@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/hub/socket.d.ts

@@ -1,24 +0,0 @@
-/** A bounded, ownership-fenced WSS link. Socket acceptance is never durable delivery evidence. */
-import { WebSocket } from "ws";
-export type HubLinkCloseCode = "unavailable" | "invalid" | "backpressure" | "replaced" | "revoked";
-export declare class HubSocket<Incoming, Outgoing> {
-    readonly ws: WebSocket;
-    private readonly options;
-    private tail;
-    private queued;
-    private queuedBytes;
-    private alive;
-    private ended;
-    private heartbeat;
-    constructor(ws: WebSocket, options: {
-        current(): boolean;
-        parse(input: Buffer): Incoming;
-        encode(value: Outgoing): string;
-        receive(value: Incoming): Promise<void>;
-        closed(code: HubLinkCloseCode): void;
-    });
-    current(): boolean;
-    send(value: Outgoing): Promise<void>;
-    retire(reason: "replaced" | "revoked"): void;
-    end(code?: HubLinkCloseCode): void;
-}

package/dist/hub/socket.js

@@ -1,79 +0,0 @@
-/** A bounded, ownership-fenced WSS link. Socket acceptance is never durable delivery evidence. */
-import { WebSocket } from "ws";
-import { HUB_LIMITS } from "./protocol.js";
-import { HubProtocolError } from "./validation.js";
-export class HubSocket {
-    ws;
-    options;
-    tail = Promise.resolve();
-    queued = 0;
-    queuedBytes = 0;
-    alive = true;
-    ended = false;
-    heartbeat;
-    constructor(ws, options) {
-        this.ws = ws;
-        this.options = options;
-        ws.on("pong", () => { this.alive = true; });
-        ws.on("message", (data, binary) => {
-            if (binary) {
-                this.end("invalid");
-                return;
-            }
-            const buffer = Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
-            if (++this.queued > HUB_LIMITS.pending || (this.queuedBytes += buffer.length) > HUB_LIMITS.sendQueue) {
-                this.end("backpressure");
-                return;
-            }
-            this.tail = this.tail.then(async () => {
-                if (!this.current())
-                    return;
-                await options.receive(options.parse(buffer));
-            }).catch(error => { this.end(error instanceof HubProtocolError && error.code === "backpressure" ? "backpressure" : "invalid"); })
-                .finally(() => { this.queued--; this.queuedBytes -= buffer.length; });
-        });
-        ws.on("close", (code, reason) => this.end(code === 1008 && ["replaced", "revoked"].includes(reason.toString()) ? reason.toString() : "unavailable"));
-        ws.on("error", () => this.end("unavailable"));
-        this.heartbeat = setInterval(() => {
-            if (!this.current() || !this.alive) {
-                this.end("unavailable");
-                return;
-            }
-            this.alive = false;
-            ws.ping(undefined, undefined, (error) => { if (error)
-                this.end("unavailable"); });
-        }, HUB_LIMITS.heartbeat);
-        this.heartbeat.unref();
-    }
-    current() { return !this.ended && this.ws.readyState === WebSocket.OPEN && this.options.current(); }
-    async send(value) {
-        if (!this.current())
-            throw new HubProtocolError("unavailable");
-        const data = this.options.encode(value);
-        if (Buffer.byteLength(data) > HUB_LIMITS.frame || this.ws.bufferedAmount + Buffer.byteLength(data) > HUB_LIMITS.sendQueue)
-            throw new HubProtocolError("backpressure");
-        await new Promise((resolve, reject) => this.ws.send(data, error => error ? reject(new HubProtocolError("uncertain")) : resolve()));
-        if (!this.current())
-            throw new HubProtocolError("uncertain");
-    }
-    retire(reason) {
-        if (this.ended)
-            return;
-        this.ended = true;
-        clearInterval(this.heartbeat);
-        this.ws.close(1008, reason);
-        const timer = setTimeout(() => this.ws.terminate(), 2_000);
-        timer.unref();
-        this.ws.once("close", () => clearTimeout(timer));
-        this.options.closed(reason);
-    }
-    end(code = "unavailable") {
-        if (this.ended)
-            return;
-        this.ended = true;
-        clearInterval(this.heartbeat);
-        this.ws.terminate();
-        this.options.closed(code);
-    }
-}
-//# sourceMappingURL=socket.js.map

package/dist/hub/socket.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../src/hub/socket.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,SAAS,EAAgB,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,SAAS;IAOC,EAAE;IAA8B,OAAO;IANpD,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,CAAC,CAAC;IACX,WAAW,GAAG,CAAC,CAAC;IAChB,KAAK,GAAG,IAAI,CAAC;IACb,KAAK,GAAG,KAAK,CAAC;IACd,SAAS,CAAiB;IAClC,YAAqB,EAAa,EAAmB,OAGpD;kBAHoB,EAAE;uBAA8B,OAAO;QAI1D,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,MAAM,EAAE,EAAE;YACzC,IAAI,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5G,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3I,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACpC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;oBAAE,OAAO;gBAC5B,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC9H,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAA4B,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9N,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACxE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,KAAc,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7G,KAAK,CAAC,IAAI,CAAC,KAAe;QACxB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACtK,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,MAA8B;QACnC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5H,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,GAAG,CAAC,IAAI,GAAqB,aAAa;QACxC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3H,CAAC;CACF"}

package/dist/hub/store.d.ts

@@ -1,77 +0,0 @@
-/** S1's metadata repository. S5 supplies an already-private SQLite DB and audit writer. */
-import type Database from "better-sqlite3";
-import { z } from "zod";
-import type { HubAuditRecord } from "./types.js";
-declare const stateSchema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    revision: z.ZodNumber;
-    revocationVersion: z.ZodNumber;
-    nextLinkEpoch: z.ZodNumber;
-    pairings: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        owner: z.ZodObject<{
-            realm: z.ZodString;
-            objectId: z.ZodString;
-        }, z.core.$strict>;
-        codeHash: z.ZodNullable<z.ZodString>;
-        expiresAt: z.ZodNumber;
-        fleetId: z.ZodNullable<z.ZodString>;
-        claimHash: z.ZodNullable<z.ZodString>;
-        fingerprint: z.ZodNullable<z.ZodString>;
-        ownerConfirmed: z.ZodBoolean;
-        adminApproved: z.ZodBoolean;
-        state: z.ZodEnum<{
-            claimed: "claimed";
-            offered: "offered";
-            pending: "pending";
-            revoked: "revoked";
-        }>;
-    }, z.core.$strict>>;
-    fleets: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        owner: z.ZodObject<{
-            realm: z.ZodString;
-            objectId: z.ZodString;
-        }, z.core.$strict>;
-        credentialHash: z.ZodNullable<z.ZodString>;
-        generation: z.ZodNumber;
-        status: z.ZodEnum<{
-            active: "active";
-            revoked: "revoked";
-        }>;
-    }, z.core.$strict>>;
-    buckets: z.ZodArray<z.ZodObject<{
-        key: z.ZodString;
-        since: z.ZodNumber;
-        attempts: z.ZodNumber;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-export type HubTransportState = z.infer<typeof stateSchema>;
-export interface HubVersionFloor {
-    /** Private durable companion, not part of a restorable older DB snapshot. Missing/corrupt existing state must throw. */
-    read(): number;
-    /** Raise durably BEFORE DB commit. A crash between these writes deliberately freezes the old DB. */
-    raise(revision: number): void;
-}
-export interface HubTransportStoreOptions {
-    floor: HubVersionFloor;
-    /** Must write into this exact DB transaction synchronously; missing/failed audit refuses the mutation. */
-    appendAudit(record: HubAuditRecord, database: Database.Database): void;
-}
-export declare function migrateHubTransportStore(db: Database.Database): void;
-export declare const HUB_TRANSPORT_MIGRATION: Readonly<{
-    component: "s1-transport";
-    version: 1;
-    up: typeof migrateHubTransportStore;
-}>;
-/** No file opening or migration on import/construction; initialization is explicit and belongs to S5. */
-export declare class HubTransportStore {
-    private readonly db;
-    private readonly options;
-    private failed;
-    constructor(db: Database.Database, options: HubTransportStoreOptions);
-    initialize(): void;
-    read(): HubTransportState;
-    mutate<T>(event: Omit<HubAuditRecord, "id" | "sequence" | "policyVersion">, change: (state: HubTransportState) => T): T;
-}
-export {};

package/dist/hub/store.js

@@ -1,88 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { z } from "zod";
-import { epoch, hash, person, uuid, validated, parseStrictJson, HubProtocolError } from "./validation.js";
-const pairing = z.strictObject({ id: uuid, owner: person, codeHash: hash.nullable(), expiresAt: epoch,
-    fleetId: uuid.nullable(), claimHash: hash.nullable(), fingerprint: hash.nullable(), ownerConfirmed: z.boolean(), adminApproved: z.boolean(),
-    state: z.enum(["offered", "pending", "claimed", "revoked"]) });
-const fleet = z.strictObject({ id: uuid, owner: person, credentialHash: hash.nullable(), generation: epoch,
-    status: z.enum(["active", "revoked"]) });
-const stateSchema = z.strictObject({ v: z.literal(1), revision: epoch, revocationVersion: epoch, nextLinkEpoch: epoch,
-    pairings: z.array(pairing).max(64), fleets: z.array(fleet).max(256),
-    buckets: z.array(z.strictObject({ key: hash, since: epoch, attempts: epoch })).max(1024) });
-export function migrateHubTransportStore(db) {
-    db.exec("CREATE TABLE IF NOT EXISTS hub_transport_state (singleton INTEGER PRIMARY KEY CHECK(singleton=1), state TEXT NOT NULL)");
-}
-export const HUB_TRANSPORT_MIGRATION = Object.freeze({ component: "s1-transport", version: 1, up: migrateHubTransportStore });
-/** No file opening or migration on import/construction; initialization is explicit and belongs to S5. */
-export class HubTransportStore {
-    db;
-    options;
-    failed = false;
-    constructor(db, options) {
-        this.db = db;
-        this.options = options;
-    }
-    initialize() {
-        if (this.db.prepare("SELECT 1 FROM hub_transport_state WHERE singleton=1").get())
-            throw new HubProtocolError("conflict");
-        if (this.options.floor.read() !== 0)
-            throw new HubProtocolError("uncertain");
-        const initial = { v: 1, revision: 0, revocationVersion: 0, nextLinkEpoch: 0, pairings: [], fleets: [], buckets: [] };
-        this.db.prepare("INSERT INTO hub_transport_state(singleton,state) VALUES(1,?)").run(JSON.stringify(initial));
-    }
-    read() {
-        if (this.failed)
-            throw new HubProtocolError("uncertain");
-        try {
-            const row = this.db.prepare("SELECT state FROM hub_transport_state WHERE singleton=1").get();
-            if (!row)
-                throw new HubProtocolError("uncertain");
-            const state = validated(stateSchema, parseStrictJson(row.state, 2 * 1024 * 1024)), floor = this.options.floor.read();
-            if (!Number.isSafeInteger(floor) || floor < 0 || floor !== state.revision
-                || new Set(state.pairings.map(x => x.id)).size !== state.pairings.length
-                || new Set(state.fleets.map(x => x.id)).size !== state.fleets.length)
-                throw new HubProtocolError("uncertain");
-            return state;
-        }
-        catch {
-            this.failed = true;
-            throw new HubProtocolError("uncertain");
-        }
-    }
-    mutate(event, change) {
-        let writing = false;
-        try {
-            return this.db.transaction(() => {
-                const state = this.read(), result = change(state);
-                if (result && typeof result.then === "function")
-                    throw new HubProtocolError();
-                state.revision++;
-                validated(stateSchema, state);
-                writing = true;
-                // The independent floor advances before either transactional write. An audit/DB failure must
-                // remain unconfirmed after restart, rather than silently restoring the prior authorization.
-                this.options.floor.raise(state.revision);
-                const audited = this.options.appendAudit({ ...event, id: randomUUID(), sequence: state.revision, policyVersion: state.revocationVersion }, this.db);
-                if (audited && typeof audited.then === "function") {
-                    void Promise.resolve(audited).catch(() => { });
-                    throw new HubProtocolError("uncertain");
-                }
-                this.db.prepare("UPDATE hub_transport_state SET state=? WHERE singleton=1").run(JSON.stringify(state));
-                return result;
-            }).immediate();
-        }
-        catch (error) {
-            // Validation/refusal may occur before any write. An advanced floor or failed writer freezes every future read.
-            if (writing)
-                this.failed = true;
-            try {
-                this.read();
-            }
-            catch {
-                this.failed = true;
-            }
-            throw error;
-        }
-    }
-}
-//# sourceMappingURL=store.js.map

package/dist/hub/store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/hub/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE1G,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK;IACnG,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3I,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;AACjE,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK;IACxG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3C,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK;IACnH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAa9F,MAAM,UAAU,wBAAwB,CAAC,EAAqB;IAC5D,EAAE,CAAC,IAAI,CAAC,wHAAwH,CAAC,CAAC;AACpI,CAAC;AACD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAC9H,yGAAyG;AACzG,MAAM,OAAO,iBAAiB;IAEC,EAAE;IAAsC,OAAO;IADpE,MAAM,GAAG,KAAK,CAAC;IACvB,YAA6B,EAAqB,EAAmB,OAAiC;kBAAzE,EAAE;uBAAsC,OAAO;IAA6B,CAAC;IAC1G,UAAU;QACR,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAsB,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAAmC,CAAC;YAC9H,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ;mBACpE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;mBACrE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAChH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAI,KAAgE,EAAE,MAAuC;QACjH,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClD,IAAI,MAAM,IAAI,OAAQ,MAA6B,CAAC,IAAI,KAAK,UAAU;oBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBACtG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC;gBACf,6FAA6F;gBAC7F,4FAA4F;gBAC5F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzC,MAAM,OAAO,GAAY,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC7J,IAAI,OAAO,IAAI,OAAQ,OAA8B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC1E,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzF,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvG,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+GAA+G;YAC/G,IAAI,OAAO;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC;YAClD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/hub/tls.d.ts

@@ -1,31 +0,0 @@
-import { X509Certificate } from "node:crypto";
-export interface HubProvisionedIdentity {
-    hubId: string;
-    spkiSha256: string;
-    issuerKeyId: string;
-    issuerPublicKey: string;
-}
-export declare function hubOrigin(input: string, protocol?: "https:" | "wss:"): string;
-export declare function verifyHubCertificate(pem: string | Buffer, origin: string, pin: string | undefined, now?: number): X509Certificate;
-/** Persisted certificate evidence may expire; only its key/address binding is retained as the trust anchor. */
-export declare function verifyHubCertificateBinding(pem: string | Buffer, origin: string, pin: string | undefined): X509Certificate;
-/** Fixed executable and argv; no caller-selected command, shell, trust-store edit or overwrite. */
-export declare function provisionHubIdentity(input: {
-    home: string;
-    memberOrigin: string;
-}): Promise<HubProvisionedIdentity>;
-/** Inspection may use the stored origin; all admission/mount callers pass their expected origin explicitly. */
-export declare function readHubIdentity(input: {
-    home: string;
-    memberOrigin?: string;
-}): HubProvisionedIdentity;
-/** Missing means wholly unprovisioned; a partial, untrusted or changed identity is an error, never a fresh start. */
-export declare function readHubIdentityIfPresent(home: string): HubProvisionedIdentity | undefined;
-/** SPKI is the trust anchor. Per-socket verification happens before HTTP can write any credential bytes. */
-export declare function pinnedHubAgent(binding: {
-    memberOrigin: string;
-    spkiSha256: string;
-}, current?: () => boolean): import("node:https").Agent;
-export declare class HubTlsIdentityError extends Error {
-    constructor();
-}

package/dist/hub/tls.js

@@ -1,135 +0,0 @@
-import { Agent as HttpsAgent } from "node:https";
-import { connect as tlsConnect } from "node:tls";
-import { generateKeyPairSync, randomUUID, X509Certificate, createPublicKey, createPrivateKey } from "node:crypto";
-import { execFile } from "../child-process.js";
-import { promisify } from "node:util";
-import { isIP } from "node:net";
-import { existsSync, mkdirSync, openSync, writeFileSync, closeSync, fsyncSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { ensurePrivateDirectory, privatePath, readPrivateFile } from "./private-files.js";
-import { hash, uuid, validated, parseStrictJson } from "./validation.js";
-import { issuerKeyId, sha256 } from "./identity.js";
-const identitySchema = z.strictObject({ v: z.literal(1), hubId: uuid, memberOrigin: z.string(), spkiSha256: hash, issuerKeyId: hash, issuerPublicKey: z.string().max(2048) });
-export function hubOrigin(input, protocol = "https:") {
-    const u = new URL(input);
-    if (u.protocol !== protocol || u.username || u.password || u.pathname !== "/" || u.search || u.hash || u.origin === "null" || u.hostname.endsWith("."))
-        throw Error("Invalid Hub origin");
-    return u.origin;
-}
-function host(origin) { return new URL(hubOrigin(origin)).hostname.replace(/^\[|\]$/g, ""); }
-function privateWrite(path, value) {
-    const fd = openSync(path, "wx", 0o600);
-    try {
-        writeFileSync(fd, value, "utf8");
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-export function verifyHubCertificate(pem, origin, pin, now = Date.now()) {
-    const cert = new X509Certificate(pem);
-    if (now < Date.parse(cert.validFrom) || now >= Date.parse(cert.validTo))
-        throw Error("Hub TLS identity differs");
-    return verifyHubCertificateBinding(pem, origin, pin);
-}
-/** Persisted certificate evidence may expire; only its key/address binding is retained as the trust anchor. */
-export function verifyHubCertificateBinding(pem, origin, pin) {
-    const cert = new X509Certificate(pem), name = host(origin), digest = sha256(cert.publicKey.export({ type: "spki", format: "der" }));
-    if (!(isIP(name) ? cert.checkIP(name) : cert.checkHost(name, { subject: "never", wildcards: false }))
-        || pin !== undefined && digest !== validated(hash, pin))
-        throw Error("Hub TLS identity differs");
-    return cert;
-}
-/** Fixed executable and argv; no caller-selected command, shell, trust-store edit or overwrite. */
-export async function provisionHubIdentity(input) {
-    const origin = hubOrigin(input.memberOrigin), name = host(origin);
-    ensurePrivateDirectory(input.home, "hub");
-    const keys = join(input.home, "hub/keys");
-    if (existsSync(keys))
-        throw Error("Hub identity already exists");
-    mkdirSync(keys, { mode: 0o700 });
-    privatePath(input.home, "hub/keys", true);
-    const tls = generateKeyPairSync("ec", { namedCurve: "prime256v1" }), issuer = generateKeyPairSync("ed25519");
-    privateWrite(join(keys, "tls-key.pem"), tls.privateKey.export({ type: "pkcs8", format: "pem" }).toString());
-    privateWrite(join(keys, "issuer-key.pem"), issuer.privateKey.export({ type: "pkcs8", format: "pem" }).toString());
-    const issuerPublicKey = issuer.publicKey.export({ type: "spki", format: "pem" }).toString();
-    privateWrite(join(keys, "issuer-public.pem"), issuerPublicKey);
-    // openssl writes only inside our new private directory; no key bytes are command-line arguments or logs.
-    const certFile = join(keys, "tls-cert.pem");
-    privateWrite(certFile, "");
-    await promisify(execFile)("/usr/bin/openssl", ["req", "-new", "-x509", "-sha256", "-days", "365", "-key", join(keys, "tls-key.pem"), "-out", certFile,
-        "-subj", "/CN=AgEnD Hub", "-addext", `subjectAltName=${isIP(name) ? "IP" : "DNS"}:${name}`], { timeout: 10_000, maxBuffer: 16 * 1024, env: { PATH: "/usr/bin:/bin", LANG: "C" } })
-        .catch(() => { throw Error("Hub certificate provisioning failed"); });
-    const cert = verifyHubCertificate(readPrivateFile(input.home, "hub/keys/tls-cert.pem"), origin, undefined);
-    const metadata = { v: 1, hubId: randomUUID(), memberOrigin: origin,
-        spkiSha256: sha256(cert.publicKey.export({ type: "spki", format: "der" })), issuerKeyId: issuerKeyId(issuer.publicKey), issuerPublicKey };
-    privateWrite(join(keys, "identity.json"), JSON.stringify(metadata));
-    return readHubIdentity({ home: input.home, memberOrigin: origin });
-}
-/** Inspection may use the stored origin; all admission/mount callers pass their expected origin explicitly. */
-export function readHubIdentity(input) {
-    const metadata = validated(identitySchema, parseStrictJson(readPrivateFile(input.home, "hub/keys/identity.json")));
-    const origin = hubOrigin(input.memberOrigin ?? metadata.memberOrigin);
-    const cert = verifyHubCertificate(readPrivateFile(input.home, "hub/keys/tls-cert.pem"), origin, metadata.spkiSha256);
-    const issuer = createPublicKey(readPrivateFile(input.home, "hub/keys/issuer-public.pem"));
-    const privateIssuer = createPrivateKey(readPrivateFile(input.home, "hub/keys/issuer-key.pem"));
-    const privateTls = createPrivateKey(readPrivateFile(input.home, "hub/keys/tls-key.pem"));
-    if (metadata.memberOrigin !== origin || issuer.asymmetricKeyType !== "ed25519" || privateIssuer.asymmetricKeyType !== "ed25519"
-        || issuer.export({ type: "spki", format: "pem" }).toString() !== metadata.issuerPublicKey || issuerKeyId(issuer) !== metadata.issuerKeyId
-        || issuerKeyId(privateIssuer) !== metadata.issuerKeyId || sha256(createPublicKey(privateTls).export({ type: "spki", format: "der" })) !== sha256(cert.publicKey.export({ type: "spki", format: "der" })))
-        throw Error("Hub identity files differ");
-    return { hubId: metadata.hubId, spkiSha256: metadata.spkiSha256, issuerKeyId: metadata.issuerKeyId, issuerPublicKey: metadata.issuerPublicKey };
-}
-/** Missing means wholly unprovisioned; a partial, untrusted or changed identity is an error, never a fresh start. */
-export function readHubIdentityIfPresent(home) {
-    try {
-        privatePath(home, "hub/keys", true);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return undefined;
-        throw error;
-    }
-    return readHubIdentity({ home });
-}
-/** SPKI is the trust anchor. Per-socket verification happens before HTTP can write any credential bytes. */
-export function pinnedHubAgent(binding, current = () => true) {
-    const origin = hubOrigin(binding.memberOrigin), hostname = host(origin), pin = validated(hash, binding.spkiSha256);
-    const agent = new HttpsAgent({ keepAlive: false });
-    agent.createConnection = (options, callback) => {
-        let finished = false;
-        const finish = (error, socket) => {
-            if (finished)
-                return;
-            finished = true;
-            if (error)
-                socket?.destroy();
-            else
-                socket?.setTimeout(0);
-            callback?.(error, socket);
-        };
-        // Deliberately no process/global TLS change: only this owned socket uses manual pinned-key authentication.
-        const socket = tlsConnect({ host: hostname, port: Number(new URL(origin).port || 443),
-            servername: isIP(hostname) ? undefined : hostname, rejectUnauthorized: false, minVersion: "TLSv1.2" }, () => {
-            try {
-                if (!current())
-                    throw Error();
-                verifyHubCertificate(socket.getPeerCertificate().raw, origin, pin);
-                finish(null, socket);
-            }
-            catch {
-                finish(new HubTlsIdentityError(), socket);
-            }
-        });
-        socket.setTimeout(5_000, () => { finish(Error("Hub TLS connection unavailable"), socket); });
-        socket.once("error", () => finish(Error("Hub TLS connection unavailable"), socket));
-        return undefined; // Agent receives the socket only through the verified callback.
-    };
-    return agent;
-}
-export class HubTlsIdentityError extends Error {
-    constructor() { super("Hub TLS identity differs"); }
-}
-//# sourceMappingURL=tls.js.map

package/dist/hub/tls.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../src/hub/tls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9K,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,QAAQ,GAAsB,QAAQ;IAC7E,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1L,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AACD,SAAS,IAAI,CAAC,MAAc,IAAY,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7G,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC;QAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACrF,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,MAAc,EAAE,GAAuB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjH,OAAO,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,2BAA2B,CAAC,GAAoB,EAAE,MAAc,EAAE,GAAuB;IACvG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;WAChG,GAAG,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AACD,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAA6C;IACtF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjE,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7G,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5G,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClH,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5F,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/D,yGAAyG;IACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5C,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ;QACnJ,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACjL,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,MAAM;QACzE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5I,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAAC,KAA8C;IAC5E,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,IAAI,aAAa,CAAC,iBAAiB,KAAK,SAAS;WAC1H,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,QAAQ,CAAC,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,WAAW;WACtI,WAAW,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrP,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;AAClJ,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,IAAI,CAAC;QAAC,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACxG,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,cAAc,CAAC,OAAqD,EAAE,OAAO,GAAkB,GAAG,EAAE,CAAC,IAAI;IACvH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACnH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,MAAoC,EAAE,EAAE;YAC3E,IAAI,QAAQ;gBAAE,OAAO;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,IAAI,KAAK;gBAAE,MAAM,EAAE,OAAO,EAAE,CAAC;;gBAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7H,CAAC,CAAC;QACF,2GAA2G;QAC3G,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YACnF,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE;YAC5G,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE;oBAAE,MAAM,KAAK,EAAE,CAAC;gBAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAChI,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,OAAO,SAAoD,CAAC,CAAC,gEAAgE;IAC/H,CAAC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAAG,gBAAgB,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;CAAE"}