota = await deps.read(entry.agent);
+            }
+            catch {
+                quota = { band: "unknown" };
+            }
+            if (link !== captured || !captured.current())
+                return;
+            // A withdrawal during the provider await must never export that agent's reading.
+            if (!deps.exposures().some(e => e.exposureId === entry.exposureId && e.agent === entry.agent))
+                continue;
+            if (sent.get(entry.exposureId) === quota.band)
+                continue;
+            await captured.send({ v: 1, type: "exposure.quota", requestId: randomUUID(), linkEpoch: captured.linkEpoch,
+                payload: { exposureId: entry.exposureId, quota } });
+            if (link !== captured || !captured.current())
+                return;
+            sent.set(entry.exposureId, quota.band);
+        }
+    }
+    function refresh() {
+        if (running)
+            return running;
+        if (!link)
+            return Promise.resolve();
+        const work = pass(link);
+        running = work;
+        void work.finally(() => { if (running === work)
+            running = null; }).catch(() => { });
+        return work;
+    }
+    function stop() {
+        if (timer)
+            clearInterval(timer);
+        timer = null;
+        link = null;
+        sent.clear();
+        lastRead = -Infinity;
+    }
+    return {
+        refresh,
+        start(l) {
+            stop();
+            link = l;
+            // Queue after the reconciliation response, so the server has marked the link ready.
+            timer = setInterval(() => { void refresh().catch(() => { }); }, HUB_QUOTA_INTERVAL_MS);
+            timer.unref?.();
+            void refresh().catch(() => { });
+        },
+        stop,
+    };
+}
+//# sourceMappingURL=quota.js.map

package/dist/hub/member/quota.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota.js","sourceRoot":"","sources":["../../../src/hub/member/quota.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACpD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC;AAE5B,oHAAoH;AACpH,MAAM,UAAU,SAAS,CAAC,QAAmC,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7F,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW;WACnH,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;WACpE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;aAChG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9H,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxC,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,oBAAoB,CAAC,IAIpC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,IAAI,IAAI,GAAyB,IAAI,EAAE,OAAO,GAAyB,IAAI,CAAC;IAC5E,IAAI,QAAQ,GAAG,CAAC,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,IAAI,KAAK,GAA0B,IAAI,CAAC;IACxC,KAAK,UAAU,IAAI,CAAC,QAAuB;QACzC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC;YAAE,OAAO;QACtG,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,GAAG,QAAQ,GAAG,qBAAqB;YAAE,OAAO;QACpE,QAAQ,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBAAC,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAAC,CAAC;YACpF,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE;gBAAE,OAAO;YACrD,iFAAiF;YACjF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;gBAAE,SAAS;YACxG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,IAAI;gBAAE,SAAS;YACxD,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;gBACxG,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE;gBAAE,OAAO;YACrD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,SAAS,OAAO;QACd,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,IAAI;QACX,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,GAAG,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,QAAQ,GAAG,CAAC,QAAQ,CAAC;IAChE,CAAC;IACD,OAAO;QACL,OAAO;QACP,KAAK,CAAC,CAAgB;YACpB,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;YACjB,oFAAoF;YACpF,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YACtF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,KAAK,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/hub/member-journal.d.ts

@@ -0,0 +1,104 @@
+/** Durable member outbox boundary (P1: the representative adapter). No ordinary daemon or terminal API is imported here. */
+import type Database from "better-sqlite3";
+import type { HubQuestion, HubReceipt, HubAnswer, HubAuthorizationLease, HubAuthorizationRequest, HubRevocation } from "./types.js";
+import type { HubVersionFloor } from "./store.js";
+export interface HubRestrictedOutbox {
+    /**
+     * Same DB transaction, unique source key. P1: the representative adapter (docs/design/hub-representative-agent.md,
+     * approved), which hands the question to the owner's published agent through ordinary delivery; the isolated S4
+     * context is off and uncomposed in P1.
+     */
+    insert(db: Database.Database, question: HubQuestion, sourceKey: string): string;
+    /** Re-reads the unique source row. It must match the same question and restricted context or throw. */
+    lookup(db: Database.Database, question: HubQuestion, sourceKey: string): string | null;
+}
+export interface HubKnownMessagesPage {
+    messages: readonly {
+        messageId: string;
+        contentDigest: string;
+    }[];
+    nextAfterMessageId: string | null;
+}
+export interface HubUnackedReceiptsPage {
+    receipts: readonly HubReceipt[];
+    nextAfterSequence: number;
+    more: boolean;
+}
+export interface HubJournalOptions {
+    hubId: string;
+    encryptionKey: Buffer;
+    floor: HubVersionFloor;
+    outbox: HubRestrictedOutbox;
+    now?: () => number;
+}
+export declare function migrateHubMemberJournal(db: Database.Database): void;
+export declare const HUB_MEMBER_JOURNAL_MIGRATION: Readonly<{
+    component: "s1-member-journal";
+    version: 1;
+    up: typeof migrateHubMemberJournal;
+}>;
+/** Signature refresh may change time/nonce/revocation but cannot redirect a previously admitted question. */
+export declare function questionContextDigest(q: HubQuestion): string;
+export declare class HubMemberJournal {
+    private readonly db;
+    private readonly options;
+    private failed;
+    constructor(db: Database.Database, options: HubJournalOptions);
+    private now;
+    initialize(): void;
+    private meta;
+    private change;
+    private row;
+    private write;
+    private source;
+    private aad;
+    private encrypt;
+    private decrypt;
+    prepare(question: HubQuestion): {
+        operationId: string;
+        receipt: HubReceipt | null;
+    };
+    private receipt;
+    private advance;
+    private authorize;
+    commitAdmission(question: HubQuestion, request: HubAuthorizationRequest, lease: HubAuthorizationLease, fence: {
+        current(): boolean;
+        linkEpoch: number;
+        revocationVersion: number;
+    }): HubReceipt;
+    /**
+     * The admitted question for its representative hand-off (docs/design/hub-representative-agent.md): only while it is
+     * queued with no input intent, i.e. before anything reached the agent. Later stages never re-read the text.
+     */
+    queuedQuestion(messageId: string): HubQuestion;
+    markInputIntent(messageId: string, request: HubAuthorizationRequest, lease: HubAuthorizationLease, fence: {
+        current(): boolean;
+        linkEpoch: number;
+        revocationVersion: number;
+    }): void;
+    recordEvidence(messageId: string, stage: "delivered" | "consumed" | "uncertain"): HubReceipt;
+    saveAnswer(answer: HubAnswer, request: HubAuthorizationRequest, fence: {
+        current(): boolean;
+        linkEpoch: number;
+        revocationVersion: number;
+    }): HubReceipt;
+    recoverInterruptedInputs(): readonly HubReceipt[];
+    reconcile(after: number, ids: readonly {
+        messageId: string;
+        contentDigest: string;
+    }[]): readonly HubReceipt[];
+    /** Bounded metadata only; never expose stored question/answer bytes to composition. */
+    knownMessages(input?: {
+        afterMessageId?: string;
+        limit?: number;
+    }): HubKnownMessagesPage;
+    unackedReceipts(input?: {
+        afterSequence?: number;
+        limit?: number;
+    }): HubUnackedReceiptsPage;
+    revocationVersion(): number;
+    /** A welcome version is a durable lower bound, never a lease or a fabricated scoped revocation. */
+    observeRevocationVersion(version: number): void;
+    acknowledge(receipt: HubReceipt): void;
+    fence(revocation: HubRevocation, fenceLocal: (messageId: string) => void): readonly HubReceipt[];
+}