@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/hub/audit/index.js

@@ -1,344 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
-import { personKeyString } from "../directory/index.js";
-import { hubTxDatabase } from "../db.js";
-export const HUB_AUDIT_MIGRATION = Object.freeze({
-    component: "s5-audit",
-    version: 1,
-    up(db) {
-        db.exec(`
-      CREATE TABLE IF NOT EXISTS hub_audit (
-        sequence INTEGER PRIMARY KEY,
-        id TEXT NOT NULL UNIQUE,
-        at INTEGER NOT NULL,
-        request_id TEXT NOT NULL,
-        actor TEXT NOT NULL,
-        action TEXT NOT NULL,
-        result TEXT NOT NULL,
-        message_id TEXT, room_id TEXT, fleet_id TEXT, exposure_id TEXT,
-        owner_at_event TEXT, grant_id TEXT, grant_revision INTEGER,
-        policy_version INTEGER NOT NULL,
-        content_ref TEXT, reason_code TEXT,
-        component_sequence INTEGER,
-        prev_hash TEXT NOT NULL,
-        hash TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS hub_audit_at ON hub_audit(at);
-      CREATE INDEX IF NOT EXISTS hub_audit_exposure ON hub_audit(exposure_id);
-      CREATE INDEX IF NOT EXISTS hub_audit_owner ON hub_audit(owner_at_event);
-      CREATE INDEX IF NOT EXISTS hub_audit_fleet ON hub_audit(fleet_id);
-      CREATE INDEX IF NOT EXISTS hub_audit_message ON hub_audit(message_id);
-      CREATE TABLE IF NOT EXISTS hub_audit_head (singleton INTEGER PRIMARY KEY CHECK(singleton = 1), sequence INTEGER NOT NULL, hash TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS hub_audit_checkpoint (sequence INTEGER PRIMARY KEY, hash TEXT NOT NULL, at INTEGER NOT NULL);
-      CREATE TABLE IF NOT EXISTS hub_audit_content (ref TEXT PRIMARY KEY, record_id TEXT UNIQUE, nonce BLOB NOT NULL, ciphertext BLOB NOT NULL, created_at INTEGER NOT NULL);
-      CREATE INDEX IF NOT EXISTS hub_audit_content_created ON hub_audit_content(created_at);
-      CREATE TABLE IF NOT EXISTS hub_auditors (person_id TEXT PRIMARY KEY, assigned_at INTEGER NOT NULL, assigned_by TEXT NOT NULL);
-    `);
-    },
-});
-const GENESIS = "0".repeat(64);
-const RESULTS = new Set(["allowed", "denied", "held", "completed"]);
-const ACTION = /^[a-z][a-z0-9.-]{0,127}$/;
-const DAY_MS = 86_400_000;
-export class HubAuditAccessError extends Error {
-    constructor(message = "not allowed to read this audit") {
-        super(message);
-        this.name = "HubAuditAccessError";
-    }
-}
-function canonical(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonical).join(",")}]`;
-    if (value && typeof value === "object") {
-        const entries = Object.entries(value).filter(([, v]) => v !== undefined);
-        entries.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
-/** The fields the hash covers: everything stored except the hash itself. */
-function hashedFields(row) {
-    const { prev_hash: _prev, ...rest } = row;
-    return rest;
-}
-function chainHash(prevHash, row) {
-    return createHash("sha256").update(`${prevHash}\n${canonical(hashedFields(row))}`).digest("hex");
-}
-function parsePersonId(id) {
-    if (!id)
-        return undefined;
-    const slash = id.indexOf("/");
-    return slash > 0 ? { realm: id.slice(0, slash), objectId: id.slice(slash + 1) } : undefined;
-}
-function toRecord(row) {
-    const owner = parsePersonId(row.owner_at_event);
-    return {
-        id: row.id,
-        sequence: row.sequence,
-        at: row.at,
-        requestId: row.request_id,
-        actor: JSON.parse(row.actor),
-        action: row.action,
-        result: row.result,
-        policyVersion: row.policy_version,
-        ...(row.message_id ? { messageId: row.message_id } : {}),
-        ...(row.room_id ? { roomId: row.room_id } : {}),
-        ...(row.fleet_id ? { fleetId: row.fleet_id } : {}),
-        ...(row.exposure_id ? { exposureId: row.exposure_id } : {}),
-        ...(owner ? { ownerAtEvent: owner } : {}),
-        ...(row.grant_id ? { grantId: row.grant_id } : {}),
-        ...(row.grant_revision !== null ? { grantRevision: row.grant_revision } : {}),
-        ...(row.content_ref ? { contentRef: row.content_ref } : {}),
-        ...(row.reason_code ? { reasonCode: row.reason_code } : {}),
-    };
-}
-export function createHubAudit(options) {
-    const { db } = options;
-    if (!Buffer.isBuffer(options.contentKey) || options.contentKey.length !== 32)
-        throw new Error("the Hub content key must be 32 bytes");
-    const key = Buffer.from(options.contentKey);
-    const now = options.now ?? Date.now;
-    const insert = db.prepare(`INSERT INTO hub_audit (sequence, id, at, request_id, actor, action, result, message_id, room_id, fleet_id,
-    exposure_id, owner_at_event, grant_id, grant_revision, policy_version, content_ref, reason_code, component_sequence, prev_hash, hash)
-    VALUES (@sequence, @id, @at, @request_id, @actor, @action, @result, @message_id, @room_id, @fleet_id, @exposure_id, @owner_at_event,
-    @grant_id, @grant_revision, @policy_version, @content_ref, @reason_code, @component_sequence, @prev_hash, @hash)`);
-    const head = () => {
-        const row = db.prepare("SELECT sequence, hash FROM hub_audit_head WHERE singleton = 1").get();
-        return row ?? { sequence: 0, hash: GENESIS };
-    };
-    /** The one write path. Caller guarantees we are inside a transaction on `db`. */
-    const write = (record) => {
-        if (!db.inTransaction)
-            throw new Error("Hub audit is written only inside a transaction");
-        if (!ACTION.test(record.action ?? ""))
-            throw new Error("Hub audit: invalid action");
-        if (!RESULTS.has(record.result))
-            throw new Error("Hub audit: invalid result");
-        if (!Number.isSafeInteger(record.at) || !Number.isSafeInteger(record.policyVersion) || record.policyVersion < 0)
-            throw new Error("Hub audit: invalid time or policy version");
-        if (!record.actor || !["person", "local-host", "member"].includes(record.actor.kind))
-            throw new Error("Hub audit: invalid actor");
-        const prev = head();
-        const row = {
-            sequence: prev.sequence + 1,
-            id: typeof record.id === "string" && record.id ? record.id : randomUUID(),
-            at: record.at,
-            request_id: typeof record.requestId === "string" && record.requestId ? record.requestId : "-",
-            actor: canonical(record.actor),
-            action: record.action,
-            result: record.result,
-            message_id: record.messageId ?? null,
-            room_id: record.roomId ?? null,
-            fleet_id: record.fleetId ?? null,
-            exposure_id: record.exposureId ?? null,
-            owner_at_event: record.ownerAtEvent ? personKeyString(record.ownerAtEvent) : null,
-            grant_id: record.grantId ?? null,
-            grant_revision: record.grantRevision ?? null,
-            policy_version: record.policyVersion,
-            content_ref: record.contentRef ?? null,
-            reason_code: record.reasonCode ?? null,
-            component_sequence: Number.isSafeInteger(record.sequence) ? record.sequence : null,
-            prev_hash: prev.hash,
-        };
-        if (record.contentRef !== undefined)
-            bindContent(record.contentRef, row.id);
-        const hash = chainHash(prev.hash, row);
-        insert.run({ ...row, hash });
-        db.prepare("INSERT INTO hub_audit_head(singleton, sequence, hash) VALUES(1, ?, ?) ON CONFLICT(singleton) DO UPDATE SET sequence = excluded.sequence, hash = excluded.hash").run(row.sequence, hash);
-        return row.sequence;
-    };
-    // GCM authenticated data binds a payload to its ref and, once its record exists, to that record's immutable id
-    // (hub-composition.md §4): a ciphertext moved to another ref or record does not decrypt.
-    const aad = (ref, recordId) => Buffer.from(`${ref}\n${recordId ?? ""}`);
-    const encrypt = (ref, recordId, payload) => {
-        const nonce = randomBytes(12);
-        const cipher = createCipheriv("aes-256-gcm", key, nonce);
-        cipher.setAAD(aad(ref, recordId));
-        const body = Buffer.concat([cipher.update(JSON.stringify(payload), "utf8"), cipher.final(), cipher.getAuthTag()]);
-        return { nonce, body };
-    };
-    const decrypt = (ref, recordId, nonce, body) => {
-        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
-        decipher.setAAD(aad(ref, recordId));
-        decipher.setAuthTag(body.subarray(body.length - 16));
-        const plain = Buffer.concat([decipher.update(body.subarray(0, body.length - 16)), decipher.final()]).toString("utf8");
-        return JSON.parse(plain);
-    };
-    /** Inside the record's own transaction: the content row gets the record's id, re-encrypted under it. Once only. */
-    const bindContent = (ref, recordId) => {
-        const row = db.prepare("SELECT record_id, nonce, ciphertext FROM hub_audit_content WHERE ref = ?").get(ref);
-        if (!row)
-            throw new Error("Hub audit: contentRef was not stored in this transaction's database");
-        if (row.record_id !== null)
-            throw new Error("Hub audit: this content already belongs to another record");
-        const payload = decrypt(ref, null, row.nonce, row.ciphertext);
-        const { nonce, body } = encrypt(ref, recordId, payload);
-        db.prepare("UPDATE hub_audit_content SET record_id = ?, nonce = ?, ciphertext = ? WHERE ref = ?").run(recordId, nonce, body, ref);
-    };
-    /** A bound content row, decrypted under its own (ref, record id); `expectedRecordId` must match when given. */
-    const readBound = (ref, expectedRecordId) => {
-        const row = db.prepare("SELECT record_id, nonce, ciphertext FROM hub_audit_content WHERE ref = ?").get(ref);
-        if (!row || row.record_id === null)
-            return undefined;
-        if (expectedRecordId !== undefined && row.record_id !== expectedRecordId)
-            throw new HubAuditAccessError("this content belongs to another record");
-        return decrypt(ref, row.record_id, row.nonce, row.ciphertext);
-    };
-    const sameDb = (tx) => {
-        if (hubTxDatabase(tx) !== db)
-            throw new Error("Hub audit: the transaction belongs to another database");
-    };
-    const content = {
-        put(tx, payload) {
-            sameDb(tx);
-            const clean = {};
-            if (typeof payload.question === "string")
-                clean.question = payload.question;
-            if (typeof payload.answer === "string")
-                clean.answer = payload.answer;
-            if (payload.buttons !== undefined)
-                clean.buttons = payload.buttons;
-            if (payload.pollBallot !== undefined)
-                clean.pollBallot = payload.pollBallot;
-            const ref = randomBytes(16).toString("hex");
-            const { nonce, body } = encrypt(ref, null, clean);
-            db.prepare("INSERT INTO hub_audit_content(ref, record_id, nonce, ciphertext, created_at) VALUES(?, NULL, ?, ?, ?)").run(ref, nonce, body, now());
-            return ref;
-        },
-        get(ref) {
-            if (typeof ref !== "string" || !/^[0-9a-f]{32}$/.test(ref))
-                return undefined;
-            return readBound(ref);
-        },
-    };
-    /**
-     * Who is asking: resolved asynchronously (fresh session and directory eligibility). The scope itself (auditor
-     * assignment, ownership) is decided later, synchronously, in the same transaction that records the read and runs the
-     * query: nothing is awaited between that check and the data leaving.
-     */
-    const identity = async (ctx) => {
-        const actor = await ctx.current();
-        if (actor.kind !== "directory")
-            throw new HubAuditAccessError("audit is read with a directory identity; the local host is not an auditor");
-        const person = await ctx.requirePerson();
-        return { personId: personKeyString(person), actor: { kind: "person", person } };
-    };
-    const isAuditor = (personId) => db.prepare("SELECT 1 FROM hub_auditors WHERE person_id = ?").get(personId) !== undefined;
-    const recordRead = (ctx, actor, action, extra = {}) => {
-        write({ id: randomUUID(), sequence: 0, at: now(), requestId: ctx.requestId, actor, action, result: "completed", policyVersion: 0, ...extra });
-    };
-    return {
-        append(tx, record) {
-            sameDb(tx);
-            write(record);
-        },
-        appendInTransaction(record, database) {
-            if (database !== db)
-                throw new Error("Hub audit: another database");
-            write(record);
-        },
-        content,
-        async read(ctx, scope) {
-            const who = await identity(ctx);
-            return db.transaction(() => {
-                const auditor = isAuditor(who.personId);
-                const where = [];
-                const args = [];
-                if (!auditor) {
-                    where.push("owner_at_event = ?");
-                    args.push(who.personId);
-                }
-                if (scope.exposureId !== undefined) {
-                    where.push("exposure_id = ?");
-                    args.push(scope.exposureId);
-                }
-                if (scope.after !== undefined) {
-                    where.push("sequence > ?");
-                    args.push(scope.after);
-                }
-                // Recorded first, in the same transaction; a failed record fails the read.
-                recordRead(ctx, who.actor, "audit.read", scope.exposureId ? { exposureId: scope.exposureId } : {});
-                const rows = db.prepare(`SELECT * FROM hub_audit ${where.length ? `WHERE ${where.join(" AND ")}` : ""} ORDER BY sequence LIMIT 500`).all(...args);
-                return rows.map(toRecord);
-            }).immediate();
-        },
-        async readContent(ctx, recordId) {
-            const who = await identity(ctx);
-            return db.transaction(() => {
-                const row = db.prepare("SELECT * FROM hub_audit WHERE id = ?").get(recordId);
-                if (!row || (!isAuditor(who.personId) && row.owner_at_event !== who.personId))
-                    throw new HubAuditAccessError();
-                recordRead(ctx, who.actor, "audit.read-content", { ...(row.message_id ? { messageId: row.message_id } : {}) });
-                const payload = row.content_ref ? readBound(row.content_ref, row.id) : undefined;
-                const audience = [];
-                const actor = JSON.parse(row.actor);
-                if (actor.kind === "person")
-                    audience.push(actor.person);
-                const owner = parsePersonId(row.owner_at_event);
-                if (owner && !audience.some((p) => personKeyString(p) === row.owner_at_event))
-                    audience.push(owner);
-                return { recordId: row.id, ...(payload?.question !== undefined ? { question: payload.question } : {}), ...(payload?.answer !== undefined ? { answer: payload.answer } : {}),
-                    ...(payload?.buttons !== undefined ? { buttons: payload.buttons } : {}), ...(payload?.pollBallot !== undefined ? { pollBallot: payload.pollBallot } : {}), audience };
-            }).immediate();
-        },
-        verifyChain() {
-            const checkpoint = db.prepare("SELECT sequence, hash FROM hub_audit_checkpoint ORDER BY sequence DESC LIMIT 1").get();
-            let prev = checkpoint?.hash ?? GENESIS;
-            let expected = (checkpoint?.sequence ?? 0) + 1;
-            let checked = 0;
-            for (const row of db.prepare("SELECT * FROM hub_audit WHERE sequence > ? ORDER BY sequence").iterate(checkpoint?.sequence ?? 0)) {
-                const { hash, ...rest } = row;
-                if (row.sequence !== expected || row.prev_hash !== prev || chainHash(prev, rest) !== hash)
-                    return { ok: false, sequence: row.sequence };
-                prev = hash;
-                expected += 1;
-                checked += 1;
-            }
-            // The head must end exactly where the rows (or the checkpoint, or genesis) end: an erased table or suffix is
-            // a broken chain even when no row is left to check.
-            const h = head();
-            if (h.hash !== prev || h.sequence !== expected - 1)
-                return { ok: false, sequence: h.sequence };
-            return { ok: true, checked };
-        },
-        setAuditor(tx, person, assigned, by, requestId) {
-            sameDb(tx);
-            const id = personKeyString(person);
-            if (assigned)
-                db.prepare("INSERT INTO hub_auditors(person_id, assigned_at, assigned_by) VALUES(?, ?, ?) ON CONFLICT(person_id) DO NOTHING").run(id, now(), canonical(by));
-            else
-                db.prepare("DELETE FROM hub_auditors WHERE person_id = ?").run(id);
-            write({ id: randomUUID(), sequence: 0, at: now(), requestId, actor: by, action: assigned ? "audit.auditor-assigned" : "audit.auditor-removed", result: "completed", policyVersion: 0, ownerAtEvent: person });
-        },
-        purge(retention, retained) {
-            for (const days of [retention.contentDays, retention.eventDays]) {
-                if (!Number.isSafeInteger(days) || days < 1)
-                    throw new Error("Hub retention must be whole days (no default)");
-            }
-            const t = now();
-            return db.transaction(() => {
-                const contentCut = t - retention.contentDays * DAY_MS;
-                const removedContent = db.prepare("DELETE FROM hub_audit_content WHERE created_at < ?").run(contentCut).changes;
-                const eventCut = t - retention.eventDays * DAY_MS;
-                let last;
-                for (const row of db.prepare("SELECT * FROM hub_audit WHERE at < ? ORDER BY sequence").iterate(eventCut)) {
-                    if (retained?.(toRecord(row)))
-                        break;
-                    last = row;
-                }
-                let removedEvents = 0;
-                if (last) {
-                    // A contiguous prefix only, so the chain verifies from the checkpoint onwards.
-                    const lowest = db.prepare("SELECT MIN(sequence) AS s FROM hub_audit").get().s;
-                    const gap = db.prepare("SELECT COUNT(*) AS n FROM hub_audit WHERE sequence BETWEEN ? AND ? AND at >= ?").get(lowest, last.sequence, eventCut);
-                    if (gap.n === 0) {
-                        db.prepare("INSERT INTO hub_audit_checkpoint(sequence, hash, at) VALUES(?, ?, ?) ON CONFLICT(sequence) DO NOTHING").run(last.sequence, last.hash, t);
-                        removedEvents = db.prepare("DELETE FROM hub_audit WHERE sequence <= ?").run(last.sequence).changes;
-                    }
-                }
-                write({ id: randomUUID(), sequence: 0, at: t, requestId: "retention", actor: { kind: "local-host" }, action: "audit.purge", result: "completed", policyVersion: 0, reasonCode: `content:${removedContent},events:${removedEvents}` });
-                return { content: removedContent, events: removedEvents };
-            }).immediate();
-        },
-    };
-}
-//# sourceMappingURL=index.js.map

package/dist/hub/audit/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hub/audit/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAC;AAG5D,MAAM,CAAC,MAAM,mBAAmB,GAAiB,MAAM,CAAC,MAAM,CAAC;IAC7D,SAAS,EAAE,UAAU;IACrB,OAAO,EAAE,CAAC;IACV,EAAE,CAAC,EAAqB;QACtB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BP,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACpE,MAAM,MAAM,GAAG,0BAA0B,CAAC;AAC1C,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,GAAG,gCAAgC;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAyBD,4EAA4E;AAC5E,SAAS,YAAY,CAAC,GAA2B;IAC/C,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,GAA2B;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,EAAiB;IACtC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa;IAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAA4B;QACvD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAkC;QAC9C,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAsCD,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtI,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEpC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;qHAGyF,CAAC,CAAC;IAErH,MAAM,IAAI,GAAG,GAAuC,EAAE;QACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,EAAoD,CAAC;QAChJ,OAAO,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,KAAK,GAAG,CAAC,MAAsB,EAAU,EAAE;QAC/C,IAAI,CAAC,EAAE,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9K,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;QACpB,MAAM,GAAG,GAA2B;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC;YAC3B,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE;YACzE,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,UAAU,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;YAC7F,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACpC,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;YAC9B,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAChC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACtC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YACjF,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAChC,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC5C,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACtC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACtC,kBAAkB,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAClF,SAAS,EAAE,IAAI,CAAC,IAAI;SACrB,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,EAAE,CAAC,OAAO,CAAC,+JAA+J,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpM,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC,CAAC;IAEF,+GAA+G;IAC/G,yFAAyF;IACzF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,OAA0B,EAAE,EAAE;QACnF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAClH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,KAAa,EAAE,IAAY,EAAqB,EAAE;QACvG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAsB,CAAC;IAChD,CAAC,CAAC;IAEF,mHAAmH;IACnH,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CAAC,GAAG,CAAgF,CAAC;QAC3L,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACjG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxD,EAAE,CAAC,OAAO,CAAC,qFAAqF,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpI,CAAC,CAAC;IAEF,+GAA+G;IAC/G,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,gBAAyB,EAAiC,EAAE;QAC1F,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CAAC,GAAG,CAAgF,CAAC;QAC3L,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,gBAAgB,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB;YAAE,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;QAClJ,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,EAAS,EAAE,EAAE;QAC3B,IAAI,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,OAAO,GAAoB;QAC/B,GAAG,CAAC,EAAE,EAAE,OAAO;YACb,MAAM,CAAC,EAAE,CAAC,CAAC;YACX,MAAM,KAAK,GAAsB,EAAE,CAAC;YACpC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAAE,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACtE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YACnE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;gBAAE,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAClD,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACjJ,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,GAAG;YACL,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;IAEF;;;;OAIG;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAsB,EAAiE,EAAE;QAC/G,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,mBAAmB,CAAC,2EAA2E,CAAC,CAAC;QAC3I,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC;IAClF,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAEjI,MAAM,UAAU,GAAG,CAAC,GAAsB,EAAE,KAA8B,EAAE,MAAc,EAAE,KAAK,GAA4B,EAAE,EAAE,EAAE;QACjI,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,KAAK,EAAoB,CAAC,CAAC;IAClK,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,EAAE,EAAE,MAAM;YACf,MAAM,CAAC,EAAE,CAAC,CAAC;YACX,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,CAAC;QAED,mBAAmB,CAAC,MAAM,EAAE,QAAQ;YAClC,IAAI,QAAQ,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,CAAC;QAED,OAAO;QAEP,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK;YACnB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAc,EAAE,CAAC;gBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;gBACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBACnC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC9B,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;gBACD,2EAA2E;gBAC3E,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnG,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,2BAA2B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAe,CAAC;gBAChK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ;YAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAyB,CAAC;gBACrG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;gBAC/G,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/G,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,MAAM,QAAQ,GAAgB,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAA4B,CAAC;gBAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAChD,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,cAAc,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzK,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC1K,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;QAED,WAAW;YACT,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,gFAAgF,CAAC,CAAC,GAAG,EAAoD,CAAC;YACxK,IAAI,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,OAAO,CAAC;YACvC,IAAI,QAAQ,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,CAA+B,EAAE,CAAC;gBAC9J,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;gBAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACxI,IAAI,GAAG,IAAI,CAAC;gBACZ,QAAQ,IAAI,CAAC,CAAC;gBACd,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;YACD,6GAA6G;YAC7G,oDAAoD;YACpD,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAED,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS;YAC5C,MAAM,CAAC,EAAE,CAAC,CAAC;YACX,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,QAAQ;gBAAE,EAAE,CAAC,OAAO,CAAC,iHAAiH,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;;gBACrK,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAoB,CAAC,CAAC;QAClO,CAAC;QAED,KAAK,CAAC,SAAS,EAAE,QAAQ;YACvB,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC;gBACtD,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;gBAChH,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,SAAS,GAAG,MAAM,CAAC;gBAClD,IAAI,IAA0B,CAAC;gBAC/B,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,OAAO,CAAC,QAAQ,CAA+B,EAAE,CAAC;oBACvI,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBAAE,MAAM;oBACrC,IAAI,GAAG,GAAG,CAAC;gBACb,CAAC;gBACD,IAAI,aAAa,GAAG,CAAC,CAAC;gBACtB,IAAI,IAAI,EAAE,CAAC;oBACT,+EAA+E;oBAC/E,MAAM,MAAM,GAAI,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;oBACjG,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,gFAAgF,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAkB,CAAC;oBAC/J,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChB,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;wBACrJ,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;oBACrG,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,cAAc,WAAW,aAAa,EAAE,EAAoB,CAAC,CAAC;gBACxP,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC5D,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hub/browser-certificate.d.ts

@@ -1,38 +0,0 @@
-/** Browser TLS selection only. The sealed Hub/member identity and member pins never change here. */
-import type Database from "better-sqlite3";
-import { type HubBrowserCertificateProposal, type HubBrowserCertificateView } from "../hub-browser-certificate-policy.js";
-import type { HubAuditStore } from "./audit/index.js";
-import type { HubMigration } from "./db.js";
-import { type HubBrowserMaterial } from "./init/browser-certificate.js";
-export interface BrowserCertificateMaterial {
-    cert: string;
-    key: string;
-}
-export interface HubBrowserCertificateControl {
-    read(): HubBrowserCertificateView;
-    prepare(input: unknown, binding: string, current: () => boolean): Promise<HubBrowserCertificateProposal>;
-    preview(input: unknown, binding: string): HubBrowserCertificateProposal;
-    apply(input: unknown, binding: string, current: () => boolean): HubBrowserCertificateView;
-}
-export declare function createHubBrowserCertificateControl(options: {
-    db: Database.Database;
-    home: string;
-    hubId: string;
-    origin: string;
-    initial: {
-        certificateFile: string;
-        keyFile: string;
-    };
-    audit: Pick<HubAuditStore, "appendInTransaction">;
-    current(): boolean;
-    now(): number;
-    activate(material: BrowserCertificateMaterial): void;
-    generate?(home: string, origin: string): Promise<HubBrowserMaterial>;
-    monotonic?: () => number;
-}): HubBrowserCertificateControl & {
-    material: () => BrowserCertificateMaterial;
-    activate(): void;
-    close(): Promise<void>;
-};
-/** Seed only when the migration itself runs, including an older initialized Hub's first upgrade. */
-export declare function browserCertificateMigration(hubId: string): HubMigration;