@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/hub/server.js

@@ -1,202 +0,0 @@
-/** Dedicated TLS machine listener. No Hub browser routes or ordinary fleet authority lives here. */
-import { createServer } from "node:https";
-import { WebSocketServer } from "ws";
-import { HUB_CAPABILITIES, HUB_LIMITS, HUB_OPTIONAL_CAPABILITIES, HUB_PATHS, parseMemberFrame, encodeServerFrame } from "./protocol.js";
-import { HubSocket } from "./socket.js";
-import { HubProtocolError, parseStrictJson } from "./validation.js";
-import { readPrivateFile } from "./private-files.js";
-import { readHubIdentity } from "./tls.js";
-import { personKeyString } from "./identity.js";
-export class HubServer {
-    options;
-    server = null;
-    wss = null;
-    connections = new Map();
-    sockets = new Set();
-    stopped = false;
-    accepting = 0;
-    handshakes = 0;
-    constructor(options) {
-        this.options = options;
-    }
-    current() { return !this.stopped && this.options.current(); }
-    address() { const x = this.server?.address(); return x && typeof x !== "string" ? x : null; }
-    async start() {
-        if (!this.current() || this.server)
-            throw new HubProtocolError("unavailable");
-        const identity = readHubIdentity(this.options);
-        if (identity.hubId !== this.options.hubId)
-            throw new HubProtocolError("invalid");
-        const server = createServer({ key: readPrivateFile(this.options.home, "hub/keys/tls-key.pem"), cert: readPrivateFile(this.options.home, "hub/keys/tls-cert.pem"), minVersion: "TLSv1.2", maxHeaderSize: 8 * 1024 }, (req, res) => { void this.http(req, res).catch(() => this.response(res, 503, { code: "unavailable" })); });
-        this.server = server;
-        this.wss = new WebSocketServer({ noServer: true, maxPayload: HUB_LIMITS.frame, perMessageDeflate: false });
-        server.requestTimeout = server.headersTimeout = 5_000;
-        server.keepAliveTimeout = 5_000;
-        server.maxHeadersCount = 16;
-        server.on("connection", socket => { this.sockets.add(socket); socket.once("close", () => this.sockets.delete(socket)); if (this.sockets.size > 256)
-            socket.destroy(); });
-        server.on("upgrade", (req, socket, head) => { void this.upgrade(req, socket, head).catch(() => socket.destroy()); });
-        await new Promise((resolve, reject) => {
-            server.once("error", reject);
-            server.listen(this.options.listen.port, this.options.listen.host, () => { server.removeListener("error", reject); resolve(); });
-        });
-        if (!this.current()) {
-            await this.close();
-            throw new HubProtocolError("stale");
-        }
-    }
-    machine(req) {
-        return this.current() && req.socket.encrypted === true
-            && req.headers.origin === undefined && req.headers.cookie === undefined && req.headers["sec-websocket-protocol"] === undefined;
-    }
-    response(res, code, body) {
-        if (res.writableEnded || res.destroyed)
-            return;
-        res.writeHead(code, { "Content-Type": "application/json", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" });
-        res.end(JSON.stringify(body));
-    }
-    async body(req) {
-        if (req.headers["content-type"] !== "application/json" || req.headers["content-encoding"] !== undefined)
-            throw new HubProtocolError();
-        const chunks = [];
-        let bytes = 0;
-        for await (const part of req) {
-            const b = Buffer.from(part);
-            bytes += b.length;
-            if (bytes > 2048) {
-                req.destroy();
-                throw new HubProtocolError();
-            }
-            chunks.push(b);
-        }
-        return parseStrictJson(Buffer.concat(chunks), 2048);
-    }
-    async http(req, res) {
-        if (!this.machine(req) || req.headers.authorization !== undefined || req.method !== "POST" || ![HUB_PATHS.pair, HUB_PATHS.claim].includes(req.url)) {
-            this.response(res, 404, { code: "not-found" });
-            return;
-        }
-        if (++this.accepting > HUB_LIMITS.pending) {
-            this.accepting--;
-            this.response(res, 429, { code: "backpressure" });
-            return;
-        }
-        try {
-            const body = await this.body(req);
-            if (!this.current())
-                throw new HubProtocolError("unavailable");
-            const result = req.url === HUB_PATHS.pair ? this.options.pairing.pair(body) : await this.options.pairing.claim(body);
-            if (!this.current())
-                throw new HubProtocolError("unavailable");
-            this.response(res, 200, result);
-        }
-        catch (error) {
-            this.response(res, error instanceof HubProtocolError && error.code === "denied" ? 403 : 400, { code: error instanceof HubProtocolError ? error.code : "invalid" });
-        }
-        finally {
-            this.accepting--;
-        }
-    }
-    async upgrade(req, socket, head) {
-        if (!this.machine(req) || req.method !== "GET" || req.url !== HUB_PATHS.connect || !/^Bearer [a-f0-9]{64}$/.test(req.headers.authorization ?? "")) {
-            socket.destroy();
-            return;
-        }
-        if (++this.handshakes > HUB_LIMITS.pending) {
-            this.handshakes--;
-            socket.destroy();
-            return;
-        }
-        try {
-            const binding = await this.options.pairing.connect(req.headers.authorization.slice(7));
-            if (!this.current() || socket.destroyed) {
-                socket.destroy();
-                return;
-            }
-            // The pairing service fences any old connection before committing the new epoch.
-            this.fenceFleet(binding.fleetId);
-            this.wss.handleUpgrade(req, socket, head, ws => {
-                let connection;
-                const context = { fleetId: binding.fleetId, owner: binding.owner, linkEpoch: binding.linkEpoch, features: new Set(),
-                    current: () => this.current() && this.connections.get(binding.fleetId) === connection && this.options.pairing.bindingCurrent(binding.fleetId, binding.generation) };
-                const link = new HubSocket(ws, { current: context.current, parse: parseMemberFrame, encode: encodeServerFrame,
-                    receive: frame => this.receive(frame, connection, binding.revocationVersion), closed: code => {
-                        clearTimeout(connection?.timer);
-                        if (this.connections.get(binding.fleetId) === connection)
-                            this.connections.delete(binding.fleetId);
-                        this.options.hold(binding.fleetId, code);
-                    } });
-                connection = { link, context, ready: false, hello: false, timer: setTimeout(() => link.end(), 5_000) };
-                connection.timer.unref();
-                this.connections.set(binding.fleetId, connection);
-            });
-        }
-        finally {
-            this.handshakes--;
-        }
-    }
-    async receive(frame, connection, revocationVersion) {
-        const { link, context } = connection;
-        if (!context.current())
-            throw new HubProtocolError("stale");
-        if (!connection.hello) {
-            if (frame.type !== "hello" || frame.linkEpoch !== 0 || !frame.payload.supportedVersions.includes(1) || HUB_CAPABILITIES.some(c => !frame.payload.capabilities.includes(c)))
-                throw new HubProtocolError("incompatible");
-            connection.hello = true;
-            clearTimeout(connection.timer);
-            const offered = this.options.capabilities ?? HUB_OPTIONAL_CAPABILITIES, features = context.features;
-            for (const c of offered)
-                if (frame.payload.capabilities.includes(c))
-                    features.add(c);
-            await link.send({ v: 1, type: "welcome", requestId: frame.requestId, linkEpoch: context.linkEpoch,
-                payload: { selectedVersion: 1, hubId: this.options.hubId, fleetId: context.fleetId, linkEpoch: context.linkEpoch, revocationVersion,
-                    // Only to a member that asked: an older member's strict welcome schema refuses the field.
-                    ...(features.has("welcome-caps-v1") ? { capabilities: [...offered] } : {}) } });
-            return;
-        }
-        if (frame.type === "hello" || frame.linkEpoch !== context.linkEpoch)
-            throw new HubProtocolError("stale");
-        if (!connection.ready && !["exposure.snapshot", "reconcile", "error"].includes(frame.type))
-            throw new HubProtocolError("unavailable");
-        if (frame.type === "exposure.quota" && (!context.features.has("quota-band-v1") || !context.features.has("welcome-caps-v1")))
-            throw new HubProtocolError("incompatible");
-        if (frame.type === "exposure.snapshot" && frame.payload.exposures.some(e => e.fleetId !== context.fleetId || personKeyString(e.owner) !== personKeyString(context.owner)))
-            throw new HubProtocolError("denied");
-        const result = await this.options.receive(frame, context);
-        if (!context.current())
-            return;
-        if (result) {
-            if (result.requestId !== frame.requestId || result.linkEpoch !== context.linkEpoch)
-                throw new HubProtocolError("invalid");
-            await link.send(result);
-            if (frame.type === "reconcile" && result.type === "reconcile" && !result.payload.more)
-                connection.ready = true;
-        }
-    }
-    async send(fleetId, frame) {
-        const connection = this.connections.get(fleetId);
-        if (!connection?.ready || !connection.context.current() || frame.linkEpoch !== connection.context.linkEpoch
-            || frame.type === "welcome" || frame.type === "question" && (frame.payload.identity.destinationFleetId !== fleetId || frame.payload.identity.issuer !== this.options.hubId))
-            throw new HubProtocolError("unavailable");
-        await connection.link.send(frame);
-    }
-    /** The enabled optional features of a fleet's ready link, or null while it has none. */
-    features(fleetId) {
-        const connection = this.connections.get(fleetId);
-        return connection?.ready && connection.context.current() ? connection.context.features : null;
-    }
-    fenceFleet(fleetId, reason = "replaced") { this.connections.get(fleetId)?.link.retire(reason); }
-    fence() { this.stopped = true; for (const connection of [...this.connections.values()])
-        connection.link.end(); for (const socket of this.sockets)
-        socket.destroy(); }
-    async close() {
-        this.fence();
-        const server = this.server, wss = this.wss;
-        this.server = null;
-        this.wss = null;
-        wss?.close();
-        if (server)
-            await new Promise((resolve, reject) => server.close(error => error && error.code !== "ERR_SERVER_NOT_RUNNING" ? reject(error) : resolve()));
-    }
-}
-//# sourceMappingURL=server.js.map

package/dist/hub/server.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/hub/server.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAC;AAKvD,OAAO,EAAE,eAAe,EAAa,MAAM,IAAI,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,yBAAyB,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACxI,OAAO,EAAE,SAAS,EAAyB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAahD,MAAM,OAAO,SAAS;IAQS,OAAO;IAP5B,MAAM,GAAkB,IAAI,CAAC;IAC7B,GAAG,GAA2B,IAAI,CAAC;IACnC,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,OAAO,GAAG,KAAK,CAAC;IAChB,SAAS,GAAG,CAAC,CAAC;IACd,UAAU,GAAG,CAAC,CAAC;IACvB,YAA6B,OAAyB;uBAAzB,OAAO;IAAqB,CAAC;IAClD,OAAO,KAAc,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAyB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,EAChN,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACjI,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,eAAe,GAAG,EAAE,CAAC;QACpH,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzK,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChK,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC;IACO,OAAO,CAAC,GAAoB;QAClC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAK,GAAG,CAAC,MAA2C,CAAC,SAAS,KAAK,IAAI;eACvF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,SAAS,CAAC;IACnI,CAAC;IACO,QAAQ,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;QAC/D,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO;QAC/C,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/J,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,GAAoB;QACrC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,kBAAkB,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtI,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACpK,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,GAAoB,EAAE,GAAmB;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAA4B,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxO,IAAI,EAAE,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3H,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;gBAC/K,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAAC,CAAC;IAC/B,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY;QACtE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAChL,IAAI,EAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACtE,iFAAiF;YACjF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,GAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;gBAC9C,IAAI,UAAuB,CAAC;gBAC5B,MAAM,OAAO,GAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAU;oBACzI,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtK,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB;oBAC3G,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;wBAC3F,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;wBAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,UAAU;4BAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBACpI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC3C,CAAC,EAAE,CAAC,CAAC;gBACP,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;gBAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAAC,CAAC;IAClC,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,KAAqB,EAAE,UAAsB,EAAE,iBAAyB;QAC5F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;YACvN,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;YAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,yBAAyB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAuB,CAAC;YACnH,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrF,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC/F,OAAO,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,iBAAiB;oBACjI,0FAA0F;oBAC1F,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAAC,OAAO;QAC9F,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzG,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,mBAAmB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACtI,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACxK,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChN,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YAAE,OAAO;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC1H,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;gBAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;QACjH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,KAAqB;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS;eACtG,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACzN,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,wFAAwF;IACxF,QAAQ,CAAC,OAAe;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,UAAU,CAAC,OAAe,EAAE,MAAM,GAA2B,UAAU,IAAU,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtI,KAAK,KAAW,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3K,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAC9F,GAAG,EAAE,KAAK,EAAE,CAAC;QAAC,IAAI,MAAM;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACzM,CAAC;CACF"}

package/dist/hub/service-start.d.ts

@@ -1,17 +0,0 @@
-import { type ServiceProcessState } from "../service-drain.js";
-import { type HubNetworkCheck } from "./init/network.js";
-export type HubServiceStartReason = "config" | "process" | "listeners" | "timeout";
-export declare class HubServiceStartError extends Error {
-    readonly reason: HubServiceStartReason;
-    constructor(reason: HubServiceStartReason);
-}
-export interface HubServiceStartDeps {
-    inspectProcess?: (pid: number) => ServiceProcessState;
-    checkListeners?: HubNetworkCheck;
-    now?: () => number;
-    sleep?: (ms: number) => Promise<void>;
-}
-/** Installation must not signal a PID claim. An active manual Hub is stopped through the existing owner command. */
-export declare function assertHubServiceInstallIdle(home: string, read?: (pid: number) => ServiceProcessState): void;
-/** Off means no PID/socket inspection. No signal, PID-file deletion, service control, directory or model call. */
-export declare function waitForHubServiceStart(home: string, deps?: HubServiceStartDeps): Promise<void>;

package/dist/hub/service-start.js

@@ -1,109 +0,0 @@
-/** A replacement waits before claiming the fleet lock, constructing runtimes or opening Hub listeners. */
-import { closeSync, constants, fstatSync, openSync, readFileSync, readSync } from "node:fs";
-import { join } from "node:path";
-import { setTimeout as sleep } from "node:timers/promises";
-import { loadRawFleetConfigSource } from "../config.js";
-import { captureServiceProcess, ServiceDrainError, waitForServiceDrain } from "../service-drain.js";
-import { listenProblems } from "./init/initializer.js";
-import { checkHubInitNetworkForHome } from "./init/network.js";
-export class HubServiceStartError extends Error {
-    reason;
-    constructor(reason) {
-        super(`hub_service_start_${reason}`);
-        this.reason = reason;
-    }
-}
-function previousPid(home) {
-    let fd;
-    try {
-        fd = openSync(join(home, "fleet.pid"), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return null;
-        throw new HubServiceStartError("process");
-    }
-    try {
-        const st = fstatSync(fd);
-        if (!st.isFile() || st.size > 32 || process.getuid && st.uid !== process.getuid())
-            throw new HubServiceStartError("process");
-        const bytes = Buffer.alloc(33), count = readSync(fd, bytes, 0, 33, 0);
-        if (count > 32)
-            throw new HubServiceStartError("process");
-        const text = bytes.subarray(0, count).toString("utf8").trim();
-        if (!/^[1-9]\d{0,9}$/.test(text) || Number(text) <= 1)
-            throw new HubServiceStartError("process");
-        if (!Number.isFinite(st.mtimeMs))
-            throw new HubServiceStartError("process");
-        return { pid: Number(text), writtenAtMs: st.mtimeMs };
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-/** Installation must not signal a PID claim. An active manual Hub is stopped through the existing owner command. */
-export function assertHubServiceInstallIdle(home, read) {
-    try {
-        const claim = previousPid(home);
-        if (!captureServiceProcess(claim?.pid ?? null, read, claim?.writtenAtMs)())
-            throw Error("still running");
-    }
-    catch {
-        throw new HubServiceStartError("process");
-    }
-}
-/** Off means no PID/socket inspection. No signal, PID-file deletion, service control, directory or model call. */
-export async function waitForHubServiceStart(home, deps = {}) {
-    const path = join(home, "fleet.yaml");
-    let source, listeners;
-    try {
-        source = readFileSync(path, "utf8");
-        const raw = loadRawFleetConfigSource(source), hub = raw.hub;
-        if (hub?.enabled !== true)
-            return;
-        listeners = { webListen: hub.webListen, memberListen: hub.memberListen };
-        if (listenProblems("web", listeners.webListen).length || listenProblems("member", listeners.memberListen).length)
-            throw Error("invalid listeners");
-    }
-    catch {
-        throw new HubServiceStartError("config");
-    }
-    let processStopped;
-    try {
-        const claim = previousPid(home);
-        processStopped = captureServiceProcess(claim?.pid ?? null, deps.inspectProcess, claim?.writtenAtMs);
-    }
-    catch {
-        throw new HubServiceStartError("process");
-    }
-    try {
-        await waitForServiceDrain({
-            current: () => { try {
-                return readFileSync(path, "utf8") === source;
-            }
-            catch {
-                return false;
-            } },
-            processStopped,
-            listenersClosed: async () => {
-                let problems;
-                try {
-                    problems = await (deps.checkListeners ? deps.checkListeners(listeners) : checkHubInitNetworkForHome(home, listeners));
-                }
-                catch {
-                    throw new HubServiceStartError("listeners");
-                }
-                if (problems.some(p => p.reason !== "occupied"))
-                    throw new HubServiceStartError("listeners");
-                return problems.length === 0;
-            },
-            now: deps.now ?? (() => performance.now()), sleep: deps.sleep ?? (async (ms) => { await sleep(ms); }),
-        });
-    }
-    catch (err) {
-        if (err instanceof ServiceDrainError)
-            throw new HubServiceStartError(err.reason === "changed" ? "config" : "timeout");
-        throw err;
-    }
-}
-//# sourceMappingURL=service-start.js.map

package/dist/hub/service-start.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-start.js","sourceRoot":"","sources":["../../src/hub/service-start.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,mBAAmB,EAA4B,MAAM,qBAAqB,CAAC;AAC9H,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAA+C,MAAM,mBAAmB,CAAC;AAG5G,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACxB,MAAM;IAA3B,YAAqB,MAA6B;QAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;sBAAtE,MAAM;IAAiE,CAAC;CAC9F;AAQD,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IACjH,OAAO,GAAG,EAAE,CAAC;QAAC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAC7H,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,IAA2C;IACnG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE;YAAE,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AACtD,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,IAAI,GAAwB,EAAE;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,MAAc,EAAE,SAA2B,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,GAA0C,CAAC;QACnG,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAA0C,EAAE,YAAY,EAAE,GAAG,CAAC,YAAgD,EAAE,CAAC;QAC9I,IAAI,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACrD,IAAI,cAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,cAAc,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC;YACxB,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC,CAAC,CAAC;YAChG,cAAc;YACd,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,IAAI,QAAQ,CAAC;gBACb,IAAI,CAAC;oBAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC9H,MAAM,CAAC;oBAAC,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBAAC,CAAC;gBACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;oBAAE,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBAC7F,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACpG,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtH,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/hub/sessions.d.ts

@@ -1,53 +0,0 @@
-import type { IncomingMessage } from "node:http";
-import type { HubRequestContext, PersonKey } from "./types.js";
-import type { HubCore } from "./http/core.js";
-/** Absolute and idle lifetimes of a Hub session. */
-export declare const HUB_SESSION_TTL: number;
-export declare const HUB_SESSION_IDLE: number;
-export declare const hubCookieName: (hubId: string) => string;
-/** The CSRF token of a session: derived from its token, so it is never stored and only the session's holder can know it. */
-export declare const hubCsrfOf: (token: string) => string;
-/**
- * This Hub's session token from a Cookie header — only the exact `__Host-agend_hub_<hubId>` name, only 64 lowercase hex.
- * Every other cookie (a fleet's included) is skipped by name without its value being used.
- */
-export declare function readHubCookie(header: string | string[] | undefined, hubId: string): string | null;
-export declare function hubSetCookie(hubId: string, token: string, maxAgeMs: number): string;
-export declare function hubClearCookie(hubId: string): string;
-export interface HubSessionView {
-    sessionId: string;
-    person: PersonKey;
-    displayName: string;
-    login: string;
-    admin: boolean;
-    csrf: string;
-}
-export declare class HubSessions {
-    private readonly core;
-    private readonly failures;
-    private signingIn;
-    constructor(core: HubCore);
-    private get hubId();
-    isAdmin(person: PersonKey): boolean;
-    /** Directory sign-in → a new session. Errors are generic to the browser ("denied"), bounded to the audit. */
-    signIn(login: unknown, password: unknown): Promise<{
-        token: string;
-        view: HubSessionView;
-        maxAgeMs: number;
-    }>;
-    /** The current session of this token, or null (ended, expired, idle, or the server fenced). Refreshes "seen". */
-    session(token: string | null): (HubSessionView & {
-        token: string;
-    }) | null;
-    signOut(token: string | null): void;
-    /** Same origin and the session's CSRF token: what every mutation needs (constant-time compare). */
-    sameOrigin(req: IncomingMessage): boolean;
-    csrfOk(req: IncomingMessage, token: string): boolean;
-    /**
-     * The request context of hub.md §5 for this request's cookie. `current()` authenticates again (session row, switch);
-     * `requirePerson()` adds a fresh directory check; `requireAdmin()` is the configured administrator's identity, fresh.
-     */
-    context(req: IncomingMessage): HubRequestContext & {
-        token: string | null;
-    };
-}

package/dist/hub/sessions.js

@@ -1,196 +0,0 @@
-/**
- * AgEnD Hub P1, slice 3: Hub web sessions (hub.md §1 "Web entry", §5 "S1/S3").
- *
- * - Sign-in goes through S2's directory (`signIn`), never through a fleet session, bearer token or member credential.
- * - The cookie is `__Host-agend_hub_<hubId>` (Secure, HttpOnly, Path=/, no Domain, SameSite=Strict). Only that one name
- *   is ever looked at; a fleet's cookies (`agend_session`, `__Host-agend_session`, …) are never read or parsed, and the
- *   fleet never reads this one.
- * - Mutations need the page's own origin (`Origin` = the configured webOrigin) and a CSRF token derived from the
- *   session token, which only a same-origin read of /hub/v1/session can learn.
- * - Every check is fresh: the session row and the server's switch on each call, the directory's eligibility on
- *   `requirePerson`/`requireAdmin` (hub.md §5: no eligibility allow-cache). An ineligible person's sessions end.
- * - Local-host repair sign-in is reserved: P1 refuses it (requireAdmin is the configured administrator's current
- *   directory identity).
- */
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { HubProtocolError } from "./validation.js";
-import { personKeyString } from "./identity.js";
-/** Absolute and idle lifetimes of a Hub session. */
-export const HUB_SESSION_TTL = 8 * 60 * 60_000;
-export const HUB_SESSION_IDLE = 60 * 60_000;
-/** Sign-in attempts: per login label in a window, and in flight in all. */
-const SIGNIN_WINDOW = 5 * 60_000, SIGNIN_PER_LOGIN = 5, SIGNIN_INFLIGHT = 8;
-const LOGIN_MAX = 256, PASSWORD_MAX = 1024;
-const digest = (s) => createHash("sha256").update(s).digest("hex");
-export const hubCookieName = (hubId) => `__Host-agend_hub_${hubId}`;
-/** The CSRF token of a session: derived from its token, so it is never stored and only the session's holder can know it. */
-export const hubCsrfOf = (token) => digest(`agend-hub-csrf\u0000${token}`);
-/**
- * This Hub's session token from a Cookie header — only the exact `__Host-agend_hub_<hubId>` name, only 64 lowercase hex.
- * Every other cookie (a fleet's included) is skipped by name without its value being used.
- */
-export function readHubCookie(header, hubId) {
-    const name = hubCookieName(hubId);
-    const text = Array.isArray(header) ? header.join("; ") : header;
-    if (typeof text !== "string" || text.length > 8192)
-        return null;
-    let found = null;
-    for (const part of text.split(";")) {
-        const eq = part.indexOf("=");
-        if (eq < 0 || part.slice(0, eq).trim() !== name)
-            continue;
-        if (found !== null)
-            return null; // two values for our name: neither is trusted
-        found = part.slice(eq + 1).trim();
-    }
-    return found !== null && /^[a-f0-9]{64}$/.test(found) ? found : null;
-}
-export function hubSetCookie(hubId, token, maxAgeMs) {
-    return `${hubCookieName(hubId)}=${token}; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=${Math.max(0, Math.floor(maxAgeMs / 1000))}`;
-}
-export function hubClearCookie(hubId) {
-    return `${hubCookieName(hubId)}=; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=0`;
-}
-export class HubSessions {
-    core;
-    failures = new Map();
-    signingIn = 0;
-    constructor(core) {
-        this.core = core;
-    }
-    get hubId() { return this.core.deps.config.hubId; }
-    isAdmin(person) { return personKeyString(person) === personKeyString(this.core.deps.config.administrator); }
-    /** Directory sign-in → a new session. Errors are generic to the browser ("denied"), bounded to the audit. */
-    async signIn(login, password) {
-        this.core.check();
-        if (typeof login !== "string" || typeof password !== "string" || !login.trim() || !password
-            || login.length > LOGIN_MAX || password.length > PASSWORD_MAX)
-            throw new HubProtocolError("invalid");
-        const label = login.trim();
-        const key = digest(label.toLowerCase()), now = this.core.now();
-        const f = this.failures.get(key);
-        if (f && now - f.since < SIGNIN_WINDOW && f.count >= SIGNIN_PER_LOGIN)
-            throw new HubProtocolError("backpressure");
-        if (this.signingIn >= SIGNIN_INFLIGHT)
-            throw new HubProtocolError("backpressure");
-        this.signingIn++;
-        let result;
-        try {
-            result = await this.core.deps.directory.signIn(label, password);
-        }
-        finally {
-            this.signingIn--;
-        }
-        this.core.check();
-        if (!result.ok) {
-            if (result.reason === "unavailable")
-                throw new HubProtocolError("unavailable");
-            const cur = this.failures.get(key);
-            if (!cur || now - cur.since >= SIGNIN_WINDOW)
-                this.failures.set(key, { since: now, count: 1 });
-            else
-                cur.count++;
-            if (this.failures.size > 4096)
-                for (const [k, v] of this.failures)
-                    if (now - v.since >= SIGNIN_WINDOW)
-                        this.failures.delete(k);
-            throw new HubProtocolError("denied");
-        }
-        this.failures.delete(key);
-        const person = result.person.key, id = personKeyString(person);
-        const token = randomBytes(32).toString("hex"), sessionId = randomUUID();
-        const displayName = (result.person.displayName || result.person.login || label).slice(0, 256);
-        this.core.atomic((db, tx) => {
-            // A person row is created only by successful directory sign-in. Its first insertion is the durable claim
-            // witness; checking it in this same transaction keeps concurrent sign-ins from claiming/auditing twice.
-            const firstAdmin = this.isAdmin(person) && !db.prepare("SELECT 1 FROM hub_people WHERE person=?").get(id);
-            db.prepare(`INSERT INTO hub_people(person, realm, object_id, display_name, login_label, status, last_checked_at) VALUES(?,?,?,?,?,'active',?)
-        ON CONFLICT(person) DO UPDATE SET display_name=excluded.display_name, login_label=excluded.login_label, status='active', last_checked_at=excluded.last_checked_at`)
-                .run(id, person.realm, person.objectId, displayName, result.person.login.slice(0, LOGIN_MAX), now);
-            db.prepare("INSERT INTO hub_sessions(token_hash, id, person, created_at, seen_at, expires_at, state) VALUES(?,?,?,?,?,?,'active')")
-                .run(digest(token), sessionId, id, now, now, now + HUB_SESSION_TTL);
-            this.core.audit(tx, { requestId: randomUUID(), actor: { kind: "person", person }, action: "session.signed-in", result: "completed" });
-            if (firstAdmin)
-                this.core.audit(tx, { requestId: randomUUID(), actor: { kind: "person", person }, action: "administrator.claimed", result: "completed" });
-        });
-        return { token, maxAgeMs: HUB_SESSION_TTL,
-            view: { sessionId, person, displayName, login: result.person.login, admin: this.isAdmin(person), csrf: hubCsrfOf(token) } };
-    }
-    /** The current session of this token, or null (ended, expired, idle, or the server fenced). Refreshes "seen". */
-    session(token) {
-        if (!token || !this.core.live())
-            return null;
-        const now = this.core.now();
-        return this.core.atomic((db) => {
-            const row = db.prepare(`SELECT s.id, s.person, s.created_at, s.seen_at, s.expires_at, s.state, p.realm, p.object_id, p.display_name, p.login_label
-        FROM hub_sessions s JOIN hub_people p ON p.person = s.person WHERE s.token_hash = ?`).get(digest(token));
-            if (!row || row.state !== "active")
-                return null;
-            if (row.expires_at <= now || now - row.seen_at > HUB_SESSION_IDLE) {
-                db.prepare("UPDATE hub_sessions SET state='ended' WHERE id=?").run(row.id);
-                return null;
-            }
-            if (now - row.seen_at > 60_000)
-                db.prepare("UPDATE hub_sessions SET seen_at=? WHERE id=?").run(now, row.id);
-            const person = { realm: row.realm, objectId: row.object_id };
-            return { token, sessionId: row.id, person, displayName: row.display_name, login: row.login_label, admin: this.isAdmin(person), csrf: hubCsrfOf(token) };
-        });
-    }
-    signOut(token) {
-        if (!token)
-            return;
-        this.core.atomic((db, tx) => {
-            const row = db.prepare("SELECT s.id, p.realm, p.object_id FROM hub_sessions s JOIN hub_people p ON p.person = s.person WHERE s.token_hash=? AND s.state='active'")
-                .get(digest(token));
-            if (!row)
-                return;
-            db.prepare("UPDATE hub_sessions SET state='ended' WHERE id=?").run(row.id);
-            this.core.audit(tx, { requestId: randomUUID(), actor: { kind: "person", person: { realm: row.realm, objectId: row.object_id } }, action: "session.signed-out", result: "completed" });
-        });
-    }
-    /** Same origin and the session's CSRF token: what every mutation needs (constant-time compare). */
-    sameOrigin(req) {
-        const origin = req.headers.origin;
-        if (origin !== this.core.deps.config.webOrigin)
-            return false;
-        const site = req.headers["sec-fetch-site"];
-        return site === undefined || site === "same-origin";
-    }
-    csrfOk(req, token) {
-        const sent = req.headers["x-agend-hub-csrf"];
-        if (typeof sent !== "string" || !/^[a-f0-9]{64}$/.test(sent))
-            return false;
-        return timingSafeEqual(Buffer.from(sent, "hex"), Buffer.from(hubCsrfOf(token), "hex"));
-    }
-    /**
-     * The request context of hub.md §5 for this request's cookie. `current()` authenticates again (session row, switch);
-     * `requirePerson()` adds a fresh directory check; `requireAdmin()` is the configured administrator's identity, fresh.
-     */
-    context(req) {
-        const token = readHubCookie(req.headers.cookie, this.hubId);
-        const requestId = randomUUID();
-        const current = async () => {
-            const s = this.session(token);
-            if (!s)
-                throw new HubProtocolError("revoked");
-            return { kind: "directory", person: s.person, sessionId: s.sessionId };
-        };
-        const requirePerson = async () => {
-            const actor = await current();
-            if (actor.kind !== "directory")
-                throw new HubProtocolError("denied");
-            if (!(await this.core.eligible(actor.person)))
-                throw new HubProtocolError("revoked");
-            await current(); // the session may have ended while the directory answered
-            return actor.person;
-        };
-        const requireAdmin = async () => {
-            const person = await requirePerson();
-            if (!this.isAdmin(person))
-                throw new HubProtocolError("denied");
-            return current();
-        };
-        return { requestId, token, current, requirePerson, requireAdmin };
-    }
-}
-//# sourceMappingURL=sessions.js.map

package/dist/hub/sessions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/hub/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIhD,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC5C,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,EAAE,gBAAgB,GAAG,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC;AAC5E,MAAM,SAAS,GAAG,GAAG,EAAE,YAAY,GAAG,IAAI,CAAC;AAE3C,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,oBAAoB,KAAK,EAAE,CAAC;AAC5E,4HAA4H;AAC5H,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;AAEnF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqC,EAAE,KAAa;IAChF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAoB,8CAA8C;QAClG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,KAAK,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB;IACzE,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,wDAAwD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;AAC5I,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,yDAAyD,CAAC;AAC1F,CAAC;AAKD,MAAM,OAAO,WAAW;IAGO,IAAI;IAFhB,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;IACxE,SAAS,GAAG,CAAC,CAAC;IACtB,YAA6B,IAAa;oBAAb,IAAI;IAAY,CAAC;IAC9C,IAAY,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAiB,IAAa,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAEhI,6GAA6G;IAC7G,KAAK,CAAC,MAAM,CAAC,KAAc,EAAE,QAAiB;QAC5C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ;eACtF,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACvG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,aAAa,IAAI,CAAC,CAAC,KAAK,IAAI,gBAAgB;YAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClH,IAAI,IAAI,CAAC,SAAS,IAAI,eAAe;YAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClF,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAAC,CAAC;QACtG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;gBAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,aAAa;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;;gBAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YACjH,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI;gBAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;oBAAE,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,aAAa;wBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/H,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,UAAU,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;YAC1B,yGAAyG;YACzG,wGAAwG;YACxG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,EAAE,CAAC,OAAO,CAAC;0KACyJ,CAAC;iBAClK,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YACrG,EAAE,CAAC,OAAO,CAAC,uHAAuH,CAAC;iBAChI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,eAAe,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACtI,IAAI,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5J,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe;YACvC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAChI,CAAC;IAED,iHAAiH;IACjH,OAAO,CAAC,KAAoB;QAC1B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;4FAC+D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAA2B,CAAC;YACrI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAChD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,GAAG,gBAAgB,EAAE,CAAC;gBAClE,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM;gBAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5G,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1J,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,KAAoB;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,0IAA0I,CAAC;iBAC/J,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAiE,CAAC;YACtF,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACxL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mGAAmG;IACnG,UAAU,CAAC,GAAoB;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,GAAoB,EAAE,KAAa;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3E,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACzF,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,GAAoB;QAC1B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE;YAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,KAAK,IAAwB,EAAE;YACnD,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACrF,MAAM,OAAO,EAAE,CAAC,CAAqC,0DAA0D;YAC/G,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,IAAuB,EAAE;YACjD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAChE,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACpE,CAAC;CACF"}